SnowPro Advanced: Security Engineer Question 157
Single answerLeverage account-level and user-level parameters to restrict when users can download query result setsA financial services company uses Snowsight and the Classic Console for data analysis. Due to a new security policy, administrators must prevent analysts from downloading query result sets from the UI during standard business hours, but allow a small incident-response team to download results at any time. The security team wants the control implemented centrally where possible, while still allowing exceptions for specific users. Which approach best meets these requirements?
- A
Set the PREVENT_UNLOAD_TO_INLINE_URL account parameter to TRUE during business hours, and set it to FALSE for incident-response users.
- B
Set the ENABLE_UNREDACTED_QUERY_SYNTAX_ERROR account parameter to FALSE during business hours, and set it to TRUE for incident-response users.
- C
Set the PREVENT_UNLOAD_TO_CLIENT account parameter at the account level during business hours, and override it at the user level for incident-response users who must still download results.
- D
Create a network policy that blocks access to Snowsight during business hours for analysts, and exempt incident-response users from the policy.
Show answer and explanation
Correct answer: C
Explanation
The best answer is to use the PREVENT_UNLOAD_TO_CLIENT parameter. Snowflake supports this parameter at multiple levels, including account and user, which makes it appropriate for centrally enforcing restrictions while allowing exceptions for named users. In this scenario, administrators can set PREVENT_UNLOAD_TO_CLIENT = TRUE at the account level during business hours to broadly prevent users from downloading query result sets to their local client, including from UI-based tools. For the incident-response team, administrators can set the user-level parameter to FALSE so those users retain the ability to download when needed. This approach aligns with Snowflake's parameter hierarchy and is the most direct implementation of the stated requirement. By contrast, PREVENT_UNLOAD_TO_INLINE_URL governs a different unload path, ENABLE_UNREDACTED_QUERY_SYNTAX_ERROR is unrelated, and network policies are about connection origin rather than controlling query result downloads. Candidates should be familiar with Snowflake documentation on parameters such as PREVENT_UNLOAD_TO_CLIENT and with the concept that user-level parameters can override broader account-level settings for exception cases.
- A. Incorrect.
Incorrect. PREVENT_UNLOAD_TO_INLINE_URL controls unloading data to inline URLs, not whether users can download query result sets to a client from Snowflake UI tools. It is related to data unloading behavior, not the specific restriction on client-side download of query results.
- B. Incorrect.
Incorrect. ENABLE_UNREDACTED_QUERY_SYNTAX_ERROR affects whether syntax errors are redacted in messages. It has nothing to do with controlling result-set downloads. This distractor targets a common mistake of choosing a security-sounding parameter that is unrelated to data egress controls.
- C. Correct.
Correct. PREVENT_UNLOAD_TO_CLIENT is the parameter used to restrict unloading or downloading data to a client, including downloading query result sets from Snowflake user interfaces. Setting it at the account level enforces the restriction broadly, and overriding it at the user level for designated incident-response personnel provides the required exception handling. This matches the requirement to manage the control centrally while permitting specific users to bypass the restriction.
- D. Incorrect.
Incorrect. A network policy can restrict where users connect from, based on allowed or blocked IP addresses, but it does not provide a native control for blocking query result downloads only during certain hours while still permitting normal analytical use. It also does not solve the requirement to use account-level and user-level parameters for fine-grained download control.