ARA-C01 Question 97
Single answerGoogle Cloud Private Service ConnectA company runs Snowflake on Google Cloud and must allow analysts in a Google Cloud VPC to connect to Snowflake without sending traffic over the public internet. The security team also wants to limit access so that only approved VPCs can reach the Snowflake service, and they want connectivity to remain private even when users resolve the Snowflake account URL from inside the VPC. Which solution best meets these requirements?
- A
Configure Google Cloud Private Service Connect (PSC) endpoints in the client VPC for Snowflake, and use the corresponding private connectivity URL/DNS configuration so clients resolve the account hostname to the PSC endpoint.
- B
Create a VPC peering connection from the client VPC directly to Snowflake's Google Cloud VPC, then use the standard Snowflake account URL because peering automatically keeps DNS private.
- C
Publish Snowflake through an internal TCP load balancer in the customer VPC and route traffic to Snowflake over Cloud NAT so the connection stays private.
- D
Use a site-to-site VPN from the client VPC to the internet-facing Snowflake account URL and restrict access with VPC firewall rules on the client side.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Google Cloud Private Service Connect for Snowflake and ensure DNS/private URL configuration points clients to the PSC endpoint. In Snowflake on GCP, PSC is the supported mechanism for private inbound connectivity from customer VPCs to Snowflake. A key implementation detail is that network connectivity alone is not enough: clients must resolve the Snowflake account hostname to the private endpoint, typically through Snowflake-provided private connectivity URLs and customer DNS configuration. This avoids accidental use of the public endpoint.
Why the other options fail:
- Direct VPC peering is not the Snowflake private connectivity model for GCP.
- Cloud NAT is for outbound internet egress, not private SaaS service consumption.
- VPN to a public endpoint may provide encryption, but it does not provide the same private service consumption model as PSC.
This aligns with Snowflake guidance for private connectivity on Google Cloud using Private Service Connect and Google Cloud best practices for private service access, where private DNS resolution is an essential part of a functional design.
- A. Correct.
Correct. For Snowflake on Google Cloud, Private Service Connect provides private connectivity from consumer VPCs to Snowflake without traversing the public internet. To make the solution work end to end for users, the client must also use the Snowflake private connectivity URL or appropriate private DNS configuration so the Snowflake hostname resolves to the PSC endpoint rather than to a public address. PSC also aligns with controlled access patterns because connectivity is established through approved endpoints and service attachments rather than broad public exposure.
- B. Incorrect.
Incorrect. Customers do not directly peer their VPC to Snowflake's managed Google Cloud VPC for this use case. Snowflake private connectivity on GCP uses Private Service Connect, not direct VPC peering from the customer to Snowflake. In addition, standard public DNS resolution would not automatically become private just because peering exists; DNS behavior must be explicitly addressed.
- C. Incorrect.
Incorrect. Customers cannot front Snowflake with their own internal load balancer and then send traffic privately via Cloud NAT. Cloud NAT provides outbound internet access for private resources; it does not create private connectivity to Snowflake. This option mixes unrelated GCP networking components and reflects a common misconception that NAT can make an external SaaS connection private.
- D. Incorrect.
Incorrect. A site-to-site VPN can encrypt traffic in transit, but connecting to Snowflake's public endpoint over VPN does not satisfy the requirement to avoid the public internet path in the same way PSC does. Client-side firewall rules also do not make the Snowflake service private or restrict Snowflake exposure at the provider side. This is a plausible security approach, but it does not meet the stated private connectivity and private resolution requirements.