SnowPro Advanced: Security Engineer Question 153
Select 22.3 Restrict data exfiltration.A financial services company allows analysts to export approved result sets to a controlled Amazon S3 bucket for downstream processing. During a security review, the team discovers that several power users can create arbitrary external stages and use COPY INTO to unload sensitive query results to storage locations outside the company’s control. The security engineer must reduce the risk of data exfiltration while still allowing approved unloads to the company-managed S3 bucket. Which TWO actions should the security engineer implement?
- A
Create a network rule that allows only corporate IP ranges and require users to connect from those locations before running COPY INTO commands.
- B
Grant users access only to a named external stage that points to the approved S3 bucket, and remove privileges that allow them to create their own external stages.
- C
Use a storage integration tied to the approved S3 location and grant USAGE on that integration only to tightly controlled roles.
- D
Enable Tri-Secret Secure so exported files can be decrypted only with the company’s cloud KMS key.
- E
Require all users to access Snowflake with MFA so they cannot unload data to unapproved cloud storage.
Show answer and explanation
Correct answers: B, C
Explanation
To restrict data exfiltration in Snowflake, the most effective controls are those that limit where data can be unloaded and who can define those destinations. In this scenario, users should be restricted to approved named external stages rather than being allowed to create arbitrary external stages. Using a storage integration for the approved S3 bucket is also a Snowflake best practice because it centralizes trust and limits cloud storage access to explicitly configured locations. Together, these controls enforce least privilege and reduce the chance of COPY INTO being used to exfiltrate data to unauthorized storage. Network restrictions, MFA, and encryption are valuable security measures, but they do not directly constrain unload destinations. Relevant Snowflake guidance includes best practices for external stages, storage integrations, access control via roles and privileges, and secure data unloading patterns.
- A. Incorrect.
Incorrect. Restricting client access by IP with network rules or network policies can reduce unauthorized logins, but it does not directly prevent a legitimate user from unloading data to an arbitrary external location if that user still has the privileges to create or use external stages. This control addresses session origin, not the unload destination. A candidate might choose this because network controls are important for security, but they are not the primary Snowflake control for limiting exfiltration through COPY INTO external locations.
- B. Correct.
Correct. Limiting users to a preapproved named external stage is a direct way to control where data can be unloaded. If users do not have privileges to create external stages or use other stages, they cannot point COPY INTO to arbitrary cloud storage destinations. This is a practical least-privilege approach for restricting exfiltration while preserving an approved export path.
- C. Correct.
Correct. Storage integrations are a best practice for controlling and securing access to cloud storage from Snowflake. By defining an integration for the approved S3 bucket and restricting USAGE on that integration to specific roles, the organization can centralize and limit which storage locations Snowflake can access for unload operations. Combined with controlled stage privileges, this significantly reduces exfiltration risk.
- D. Incorrect.
Incorrect. Tri-Secret Secure adds an additional key management layer for Snowflake data at rest, but it does not control where users can unload query results. It is not a mechanism for restricting external stages, COPY INTO destinations, or outbound data movement to cloud storage. Someone might pick this because encryption is related to data protection, but it does not solve destination control.
- E. Incorrect.
Incorrect. MFA strengthens authentication and reduces account takeover risk, but it does not restrict an authenticated user’s ability to export data if their role still permits it. This is a common misconception: strong authentication helps ensure the right user logs in, but authorization and object design are what restrict exfiltration paths.