SnowPro Advanced: Security Engineer Question 324
Select 34.2 Perform risk assessment and manage risk.A financial services company stores regulated customer data in Snowflake and is preparing for an internal risk review after several teams began using third-party BI and ETL tools. The security engineer must reduce the risk of long-lived credentials being exposed while preserving auditability and minimizing disruption to existing workloads. Which TWO actions should the security engineer recommend as the most effective risk reduction measures in Snowflake?
- A
Integrate Snowflake with the corporate identity provider using federated authentication and enforce MFA for human users
- B
Replace embedded passwords in service integrations with key pair authentication for programmatic access where supported
- C
Grant SYSADMIN to each BI tool service account so administrators can quickly investigate incidents
- D
Disable access history and login history retention to reduce the amount of sensitive security metadata stored in Snowflake
- E
Use network policies to restrict access to approved corporate and vendor egress IP ranges
Show answer and explanation
Correct answers: A, B, E
Explanation
The best risk reduction measures here are those that directly address credential exposure while preserving auditability and minimizing disruption. Federated authentication with MFA reduces risk for human users by shifting authentication to the enterprise IdP and adding strong verification. Key pair authentication reduces dependence on embedded passwords for programmatic clients. Network policies add an important layer of defense by constraining where connections can originate. Together, these controls map well to practical risk treatment strategies: reduce likelihood of credential compromise, reduce blast radius, and maintain monitoring.
The incorrect choices conflict with core Snowflake security practices. Overprivileged service accounts contradict least privilege and increase impact if compromised. Disabling security telemetry undermines monitoring, incident response, and compliance validation. Snowflake documentation and best practices consistently emphasize SSO/federation, MFA, least privilege, network policies, and use of account usage/security telemetry such as login and access history for ongoing risk management.
- A. Correct.
Correct. Federated authentication with the organization's IdP centralizes identity lifecycle management and reduces the risk associated with Snowflake-managed passwords for human users. Enforcing MFA further mitigates credential theft and account takeover risk. This aligns with Snowflake security best practices for stronger authentication and reduced reliance on static credentials.
- B. Correct.
Correct. For service accounts and automated clients, key pair authentication is a strong control because it avoids storing reusable passwords in scripts, tools, or configuration files. It supports better operational security for non-interactive access and is a common recommendation when assessing credential exposure risk in Snowflake environments.
- C. Incorrect.
Incorrect. Granting SYSADMIN to BI tool service accounts significantly increases blast radius and violates least privilege principles. Although responders may need visibility during incidents, broad administrative rights for service accounts increase rather than reduce risk. A better approach is to grant only the minimum required privileges and use separate administrative roles for investigations.
- D. Incorrect.
Incorrect. Access History and Login History are valuable for detective controls, investigations, and auditability. Disabling or limiting security telemetry would weaken risk management by making it harder to identify suspicious activity, validate control effectiveness, and support compliance reviews. The misconception is treating metadata visibility as a risk greater than the operational risk of reduced monitoring.
- E. Correct.
Correct. Network policies reduce exposure by limiting connections to known trusted IP ranges, which is an effective compensating control for both human and service access. While not a substitute for strong authentication, they materially lower the likelihood of unauthorized access from untrusted networks and are commonly used as part of defense in depth.