ARA-C01 Question 86
Single answerNetwork rulesA financial services company uses Snowflake and wants to tightly control outbound access from handler code used by external network integrations. The security team requires that Python UDFs and stored procedures be allowed to call only the vendor API endpoints api.riskscore.example.com on port 443 and auth.riskscore.example.com on port 443. They also want the configuration to be reusable and easy to audit before associating it with an external access integration. Which approach should the architect recommend?
- A
Create a NETWORK RULE in EGRESS mode with TYPE = HOST_PORT that includes api.riskscore.example.com:443 and auth.riskscore.example.com:443, then reference that rule from the external access integration.
- B
Create a NETWORK POLICY that allows api.riskscore.example.com and auth.riskscore.example.com, then attach the policy to the external access integration.
- C
Create a NETWORK RULE in INGRESS mode with TYPE = IPV4 that contains the public IP addresses for the vendor endpoints, then reference that rule from the external access integration.
- D
Create a NETWORK RULE in EGRESS mode with TYPE = AWSVPCEID for the vendor service, then reference that rule from the external access integration.
Show answer and explanation
Correct answer: A
Explanation
Snowflake network rules are reusable schema-level objects that define allowed or blocked network locations for specific use cases. In the context of external network access for Python/Java handlers such as UDFs and stored procedures, an external access integration references allowed network rules. For public API destinations identified by DNS name and port, best practice is to create an egress network rule with TYPE = HOST_PORT and list only the required endpoints, such as api.riskscore.example.com:443 and auth.riskscore.example.com:443. This gives least-privilege outbound access and supports easier auditing. By contrast, network policies govern who can connect to Snowflake, not where Snowflake handler code can connect outbound. INGRESS rules and AWSVPCEID are for different scenarios. Relevant Snowflake documentation includes topics on CREATE NETWORK RULE, network rule modes and types, and external network access integrations.
- A. Correct.
Correct. For outbound connectivity used by external network access from Snowflake handler code, Snowflake uses network rules that can be referenced by an external access integration. When the requirement is to permit access to specific hostnames and ports, the appropriate rule is an egress network rule with TYPE = HOST_PORT. This is the most precise and auditable design because it explicitly enumerates the allowed destinations and ports rather than allowing broader IP ranges.
- B. Incorrect.
Incorrect. A network policy is used to restrict client access into Snowflake, typically by controlling which client IP addresses can connect to the Snowflake service. It is not the object used to define outbound destinations for handler code or to be attached to an external access integration. This option reflects a common confusion between inbound client access controls and outbound external access controls.
- C. Incorrect.
Incorrect. INGRESS mode is not appropriate for defining outbound destinations that handler code can call. In addition, using TYPE = IPV4 for vendor endpoints that are specified as hostnames is less maintainable and can break if the vendor changes underlying IP addresses. For external access integrations that need to permit calls to named API endpoints, HOST_PORT in EGRESS mode is the intended pattern.
- D. Incorrect.
Incorrect. TYPE = AWSVPCEID is used in specific private connectivity scenarios involving AWS PrivateLink endpoint identifiers, not for standard public HTTPS API endpoints identified by hostname. Because the scenario explicitly names public vendor API hostnames and requires access on port 443, HOST_PORT is the correct and simpler choice.