SnowPro Advanced: Security Engineer Question 155
Single answerLeverage account-level parameters to restrict the destinations where Snowflake can write data programmaticallyA security engineer at a financial services company must prevent developers from using Snowflake features to write data to unapproved external cloud storage locations. The company allows data exports only to a small set of vetted Amazon S3 buckets and Azure Blob Storage containers managed by central IT. Security leadership wants an account-level control that restricts where Snowflake can write data programmatically, while still allowing approved integrations to function. Which action should the security engineer take?
- A
Configure the EXTERNAL_ACCESS_ALLOWED_LOCATIONS account parameter with the approved S3 buckets and Azure containers.
- B
Configure the PREVENT_UNLOAD_TO_INLINE_URL account parameter and the PREVENT_UNLOAD_TO_INTERNAL_STAGES account parameter as needed, then require unloads to use approved named external stages.
- C
Create network rules for the approved cloud storage endpoints and attach them to all users who perform COPY INTO commands.
- D
Set the ALLOW_CLIENT_MFA_CACHING account parameter to FALSE so exports can occur only through centrally managed sessions.
- E
Restrict users to warehouses with resource monitors so large data exports to unapproved destinations are blocked automatically.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use the Snowflake account-level parameters designed to restrict unload behavior: PREVENT_UNLOAD_TO_INLINE_URL and, where appropriate, PREVENT_UNLOAD_TO_INTERNAL_STAGES. In practice, organizations that need strict control over data egress commonly disable ad hoc unloads to inline cloud storage URLs and require users or applications to unload only through approved named external stages that point to vetted storage locations. This aligns with the principle of centralized governance and least privilege.
This is the most direct way to satisfy the requirement to restrict destinations where Snowflake can write data programmatically. Named external stages can be tightly administered, and the account parameters help enforce that users cannot bypass those governed objects with arbitrary URLs. Snowflake documentation on unloading data and account parameters describes these controls and their use in securing data export paths.
- A. Incorrect.
Incorrect. EXTERNAL_ACCESS_ALLOWED_LOCATIONS is not the account-level control used to restrict Snowflake unload destinations. A common confusion is mixing controls for external network access or integrations with controls for data unloading. The requirement is specifically about restricting where Snowflake can write data using unload operations, not about outbound access for handlers or clients in general.
- B. Correct.
Correct. Snowflake provides account-level parameters such as PREVENT_UNLOAD_TO_INLINE_URL and PREVENT_UNLOAD_TO_INTERNAL_STAGES to limit how data can be written out. Setting PREVENT_UNLOAD_TO_INLINE_URL helps block ad hoc unloads to arbitrary cloud storage URLs, and using approved named external stages allows administrators to centralize and govern permitted destinations. Depending on policy, PREVENT_UNLOAD_TO_INTERNAL_STAGES can also be used to stop users from unloading to internal stages if the organization wants all exports constrained to approved external locations.
- C. Incorrect.
Incorrect. Network rules are used in Snowflake for specific network policy and connectivity control use cases, but they are not the primary account-level mechanism for governing COPY INTO
unload destinations. This distractor reflects a plausible security instinct, controlling endpoints, but it does not address the Snowflake-native unload restriction requirement. - D. Incorrect.
Incorrect. ALLOW_CLIENT_MFA_CACHING relates to authentication experience and MFA token reuse, not to restricting export destinations. Someone might choose this if they are thinking broadly about session hardening, but it does not control where Snowflake can write data.
- E. Incorrect.
Incorrect. Resource monitors control credit usage and can suspend warehouses based on consumption thresholds, but they do not determine whether a user can unload data to a particular location. This is a governance and cost-management feature, not a data egress restriction feature.