SnowPro Advanced: Security Engineer Question 236
Single answerVerify that replicated network policies and security integrations are active and enforced on the new primary accountA company uses account replication and planned failover for business continuity. After promoting a secondary account to become the new primary, the security engineer must confirm that replicated network controls and authentication integrations are actually protecting the new primary account. The organization uses a network policy to restrict allowed client IP ranges and a SAML2 security integration for federated sign-in. Which action provides the most reliable verification that both replicated objects are active and enforced on the new primary account?
- A
Run SHOW NETWORK POLICIES and SHOW SECURITY INTEGRATIONS in the new primary account to confirm the objects exist, then assume replication made them active.
- B
Query ACCOUNT_USAGE views for the replicated objects and verify the REPLICATION_GROUP name matches the old primary account.
- C
Attempt a login to the new primary account from an IP address outside the allowed ranges and confirm access is blocked, then perform a federated authentication test using the SAML2 integration against the new primary account URL.
- D
Execute DESCRIBE INTEGRATION on the SAML2 security integration and DESCRIBE NETWORK POLICY on the network policy; if both return definitions without error, the controls are enforced.
- E
Verify that users and roles were replicated successfully to the new primary account because successful principal replication implies network policies and security integrations are active.
Show answer and explanation
Correct answer: C
Explanation
After account failover, the key task is not just to confirm that replicated objects exist, but to verify that they are active and enforced in the new primary account. In Snowflake, network policies control login access based on client network location, so the strongest validation is an authentication attempt from a disallowed IP range to ensure the policy blocks access. Likewise, a SAML2 security integration should be validated through an actual federated sign-in test against the new primary account. Metadata commands such as SHOW or DESCRIBE and usage views are useful for confirming replication state and object definitions, but they do not by themselves prove runtime enforcement. This aligns with Snowflake security best practices: validate security controls through operational testing after failover, especially for authentication-related controls such as network policies and federated identity integrations.
- A. Incorrect.
This is insufficient because object existence does not prove enforcement. In Snowflake, replicated objects can be present after failover, but the practical question is whether the new primary is actually using them. For a network policy, enforcement must be validated by behavior at login. For a SAML2 integration, the engineer should verify the federated sign-in flow against the new primary account endpoint. Merely listing objects is a common but incomplete validation step.
- B. Incorrect.
This checks metadata, not runtime enforcement. ACCOUNT_USAGE and replication metadata can help confirm that objects were copied and that failover or replication occurred, but they do not prove that a login from a disallowed IP is rejected or that the federated sign-in path works in the promoted account. Candidates may choose this because metadata validation feels authoritative, but exam scenarios focused on security assurance usually require an operational verification.
- C. Correct.
This is the best answer because it validates actual enforcement in the promoted account. A network policy is enforced during authentication, so the strongest confirmation is a negative login test from a blocked IP range. A SAML2 security integration is meaningful only if federated authentication succeeds against the new primary account. This directly tests whether the replicated security controls are active after failover rather than just present in metadata.
- D. Incorrect.
DESCRIBE confirms configuration details but not effective enforcement. For example, a network policy definition can exist even if it is not the policy being applied at the relevant scope, and an integration definition can exist even if the end-to-end SAML authentication flow is not functioning as expected for the new primary account URL or endpoints. This option reflects a common misconception that configuration inspection alone is equivalent to control validation.
- E. Incorrect.
Replication of users and roles does not prove that network policies or security integrations are active. These are separate security controls with distinct enforcement paths. A user could exist in the new primary account while access restrictions or federated login are misconfigured or untested. This distractor is plausible because failover readiness often includes identity objects, but it does not answer the question about control enforcement.