SnowPro Advanced: Security Engineer Question 27
Select 31.2 Configure and monitor user authentication and session management.A Snowflake security engineer is reviewing authentication controls after an internal audit found that several service accounts still use username/password authentication and some interactive users remain logged in for long periods on unmanaged devices. The company has already integrated Snowflake with its corporate SAML 2.0 identity provider for workforce users. The engineer must reduce password-related risk, enforce stronger authentication for human users, and limit how long idle sessions remain active. Which TWO actions should the engineer take to best meet these requirements?
- A
Configure authentication policies to require federated authentication for interactive users and require MFA where supported.
- B
Set appropriate session idle timeout values so inactive sessions are terminated sooner.
- C
Disable all network policies because SAML authentication already controls device trust and session risk.
- D
Convert service accounts to key-pair authentication instead of continuing to use passwords.
- E
Increase the session token lifetime so users are not prompted to authenticate as often.
Show answer and explanation
Correct answers: A, B, D
Explanation
The best answer is to combine stronger authentication controls for users, stronger non-password authentication for service principals, and tighter session management. In Snowflake, authentication policies can be used to govern permitted authentication methods and strengthen user sign-in behavior, making them appropriate for enforcing federated authentication and MFA-related requirements for workforce users. For service accounts, key-pair authentication is a standard best practice because it removes dependence on passwords for automated processes. To address long-lived interactive access, session timeout settings should be reduced so idle sessions expire sooner. Network policies remain complementary rather than obsolete, and increasing token/session lifetime would weaken security posture. These recommendations align with Snowflake security best practices for authentication, MFA, key-pair authentication, session policies/settings, and defense-in-depth access controls.
- A. Correct.
Correct. Authentication policies are designed to control how users authenticate to Snowflake, including restricting allowed authentication methods. In an environment already integrated with a SAML 2.0 identity provider, requiring federated authentication for interactive users reduces reliance on Snowflake-managed passwords and aligns with enterprise SSO best practices. Requiring MFA for supported user flows further strengthens assurance for human users accessing Snowflake.
- B. Correct.
Correct. Session management controls such as idle session timeout help reduce the risk of unattended or abandoned sessions remaining active on unmanaged or shared devices. Lowering idle timeout values is an appropriate control when the audit finding specifically calls out users remaining logged in for long periods.
- C. Incorrect.
Incorrect. Network policies are still valuable because they restrict allowed IP addresses for connecting to Snowflake. SAML federation does not replace IP-based access restrictions, device posture controls, or other layered defenses. The misconception is assuming identity federation alone is sufficient to mitigate all session and access risk.
- D. Correct.
Correct. For non-interactive service accounts, key-pair authentication is a recommended approach because it avoids stored passwords and supports stronger machine-to-machine authentication patterns. This directly addresses the audit concern about service accounts still using username/password authentication.
- E. Incorrect.
Incorrect. Increasing token or session lifetime works against the stated requirement to limit how long sessions remain active. Longer-lived tokens may improve convenience, but they expand the window in which a stolen or unattended session could be abused. The audit finding indicates the organization should tighten, not relax, session duration controls.