ARA-C01 Question 85
Single answerNetwork rulesA security architect is configuring outbound connectivity from Snowflake to an external REST API that is hosted at api.partner-example.com. The partner rotates the service IP addresses behind the DNS name, so the architect wants to avoid maintaining IP-based allowlists. The architect also wants to ensure Snowflake can call only this specific host through the external access integration used by a Python UDF. Which configuration best meets these requirements?
- A
Create a NETWORK RULE with TYPE = HOST_PORT and MODE = EGRESS for api.partner-example.com, associate it with an EXTERNAL ACCESS INTEGRATION, and reference that integration from the UDF.
- B
Create a NETWORK RULE with TYPE = IPV4 and MODE = INGRESS for the current IP addresses of api.partner-example.com, and attach it to the user who owns the UDF.
- C
Create a NETWORK POLICY that allows api.partner-example.com, and assign the policy to the database that contains the UDF.
- D
Create a NETWORK RULE with TYPE = AWSVPCEID and MODE = EGRESS for the partner's public endpoint, and add it directly to the UDF definition without an integration.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use a network rule that allows outbound access by hostname rather than IP, then expose that rule through an external access integration consumed by the Python UDF. In Snowflake, network rules are reusable schema-level objects used in several networking contexts. For external network access, the architect should define an EGRESS network rule using TYPE = HOST_PORT when the target is a public DNS host and the goal is to avoid brittle IP-based controls. The external access integration then references the allowed network rule objects and is what the UDF or procedure uses at runtime.
Key distinctions that matter on the exam and in practice:
- Network rules + external access integrations govern outbound connectivity from handler code to external services.
- Network policies govern inbound client access to Snowflake accounts and users; they do not control where Snowflake code can send requests.
- HOST_PORT is appropriate for DNS/host-based outbound restrictions; IPV4 is more operationally expensive when endpoint IPs change.
- Private connectivity identifiers such as cloud private endpoint IDs are only relevant when the architecture uses private connectivity, not a normal public API hostname.
This aligns with Snowflake documentation on external network access, external access integrations, and network rules, including the distinction between ingress controls for client connectivity and egress controls for outbound access from Snowflake-managed code.
- A. Correct.
Correct. For outbound access from Snowflake code such as Python UDFs and stored procedures, Snowflake uses external network access controls built around network rules and external access integrations. A HOST_PORT network rule in EGRESS mode is appropriate when restricting access by hostname and port, which is ideal when the partner rotates IPs behind a stable DNS name. The external access integration references the allowed network rule, and the UDF must use that integration to make outbound calls.
- B. Incorrect.
Incorrect. This option mixes multiple concepts incorrectly. IPV4 rules are useful when controlling by IP address, but the scenario explicitly wants to avoid IP maintenance because the partner rotates addresses. In addition, MODE = INGRESS is for incoming client connectivity controls, not outbound calls from Snowflake to external services. Finally, network rules for external access are not attached to a user who owns the UDF in this way.
- C. Incorrect.
Incorrect. Network policies are used to control client access to Snowflake, such as restricting where users can connect from, not to define outbound destinations for UDFs or stored procedures. They also are not assigned to databases for this purpose. This distractor reflects a common confusion between network policies and network rules used by external access integrations.
- D. Incorrect.
Incorrect. AWSVPCEID is used for private connectivity scenarios involving specific cloud private endpoint identifiers, not for a standard public hostname-based REST endpoint. Also, outbound access from a UDF is governed through an external access integration; you do not add a network rule directly to the UDF without the integration layer.