SnowPro Advanced: Security Engineer Question 218
Single answer2.7 Manage secure replication and failover operations.A global company uses Business Critical edition and has enabled account replication from its primary Snowflake account in AWS us-east-1 to a secondary account in AWS us-west-2 for disaster recovery. The security team must ensure that, during a regional outage and failover, users can continue to access data through their existing private network path without exposing traffic to the public internet. During testing, they find that database replication and account failover succeed, but clients that rely on private connectivity cannot connect to the secondary account after failover. Which action should the security engineer take to meet the requirement?
- A
Configure and validate private connectivity separately for the secondary account in the target region, because replication/failover does not automatically recreate region-specific private connectivity endpoints.
- B
Enable Tri-Secret Secure on the primary account so the customer-managed key metadata is replicated and private connectivity automatically follows the failover.
- C
Replicate the network policies from the primary account to the secondary account, because network policy replication also transfers the private endpoint configuration needed by clients.
- D
Create a reader account in the secondary region and direct all private clients to that reader account after failover, because reader accounts inherit the primary account's private connectivity settings.
Show answer and explanation
Correct answer: A
Explanation
For secure replication and failover, Snowflake can replicate supported objects and support account failover between regions/cloud providers where available, but private connectivity remains a regional/account-specific network configuration. In practice, organizations using AWS PrivateLink, Azure Private Link, or Google Cloud private connectivity must pre-provision and validate connectivity for the secondary environment as part of DR planning. A common misconception is that account replication includes all network plumbing; it does not. Another common mistake is assuming network policies or encryption features such as Tri-Secret Secure address transport path requirements. Best practice is to treat private connectivity, client connection configuration, and failover testing as explicit DR workstreams alongside replication groups and failover groups.
- A. Correct.
Correct. Secure replication and failover protect replicated objects and account-level failover capabilities, but private connectivity is implemented with cloud-region-specific endpoint resources and account configuration that must be set up in each participating region/account. In a failover design, the security engineer should provision and test private connectivity for the secondary account ahead of time so clients can continue using private access after failover.
- B. Incorrect.
Incorrect. Tri-Secret Secure is related to key management and encryption using a customer-managed key in combination with Snowflake-managed keys. It does not configure or replicate cloud private connectivity constructs such as AWS PrivateLink, Azure Private Link, or Google Cloud Private Service Connect endpoints. This option confuses encryption controls with network access configuration.
- C. Incorrect.
Incorrect. Network policies control which IP addresses can connect to Snowflake, but they do not create or transfer private connectivity endpoint resources. Even if network policies are replicated or manually recreated, clients still cannot connect privately unless private connectivity is separately configured in the target account/region.
- D. Incorrect.
Incorrect. Reader accounts are designed for data sharing scenarios and are not the mechanism for DR failover access to a replicated account. They do not solve the requirement to preserve private connectivity for existing workloads after account failover. Private connectivity must be configured for the actual account that will serve traffic after failover.