ARA-C01 Question 193
Single answerSnowpark Container ServicesA financial services company wants to deploy a fraud-scoring microservice inside Snowflake using Snowpark Container Services (SPCS). The service must score transactions in near real time by reading feature data from Snowflake tables and writing prediction results back to Snowflake. Security requirements state that no inbound access from the public internet is allowed, and the service should be reachable only by internal Snowflake clients. The architects also want to minimize data movement and operational complexity. Which approach best meets these requirements?
- A
Deploy the application as an SPCS service exposed through a public endpoint, and use external functions so the service can call back into Snowflake for feature reads and result writes.
- B
Deploy the application as an SPCS service with an internal endpoint, use the service's Snowflake access to read and write Snowflake data directly, and keep all inference processing inside Snowflake-managed compute.
- C
Package the model as a JavaScript UDF and expose it through Snowflake Marketplace so internal applications can invoke it without any service endpoint configuration.
- D
Run the model on a client-hosted Kubernetes cluster outside Snowflake and connect to Snowflake over private connectivity; this avoids public internet exposure while providing the same operational simplicity as SPCS.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to deploy the fraud-scoring application as a Snowpark Container Services service with an internal endpoint and direct Snowflake access. Snowpark Container Services is intended for containerized workloads that need custom libraries, model servers, APIs, or long-running services running close to Snowflake data. Using an internal endpoint satisfies the requirement that the service be reachable only by internal Snowflake clients, whereas a public endpoint would expose inbound access over the internet. This architecture also minimizes data movement because the service can interact with Snowflake data directly instead of exporting features to external platforms. As an architectural best practice, choose SPCS when you need a custom container runtime or service-based inference pattern, and prefer internal connectivity when the workload is only consumed within Snowflake. This matches Snowflake guidance around using service endpoints appropriately and leveraging Snowflake-managed execution for secure, low-movement data processing.
- A. Incorrect.
Incorrect. A public endpoint violates the stated requirement that no inbound access from the public internet be allowed. In addition, using external functions for a service already running inside Snowflake adds unnecessary complexity and data movement patterns. SPCS is designed so containerized services can run close to Snowflake data and, when configured appropriately, access Snowflake resources directly rather than routing through an external function pattern.
- B. Correct.
Correct. This design aligns with the requirements: an internal endpoint restricts access to internal Snowflake clients, avoiding public inbound exposure. Running the fraud-scoring service in Snowpark Container Services keeps compute near the data, minimizing data movement. SPCS services can be configured to access Snowflake data directly for reading features and writing predictions, which reduces operational overhead compared with managing separate infrastructure outside Snowflake.
- C. Incorrect.
Incorrect. JavaScript UDFs are not a substitute for deploying a containerized microservice when the workload requires a custom runtime, model-serving stack, or long-running service behavior typical of SPCS use cases. Publishing through Marketplace is unrelated to the internal-only network access requirement and does not address the need for a private service endpoint.
- D. Incorrect.
Incorrect. While hosting the model externally with private connectivity could satisfy the no-public-inbound requirement, it does not minimize operational complexity compared with SPCS because the team must manage external infrastructure, deployment, scaling, and integration separately. The scenario explicitly prefers keeping inference processing inside Snowflake-managed compute and minimizing data movement.