ARA-C01 Question 105
Single answerFederated authenticationA global enterprise uses Okta as its corporate identity provider and has configured SAML 2.0 federated authentication for Snowflake. The security team wants to reduce the risk of users authenticating through Snowflake with passwords that are not governed by Okta MFA policies. At the same time, a small number of service accounts used by batch integrations must continue to authenticate non-interactively with username and password. Which configuration approach best meets these requirements?
- A
Set SSO_REQUIRED = TRUE at the account level so all users, including service accounts, must use federated authentication.
- B
Set SSO_REQUIRED = TRUE only for human users who should authenticate through Okta, and leave service accounts without this setting so they can continue using password-based authentication.
- C
Disable passwords for all Snowflake users and use key-pair authentication for both human users and service accounts.
- D
Configure network policies to allow only Okta IP addresses, which will force all human users to authenticate through federated SSO while preserving password logins for service accounts.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to enforce federated authentication selectively for human users by setting the Snowflake user property SSO_REQUIRED = TRUE on those identities, while leaving batch/service accounts configured for native Snowflake authentication as needed. This design is commonly used when enterprises want workforce identities governed by the corporate IdP, including MFA and conditional access, but still need non-interactive accounts for legacy or automated integrations. In Snowflake, SAML 2.0 federated authentication enables SSO through an external IdP such as Okta, and SSO_REQUIRED helps prevent users from bypassing that control by logging in with a Snowflake password. Account-wide enforcement would be too broad in this scenario because it would also impact service accounts. Relevant Snowflake documentation covers federated authentication with SAML, user-level SSO enforcement using SSO_REQUIRED, and the distinction between authentication controls and network policies.
- A. Incorrect.
Incorrect. Setting SSO_REQUIRED = TRUE at the account level would enforce SSO for all users in the account, including service accounts. That conflicts with the requirement that certain batch integration accounts must continue using non-interactive username/password authentication. This option reflects a common misunderstanding that account-wide enforcement can selectively exempt specific users; it cannot unless you avoid applying it globally.
- B. Correct.
Correct. Snowflake supports the SSO_REQUIRED user property to require federated authentication for specific users. Applying it to human users helps prevent fallback to native Snowflake password authentication, ensuring their access is governed by the IdP's MFA and sign-in policies. Leaving service accounts without SSO_REQUIRED allows them to continue authenticating with Snowflake-native credentials where needed for non-interactive workloads. This is the most targeted approach that satisfies both security and operational requirements.
- C. Incorrect.
Incorrect. Human users do not typically use key-pair authentication for interactive access in place of SAML SSO, and the scenario specifically states the organization already uses Okta with SAML federated authentication. Also, the requirement says service accounts must continue with username/password, not be migrated to key-pair authentication. While key-pair authentication is valid for some programmatic use cases, it does not match the stated requirements.
- D. Incorrect.
Incorrect. Network policies restrict where connections can originate, but they do not force SAML-based authentication or prevent users from using Snowflake passwords if password authentication is otherwise allowed. Okta authentication occurs through an identity flow, not by simply originating from Okta IP ranges. This option confuses network-level controls with authentication-method enforcement.