SnowPro Advanced: Security Engineer Question 323
Single answerImplement mitigation strategiesA financial services company allows analysts to connect to Snowflake from corporate laptops using Snowsight, JDBC, and Python connectors. The security team discovers repeated failed login attempts against several analyst usernames coming from IP addresses outside the corporate network. Some of the usernames eventually succeed because the users had weak passwords and were not enrolled in MFA. The company needs to quickly reduce the risk of further account compromise while preserving normal access for analysts connecting from the corporate network. Which action should the security engineer implement first?
- A
Create a network policy that allows connections only from the company’s approved corporate egress IP ranges, and apply it to the affected users or account as appropriate
- B
Rotate the encryption keys used for Snowflake-managed data encryption so previously exposed passwords cannot be used again
- C
Disable result cache for all analyst sessions so attackers cannot retrieve previously queried data after login
- D
Increase the size of the analysts’ virtual warehouses to reduce the impact of repeated failed login attempts on authentication latency
Show answer and explanation
Correct answer: A
Explanation
The best first mitigation is to restrict where users can connect from by using a Snowflake network policy. In the scenario, the observed threat is repeated login activity from IPs outside the corporate network, and the requirement is to preserve normal analyst access from corporate laptops. Network policies are specifically designed to limit access by client IP address and are an appropriate containment measure while the organization also remediates weak passwords and MFA gaps.
From a Snowflake security best-practice perspective, this scenario also suggests follow-up actions such as enforcing MFA, integrating with federated authentication/SSO where possible, disabling or resetting compromised users, and reviewing login history for impacted principals. However, among the listed options, the network policy is the only control that directly mitigates the active attack path without unnecessarily disrupting approved corporate access.
Relevant Snowflake documentation and best practices include Snowflake network policies for restricting access by IP address, account and user security hardening guidance, and recommendations to use MFA and strong identity controls to reduce the likelihood of credential compromise.
- A. Correct.
Correct. A network policy is a direct mitigation for suspicious login activity originating from untrusted IP addresses. Snowflake supports network policies to restrict access based on allowed and blocked IP lists. Applying a network policy at the appropriate scope can quickly reduce the attack surface by preventing login attempts from non-corporate networks while preserving legitimate access from approved corporate egress addresses. In a scenario involving credential attacks from external IPs, this is an effective first containment step.
- B. Incorrect.
Incorrect. Snowflake-managed encryption keys protect data at rest, not user authentication credentials. Rotating encryption keys does not invalidate stolen or weak passwords and does not address brute-force or credential-stuffing attempts. This option confuses data encryption controls with identity and access mitigations.
- C. Incorrect.
Incorrect. The result cache is a performance optimization and is unrelated to stopping unauthorized logins. If an attacker can authenticate successfully, the core issue is weak authentication and network exposure, not cached query results. Disabling the result cache would not materially reduce the immediate risk described in the scenario.
- D. Incorrect.
Incorrect. Virtual warehouse size affects compute resources for query execution, not login controls. Authentication in Snowflake is not mitigated by scaling warehouse size. This distractor reflects a misunderstanding between account security controls and query-processing performance settings.