ARA-C01 Question 82
Select 2Network securityA financial services company is deploying a business-critical Snowflake workload on AWS. The security team has mandated that users and applications must connect only through private network paths and that access from the public internet must be blocked. The company also needs to allow connectivity from its on-premises data center over a private connection to AWS. Which TWO actions should the architect recommend to meet these requirements?
- A
Configure AWS PrivateLink for Snowflake and have clients use the account's private connectivity URL.
- B
Create a network policy that allows only the organization's public NAT IP addresses and apply it to all users.
- C
Establish private connectivity from the on-premises environment to AWS using AWS Direct Connect or a VPN to the VPCs that host the PrivateLink endpoints.
- D
Enable Tri-Secret Secure so that Snowflake traffic is forced over private network paths.
- E
Use a storage integration with private S3 endpoints to ensure all Snowflake user connections avoid the public internet.
Show answer and explanation
Correct answers: A, C
Explanation
The best answer is to combine Snowflake private connectivity on AWS with private enterprise networking into AWS. AWS PrivateLink is the Snowflake-supported mechanism for ensuring client connections use private paths instead of the public internet. When on-premises connectivity is also required, the organization must extend its private network to AWS, commonly through AWS Direct Connect or a VPN-based design, so clients can reach the PrivateLink endpoints privately. Network policies are useful for restricting allowed source IP addresses, but they do not by themselves eliminate public internet exposure. Likewise, Tri-Secret Secure addresses encryption key management, not network routing. Snowflake documentation on private connectivity and network policies distinguishes these controls clearly: private connectivity secures the path, while network policies constrain who can connect based on IP rules.
- A. Correct.
Correct. On AWS, Snowflake supports private connectivity through AWS PrivateLink. This allows clients to connect to Snowflake using private IP-based connectivity rather than traversing the public internet. To satisfy the requirement, the architect should configure the account for PrivateLink and direct users/applications to the private connectivity URL.
- B. Incorrect.
Incorrect. A network policy that restricts access to approved public IP addresses can reduce exposure, but it still relies on internet-routable connectivity. The scenario explicitly requires private network paths only and blocking public internet access, so network policies alone do not meet the requirement.
- C. Correct.
Correct. For on-premises users to reach Snowflake privately through AWS PrivateLink, the enterprise must first establish private connectivity into AWS, typically via AWS Direct Connect or, in some architectures, a VPN to the relevant AWS network path hosting the interface endpoints. This is the practical way to extend private access from on premises to Snowflake.
- D. Incorrect.
Incorrect. Tri-Secret Secure is a key management/encryption feature, not a network transport control. It helps meet encryption and key custody requirements, but it does not force client sessions to use private connectivity or prevent internet-based access.
- E. Incorrect.
Incorrect. Storage integrations and private S3 access relate to how Snowflake accesses external cloud storage, not how end users or applications connect to the Snowflake service endpoint. This option confuses data access path controls with client-to-Snowflake network connectivity.