SnowPro Advanced: Security Engineer Question 320
Select 2Vulnerabilities in 3rd-party connections and packagesA Snowflake security engineer reviews a Python-based data enrichment workflow implemented as a Snowpark stored procedure. The procedure depends on several third-party packages from Anaconda and also calls an external service through an external access integration. During an internal security review, the team is asked to reduce the risk of both vulnerable package use and data exfiltration through third-party connections, while preserving the procedure's functionality. Which TWO actions should the engineer take?
- A
Restrict the stored procedure to a curated list of required package versions instead of allowing broad or unpinned dependency resolution.
- B
Configure the external access integration to allow only the specific network rules and secrets needed by the procedure, rather than broad outbound access.
- C
Grant OWNERSHIP on the procedure to application developers so they can update packages and external endpoints quickly without security review.
- D
Enable Tri-Secret Secure so external calls made by the procedure are blocked unless the external service also uses customer-managed keys.
- E
Rely on secure views over source tables, because view-based masking prevents vulnerable packages from importing or transmitting sensitive data.
Show answer and explanation
Correct answers: A, B
Explanation
The best answer is to combine software supply chain controls with least-privilege outbound connectivity controls. For third-party packages, security best practice is to minimize dependencies, use only required packages, and avoid loose versioning that can introduce vulnerable or unreviewed code. For third-party connections, Snowflake external access should be tightly constrained using external access integrations, network rules, and secrets so handlers can reach only explicitly approved endpoints with approved credentials. These controls directly address the two risks in the scenario: vulnerable packages and unauthorized exfiltration through external services. By contrast, broad object ownership grants weaken governance, Tri-Secret Secure does not govern outbound network calls, and secure views do not stop authorized code from sending retrieved data to an external destination. These recommendations align with Snowflake guidance for Snowpark handlers, package management, secrets, network rules, and external access integrations.
- A. Correct.
Correct. Limiting the procedure to an approved, curated set of third-party packages and versions is a core mitigation for software supply chain risk. Broad or unpinned dependencies can introduce vulnerable or unexpected package versions during deployment or execution. In Snowflake Python workloads, package usage should be intentionally controlled so only required libraries and vetted versions are permitted.
- B. Correct.
Correct. External access integrations should follow least privilege. In Snowflake, outbound connectivity for handlers is controlled through external access integrations, network rules, and secrets. Restricting access to only the required destinations and credentials reduces the blast radius if the code or a dependency is compromised and helps prevent unauthorized data exfiltration.
- C. Incorrect.
Incorrect. Granting OWNERSHIP to developers increases risk because OWNERSHIP allows full control, including replacing the procedure or changing properties. Fast changes without review weaken governance rather than reducing vulnerability exposure. A stronger approach is controlled change management with narrowly scoped privileges.
- D. Incorrect.
Incorrect. Tri-Secret Secure is related to encryption key management for data at rest and does not control whether a stored procedure can make outbound calls through an external access integration. It is not a mechanism for restricting third-party network connectivity or validating the key management posture of an external service.
- E. Incorrect.
Incorrect. Secure views help protect how data is exposed within Snowflake, but they do not prevent vulnerable code from exfiltrating data if that code is authorized to read it and has outbound connectivity. This option reflects a common misconception that data access controls alone mitigate package and connection-based supply chain risks.