ARA-C01 Question 321
Single answerUse of system$allowlistA company is enabling PrivateLink connectivity between its AWS environment and Snowflake. The network team wants to tighten outbound firewall rules so application servers can reach Snowflake only through approved private endpoints. Before making the change, the Snowflake architect needs to provide the network team with the exact hostnames that Snowflake requires for the account and related services over the private connection. Which approach should the architect take?
- A
Run the SYSTEM$ALLOWLIST function for the account and use its returned hostnames to build the firewall allowlist for the required Snowflake endpoints
- B
Query ACCOUNT_USAGE views to retrieve all Snowflake service endpoints, because SYSTEM$ALLOWLIST is intended only for external functions
- C
Use SHOW NETWORK POLICIES to list the private endpoints that Snowflake publishes for the account, then allow those DNS names in the firewall
- D
Manually derive the required hostnames from the account URL and region identifier, because SYSTEM$ALLOWLIST returns only IP addresses
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use SYSTEM$ALLOWLIST to obtain the Snowflake hostnames that must be allowlisted by the customer's network controls. This is especially relevant when configuring restricted egress rules or private connectivity such as AWS PrivateLink. From an architect's perspective, the key point is that Snowflake provides a supported function to identify the necessary endpoints rather than requiring administrators to infer or manually build them.
A common mistake is to confuse Snowflake network policies with outbound firewall configuration. Network policies govern which client source IP addresses may connect to Snowflake, while SYSTEM$ALLOWLIST helps identify destination hostnames the client's environment must permit. Another common misconception is that account metadata or manually derived URLs are sufficient; however, best practice is to use the documented system function so the allowlist reflects the actual service endpoints required by Snowflake. Refer to Snowflake documentation on SYSTEM$ALLOWLIST and private connectivity/PrivateLink configuration guidance for the supported workflow.
- A. Correct.
Correct. SYSTEM$ALLOWLIST is used to return the hostnames that should be allowlisted for connecting to Snowflake services, including scenarios where customers need to configure network controls such as firewalls or private connectivity. In a PrivateLink deployment, this is the appropriate way to obtain the exact Snowflake hostnames that the client side may need to access, rather than guessing them or trying to infer them from account naming conventions.
- B. Incorrect.
Incorrect. ACCOUNT_USAGE views do not provide a supported mechanism to enumerate the Snowflake service hostnames that clients must allowlist for connectivity. This option reflects a common misconception that metadata views can be used to discover all platform-managed endpoints. SYSTEM$ALLOWLIST is the relevant built-in function for this purpose, not a usage view query.
- C. Incorrect.
Incorrect. SHOW NETWORK POLICIES displays Snowflake network policy objects that control which client IP addresses can connect to Snowflake. It does not publish the service endpoint hostnames required for PrivateLink or firewall allowlisting. This distractor targets confusion between inbound access control to Snowflake and outbound destination allowlisting from client environments.
- D. Incorrect.
Incorrect. The required hostnames should not be manually derived. Snowflake can require multiple service hostnames, and relying on naming assumptions is error-prone. Also, SYSTEM$ALLOWLIST does not merely return IP addresses; it is intended to provide the hostnames customers should allowlist. Manually constructing endpoint names risks missing required entries and causing connectivity failures.