SnowPro Advanced: Security Engineer Question 226
Single answerConfigure Client RedirectA global company uses Snowflake Business Critical Edition and has accounts in AWS us-east-1 and AWS us-west-2. Security policy requires applications to reconnect automatically to the secondary account during a regional outage without changing connection strings. The security engineer has already configured account replication and failover groups. During testing, JDBC clients continue trying to connect to the original account URL and do not fail over automatically. Which action should the security engineer take to meet the requirement?
- A
Configure Client Redirect by defining a connection object for the organization account and setting the primary and secondary accounts as redirect targets, then have clients connect using the connection URL associated with that connection object
- B
Create a network policy that lists both regional account URLs so Snowflake can choose the available endpoint automatically when the primary region is unavailable
- C
Enable Tri-Secret Secure so the account locator remains valid across regions and JDBC drivers can transparently reconnect to the secondary account
- D
Modify the failover group to include user objects and roles because Client Redirect only works when security objects are replicated with application data
Show answer and explanation
Correct answer: A
Explanation
The key concept is that Snowflake Client Redirect provides a stable, organization-level connection mechanism so supported clients can be redirected from a primary account to a designated secondary account after failover. Merely configuring replication and failover groups is not sufficient for transparent client reconnection. Applications must use the Client Redirect connection URL associated with a configured connection object; otherwise, they continue targeting the original account endpoint. This is a common implementation gap in failover testing. Best practice is to combine replication/failover groups with Client Redirect and validate that drivers and applications are using the redirect-aware connection string. See Snowflake documentation for Client Redirect, account failover/replication, and supported client configuration requirements.
- A. Correct.
Correct. Client Redirect is designed for this exact requirement: keeping a stable connection URL while allowing Snowflake to redirect clients to another account after failover. The administrator creates and manages a connection object and configures its primary/secondary targets. Clients must connect using the Client Redirect connection URL; continuing to use the original account-specific URL will not provide transparent redirection.
- B. Incorrect.
Incorrect. Network policies control which IP addresses can access Snowflake, not endpoint selection or automatic regional failover. Listing both account URLs in a network policy is not how Snowflake performs client redirection.
- C. Incorrect.
Incorrect. Tri-Secret Secure is related to encryption key management and customer-managed keys, not connection endpoint abstraction or redirect behavior. It does not make JDBC clients fail over to another account URL.
- D. Incorrect.
Incorrect. Replicating users and roles can be important for a full failover strategy, but it is not what enables Client Redirect. The immediate issue in the scenario is that clients are using the original account URL instead of the Client Redirect connection URL.