SnowPro Advanced: Security Engineer Question 321
Select 2Vulnerabilities in 3rd-party connections and packagesA security engineer at a financial services company is reviewing a Snowflake Native App and a set of Python packages that a development team wants to use inside Snowpark workloads. The app will connect to an external service, and the Python code will run in Snowflake-managed compute. The company must reduce the risk of data exfiltration and vulnerable third-party components while still allowing the solution to operate. Which actions should the security engineer take? (Choose two.)
- A
Configure and review external access integrations so outbound network destinations are explicitly allowlisted, and limit secrets available to the app or code to only those required.
- B
Approve the Native App because Snowflake automatically guarantees that all third-party packages and external endpoints used by the app are free of vulnerabilities.
- C
Restrict package usage to approved sources and versions, and review the dependency set before deployment rather than allowing developers to install arbitrary packages at runtime.
- D
Rely on network policies alone to prevent the Snowpark Python code from reaching unapproved external services, because network policies govern outbound access from Snowflake workloads.
- E
Grant broad application privileges so the Native App can self-discover which objects and secrets it needs during execution, reducing configuration effort.
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are to tightly control outbound connectivity and to govern third-party packages. In Snowflake, outbound calls from supported code paths are controlled with external access integrations, which are designed to allow only approved external network destinations and approved secrets. This is the key control for reducing risk from third-party connections. Separately, package risk should be managed through an approval and version-control process so developers do not introduce vulnerable or unreviewed dependencies into Snowpark workloads.
The incorrect options reflect common misconceptions. Snowflake does not certify that all external services, Native Apps, or Python packages are vulnerability-free. Network policies protect access into Snowflake, not outbound traffic from code running in Snowflake-managed environments. And broad application privileges contradict security best practices; least privilege remains essential for Native Apps, secrets, and object access.
These practices align with Snowflake security guidance around least privilege, reviewing Native App requested privileges and references, and controlling external network access with external access integrations. They also align with standard software supply chain security practices for third-party package management, such as dependency review, version pinning, and limiting unapproved package installation.
- A. Correct.
Correct. For third-party connections from Snowflake workloads, external access integrations are a primary control for governing outbound network access. They let administrators explicitly allow approved network locations and control which secrets can be used for authentication. This directly reduces the risk of a Native App or Snowpark handler calling unexpected destinations or using overly broad credentials.
- B. Incorrect.
Incorrect. Snowflake provides controls for isolation, governance, and review, but it does not guarantee that a third-party Native App, external endpoint, or package is inherently safe or vulnerability-free. Customers remain responsible for due diligence, least-privilege design, reviewing requested privileges, and assessing package and dependency risk.
- C. Correct.
Correct. Vulnerabilities in third-party packages are best mitigated by using a controlled approval process for package sources and versions, reviewing dependency chains, and avoiding uncontrolled runtime installation. This helps prevent the use of outdated or malicious packages and supports repeatable, auditable deployments in Snowpark environments.
- D. Incorrect.
Incorrect. Network policies in Snowflake are used to restrict client access to Snowflake based on network location, such as allowed IP addresses for connecting to Snowflake. They do not govern outbound connections from handler code or apps to external services. Outbound access is controlled through mechanisms such as external access integrations.
- E. Incorrect.
Incorrect. Broad privileges increase blast radius if the app is compromised or behaves unexpectedly. Native Apps and related integrations should follow least privilege, with explicit grants only for required objects, references, and secrets. Allowing self-discovery through broad access is a common but unsafe shortcut.