SnowPro Advanced: Security Engineer Question 227
Single answerConfigure Client RedirectA financial services company uses Snowflake Business Critical Edition and has accounts in AWS us-east-1 and AWS us-west-2 for business continuity. Security policy requires that application connection strings remain unchanged during a regional outage, and administrators want clients to be redirected automatically to the secondary account when failover is initiated. During testing, some JDBC-based applications continue trying to connect to the original account URL and never reach the secondary account. Which action is required to correctly configure Snowflake Client Redirect for this scenario?
- A
Configure a connection failover list in the JDBC driver with both account URLs so the driver can choose the secondary account automatically.
- B
Create and enable Snowflake Client Redirect by associating an organization-level connection URL with the primary account, then update applications to use the organization connection URL instead of an account-specific URL.
- C
Replicate the network policies and set the secondary account locator as the preferred URL in the security integration so all clients inherit the redirect target.
- D
Configure account-level DNS CNAME records that point the original Snowflake account URL to the secondary account URL during failover.
Show answer and explanation
Correct answer: B
Explanation
The key requirement for Snowflake Client Redirect is that applications must use the organization connection URL, not a region- and account-specific Snowflake URL. Snowflake then maps that organization URL to the current active account. When administrators perform failover or business continuity operations, they can update the redirect target so clients using the organization URL are sent to the secondary account without changing application connection strings. If clients continue using the original account URL, they bypass the redirect mechanism entirely.
This question tests an important practical point: configuring redirect on the Snowflake side is not enough if client applications are still hardcoded to account-specific endpoints. Best practice is to standardize application connectivity on the organization URL wherever Client Redirect is required for continuity planning. Refer to Snowflake documentation for Client Redirect and organization URLs, which describes the dependency on supported clients using the organization-level connection endpoint.
- A. Incorrect.
Incorrect. Snowflake Client Redirect is not implemented by supplying a custom failover list in the JDBC driver. The requirement is to keep application connection strings unchanged and let Snowflake manage redirection. Relying on driver-specific failover configuration also does not provide the centralized, account-level redirect behavior required here.
- B. Correct.
Correct. Snowflake Client Redirect requires clients to connect using the organization connection URL rather than an account-specific URL. Administrators configure the redirect so that the organization URL points to the active account, and during failover they can switch the redirect target to the secondary account. If applications keep using the original account URL, client redirect will not occur, which matches the test failure described.
- C. Incorrect.
Incorrect. Network policies control allowed network locations, not redirect behavior. There is no mechanism in a security integration to set a secondary account locator as a redirect target for all clients. This option confuses access control configuration with connection endpoint management.
- D. Incorrect.
Incorrect. Snowflake account URLs are managed by Snowflake, and customer-managed DNS CNAME changes are not the supported mechanism for Snowflake Client Redirect. The supported approach is to use Snowflake's organization connection URL and configure redirect behavior within Snowflake rather than attempting external DNS manipulation.