SnowPro Advanced: Security Engineer Question 154
Single answerLeverage account-level parameters to restrict the destinations where Snowflake can write data programmaticallyA security team needs to reduce the risk of data exfiltration from a Snowflake account. Several engineering teams use programmatic unload operations such as COPY INTO
- A
Set the PREVENT_UNLOAD_TO_INLINE_URL account parameter to TRUE and configure ALLOWED_LOCATIONS at the account level with the approved cloud storage URLs.
- B
Set the PREVENT_UNLOAD_TO_INLINE_URL account parameter to TRUE and set PREVENT_UNLOAD_TO_INTERNAL_STAGES to TRUE.
- C
Create storage integrations only for approved buckets and rely on developers to avoid using inline URLs in COPY INTO statements.
- D
Use network policies so Snowflake clients can connect only from corporate IP addresses before performing unload operations.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use account-level controls designed specifically for outbound data writes. In Snowflake, PREVENT_UNLOAD_TO_INLINE_URL prevents ad hoc unloads to arbitrary external cloud storage URLs, which is a key exfiltration risk. To further constrain destinations, ALLOWED_LOCATIONS can be used as an account-level allowlist for supported operations that write to external locations. This aligns with the requirement to centrally restrict where Snowflake can write data programmatically, independent of individual user choices. By contrast, PREVENT_UNLOAD_TO_INTERNAL_STAGES affects internal staging behavior, not approved external destinations. Storage integrations are important for secure access delegation and should be used as a best practice, but the scenario explicitly asks for an account-level restriction on destinations. Network policies govern access into Snowflake, not where Snowflake sends data. These controls are documented in Snowflake guidance on account parameters for unload restrictions and external location allowlisting.
- A. Correct.
Correct. PREVENT_UNLOAD_TO_INLINE_URL=TRUE prevents users from unloading directly to ad hoc cloud storage URLs in statements such as COPY INTO 's3://...'. To further restrict where Snowflake can write data programmatically, the account-level ALLOWED_LOCATIONS parameter can be set to an allowlist of approved destinations. This combination addresses the requirement to centrally restrict write destinations at the account level rather than depending on user behavior or object-level controls alone.
- B. Incorrect.
Incorrect. PREVENT_UNLOAD_TO_INLINE_URL=TRUE is relevant because it blocks direct unloads to ad hoc external URLs. However, PREVENT_UNLOAD_TO_INTERNAL_STAGES=TRUE blocks unloading to internal stages, not restriction of external cloud destinations to an approved list. This option would not satisfy the requirement to allow writes only to specific approved external locations.
- C. Incorrect.
Incorrect. Using storage integrations for approved buckets is a good practice, but by itself it does not fully meet the stated requirement of enforcing restrictions at the account level regardless of how users attempt to write data. Without the relevant account-level restriction, users could still attempt to use inline URLs if not otherwise blocked. This option depends too much on process and developer compliance.
- D. Incorrect.
Incorrect. Network policies control the client network locations from which users can connect to Snowflake. They do not restrict the external storage destinations to which Snowflake can write data. This is a common misconception because both are security controls, but they address different risks.