SnowPro Advanced: Security Engineer Question 240
Single answerValidate the secure client redirection configurationsA security engineer is validating secure client redirection for a Snowflake account that uses a business continuity URL. During testing, users can authenticate and run queries through the primary account URL, but when they try the connection through the organization URL, some clients fail with certificate or hostname validation errors after redirection. The engineer must determine which configuration issue most likely explains the failures while preserving Snowflake security best practices.
Which issue is the MOST likely cause?
- A
The clients are using older Snowflake drivers/connectors that do not support secure client redirect and therefore cannot validate the redirected host correctly.
- B
The account is using key-pair authentication instead of password authentication, which is not supported when secure client redirect is enabled.
- C
Network policies are not attached to the redirected account URL, so the TLS handshake is rejected after redirection.
- D
The users were not granted the SECURITYADMIN role, so the redirect target hostname cannot be resolved by the client.
Show answer and explanation
Correct answer: A
Explanation
The best answer is that the failing clients are using unsupported or outdated Snowflake clients/drivers. Secure client redirect requires clients to understand Snowflake's redirection process and then validate the redirected hostname and certificate correctly. In practice, validation of secure client redirection should include confirming that the organization URL is being used, that account-level redirection has been configured, and that every client/driver version in scope explicitly supports secure client redirect.
From a security engineering perspective, this aligns with Snowflake best practices: preserve TLS validation, do not weaken certificate checks, and standardize supported connector versions before enabling or validating redirect-based business continuity workflows. When troubleshooting, engineers should compare successful and failing client versions first, because direct access to the account URL can still work while redirect through the organization URL fails on older clients.
Relevant Snowflake guidance includes documentation on client redirect/business continuity features and connector/driver compatibility requirements for secure client redirect.
- A. Correct.
Correct. Secure client redirect depends on client and driver support for following Snowflake's redirection flow and validating the redirected endpoint securely. If users are on unsupported or outdated drivers/connectors, they can fail on redirect with hostname or certificate validation issues even though direct connections to the primary account URL still work. Validating that the SnowSQL/client version supports secure client redirect is a core troubleshooting step.
- B. Incorrect.
Incorrect. Secure client redirect is not limited to password authentication. Snowflake supports multiple authentication methods, and key-pair authentication itself is not the reason a client would fail hostname or certificate validation after redirect. This option reflects a common misconception that redirect is tied to one authentication type.
- C. Incorrect.
Incorrect. Network policies can block connections based on source IP rules, but they do not typically manifest as hostname or certificate validation errors during TLS validation. A network policy issue would more likely cause connection refusal or access denial rather than a certificate/hostname mismatch after redirection.
- D. Incorrect.
Incorrect. SECURITYADMIN role assignment is unrelated to client-side DNS resolution or TLS hostname verification. Role privileges affect object and security administration within Snowflake, not whether a client can validate a redirected endpoint.