ARA-C01 Question 9
Single answerAccount parametersA Snowflake architect is reviewing security settings after an internal audit. The auditors found that some users can still authenticate with only a password, even though the company policy now requires multi-factor authentication (MFA) for all human users. The company also has several service accounts used by ETL tools that must continue to connect non-interactively. The architect wants to enforce the requirement centrally with the least operational overhead while avoiding disruption to service accounts. Which action should the architect take?
- A
Set the account parameter REQUIRE_MULTI_FACTOR_AUTHENTICATION = TRUE, and move all service accounts to key pair authentication or another non-human authentication method as needed.
- B
Set the account parameter SSO_LOGIN_PAGE = TRUE, because redirecting users to SSO automatically enforces MFA for all users and service accounts.
- C
Set the account parameter NETWORK_POLICY = strict_mfa_policy, because network policies can require MFA based on user type.
- D
Set the account parameter CLIENT_SESSION_KEEP_ALIVE = FALSE, because reducing session duration forces users to reauthenticate with MFA more frequently.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use the account parameter REQUIRE_MULTI_FACTOR_AUTHENTICATION to centrally enforce MFA for user logins. This is the most direct account-parameter-based control for the stated requirement. In practice, architects must also account for non-human service accounts, which typically should not depend on interactive MFA challenges. A common best practice is to migrate those accounts to an appropriate non-interactive authentication mechanism, such as key pair authentication, and to review whether those accounts truly require direct user credentials at all.
The other options confuse related but distinct controls. SSO-related parameters influence login flow but do not inherently enforce MFA across all scenarios; MFA in SSO is often governed at the identity provider. Network policies govern where connections can originate, not how users authenticate. Session keep-alive settings affect usability and session lifecycle, not authentication strength.
This aligns with Snowflake best practices around centralized security controls, least operational overhead, and separating human interactive authentication requirements from service-to-service authentication design.
- A. Correct.
Correct. The account-level parameter REQUIRE_MULTI_FACTOR_AUTHENTICATION is the central control used to require MFA for user authentications. In a real environment, this should be paired with an authentication approach for non-interactive service accounts that does not rely on human MFA prompts, such as key pair authentication where appropriate. This meets the audit requirement with centralized governance while minimizing manual per-user administration.
- B. Incorrect.
Incorrect. SSO_LOGIN_PAGE controls whether users are directed to the SSO login experience, but it does not itself guarantee MFA enforcement. MFA enforcement in federated environments is typically handled by the identity provider, and this setting does not solve the requirement for all authentication paths. It also does not address how non-interactive service accounts should authenticate.
- C. Incorrect.
Incorrect. NETWORK_POLICY is used to restrict access by IP address, CIDR block, or related network conditions. It is not an MFA control and cannot require MFA based on whether an account is human or service-based. This is a plausible distractor because both are account-level security controls, but they govern different concerns.
- D. Incorrect.
Incorrect. CLIENT_SESSION_KEEP_ALIVE affects session persistence behavior for supported clients and can influence how long sessions remain active, but it does not enforce MFA. Shorter-lived sessions are not a substitute for an MFA requirement and would not satisfy the audit finding.