ARA-C01 Question 111
Single answerMulti-Factor Authentication (MFA)A global enterprise is tightening access controls for its Snowflake account after an internal audit found that several administrators still connect with only usernames and passwords. The security team wants to reduce the risk of credential theft for interactive access to Snowsight and the Classic Console, but they must avoid disrupting service accounts used by automated ETL jobs. Which action should the Snowflake architect recommend to meet these requirements?
- A
Enable Snowflake MFA for all users in the account, including service accounts, so every authentication path has the same control.
- B
Require key-pair authentication for all users, because key-pair authentication replaces the need for MFA for interactive administrators.
- C
Enable Snowflake MFA and enforce it for human users who access Snowflake interactively, while keeping non-interactive service accounts on supported programmatic authentication methods such as key-pair authentication.
- D
Use network policies only, because restricting source IP addresses provides equivalent protection against stolen passwords for administrator sign-ins.
Show answer and explanation
Correct answer: C
Explanation
The best recommendation is to enforce MFA for human users, especially administrators and other privileged users, while preserving non-interactive authentication methods for service accounts. In Snowflake, MFA is designed to strengthen interactive authentication flows such as access to Snowsight and the Classic Console. Automated jobs and integrations should typically use programmatic methods like key-pair authentication, which avoid the operational problem of requiring a second factor for unattended execution. This reflects the principle of applying stronger authentication to interactive identities and using purpose-appropriate credentials for machine identities. Snowflake documentation and security best practices emphasize MFA for users, especially privileged users, and recommend key-pair authentication or other supported non-interactive methods for service accounts rather than attempting to force MFA into automation workflows.
- A. Incorrect.
Incorrect. Applying MFA uniformly to all users sounds secure, but it is not practical for non-interactive service accounts running unattended ETL or integrations. Service accounts typically use programmatic authentication methods and cannot reliably complete an MFA challenge during automated execution. This option would likely break automation and does not reflect Snowflake best practice for separating interactive and non-interactive access patterns.
- B. Incorrect.
Incorrect. Key-pair authentication is a strong authentication method for programmatic access and is commonly recommended for service users, but it does not replace MFA requirements for human interactive users signing in through the UI. Administrators using Snowsight or the Classic Console should still be protected with MFA to mitigate the risk of compromised passwords and phishing-based credential reuse.
- C. Correct.
Correct. This approach aligns security controls with how identities are actually used. Snowflake MFA is intended to protect interactive user authentication, especially privileged users accessing the web UI. At the same time, service accounts for unattended workloads should use supported non-interactive authentication methods such as key-pair authentication rather than MFA prompts. This design improves security without disrupting automated processes.
- D. Incorrect.
Incorrect. Network policies are valuable as an additional control, but they are not equivalent to MFA. IP restrictions can reduce exposure, yet they do not protect against password theft when an attacker operates from an allowed network or through a compromised corporate device or VPN. MFA specifically addresses the weakness of password-only authentication for interactive sign-ins.