ARA-C01 Question 102
Single answerAuthenticationA global enterprise uses Snowflake for analytics across several business units. The security team has mandated the following for all human users: centralized identity management with the corporate IdP, no Snowflake-managed passwords, and support for users accessing multiple Snowflake accounts without repeated sign-ins during the same browser session. Service accounts used by automated ETL jobs must continue to authenticate non-interactively. Which authentication approach best meets these requirements with the least operational overhead?
- A
Configure federated authentication with the corporate IdP for human users, enable SSO across Snowflake accounts, and use key-pair authentication for service accounts.
- B
Enable MFA on all Snowflake local users, disable password caching in clients, and use username/password authentication for service accounts.
- C
Use External OAuth for all users and service accounts so Snowflake no longer needs to manage any user identities.
- D
Configure SCIM provisioning from the corporate IdP and keep Snowflake username/password authentication enabled for all users to provide a fallback option.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to combine federated authentication for human users with key-pair authentication for service accounts. In Snowflake, federated authentication using a SAML 2.0-compliant identity provider is the standard approach for enterprise SSO. This satisfies centralized identity management and removes the need for Snowflake-managed passwords for human users. Snowflake also supports single sign-on across multiple Snowflake accounts, reducing repeated sign-ins when users access more than one account in the same browser session. For automated ETL and other non-interactive processes, key-pair authentication is a common best practice because it is designed for programmatic access and avoids password rotation challenges. SCIM is complementary for provisioning but not a substitute for authentication. External OAuth is valid for certain application integration patterns, but it is not the most direct or lowest-overhead solution for this specific mix of interactive enterprise users and non-interactive service accounts. These align with Snowflake best practices around SSO/federation, key-pair authentication for service users, and account-level authentication architecture.
- A. Correct.
Correct. Federated authentication with SAML 2.0 allows Snowflake to delegate authentication for human users to the corporate IdP, which satisfies centralized identity management and avoids Snowflake-managed passwords for those users. Snowflake also supports SSO across multiple Snowflake accounts so users can access more than one account without signing in again during the same browser session, assuming the accounts are configured appropriately with the same IdP context. For non-interactive automated workloads, key-pair authentication is a standard best practice because it avoids interactive login flows and is designed for programmatic access.
- B. Incorrect.
Incorrect. MFA on Snowflake local users improves security, but it does not satisfy the requirement to avoid Snowflake-managed passwords or centralize authentication in the corporate IdP. It also does not address seamless SSO across multiple Snowflake accounts in the same way federated SSO does. Using username/password for service accounts is operationally heavier and generally less secure than key-pair authentication for automation.
- C. Incorrect.
Incorrect. External OAuth is useful for authorizing client applications to access Snowflake using OAuth tokens, but it is not the best fit here for all human interactive access plus all service accounts. The requirement is specifically about centralized human authentication via the corporate IdP and cross-account browser SSO, which is more directly addressed by federated SSO. Also, saying Snowflake no longer needs to manage any user identities is misleading; user objects and authorization still exist in Snowflake even when authentication is delegated.
- D. Incorrect.
Incorrect. SCIM helps automate user and group provisioning but does not perform user authentication by itself. Keeping Snowflake username/password enabled for all users conflicts with the requirement of no Snowflake-managed passwords for human users. While some organizations retain break-glass access under tightly controlled conditions, that is not what the scenario asks for, and enabling local passwords for all users increases operational and security complexity.