SnowPro Advanced: Security Engineer Question 348
Single answerRevoke compromised credentials or API keysA security engineer discovers that a service account used by an external application authenticates to Snowflake with a key pair, and the application's private key has been exposed in a public source code repository. The account is actively used for automated data loads and must be secured immediately while minimizing disruption. Which action should the engineer take first to revoke the compromised credential and restore secure access?
- A
Use ALTER USER to replace the user's RSA public key with a new public key, then update the application to use the matching new private key
- B
Use REVOKE ROLE to remove all roles from the service account so the exposed private key can no longer be used
- C
Rotate the user's password with ALTER USER SET PASSWORD, because password rotation invalidates key-pair authentication
- D
Drop and recreate the user so Snowflake automatically invalidates the compromised key and generates a replacement key pair
Show answer and explanation
Correct answer: A
Explanation
When a private key used for Snowflake key-pair authentication is compromised, the correct response is to rotate the key pair by generating a new private/public key pair and updating the Snowflake user with the new public key using ALTER USER. This immediately invalidates the exposed private key because Snowflake will only accept signatures that match the currently registered public key. Revoking roles or changing passwords does not revoke the key-pair credential itself. Dropping and recreating the user introduces unnecessary downtime and complexity. This aligns with Snowflake best practices for managing and rotating key-pair authentication credentials and limiting service interruption during incident response.
- A. Correct.
Correct. For Snowflake key-pair authentication, the effective credential on the Snowflake side is the public key stored on the user object. Replacing the stored RSA public key immediately prevents authentication attempts using the old exposed private key, because it no longer matches the registered public key. After that, the application should be updated to use the newly generated private key that corresponds to the new public key. This is the most direct and least disruptive way to revoke a compromised key-pair credential.
- B. Incorrect.
Incorrect. Revoking roles reduces what the user can do after authentication, but it does not revoke the compromised authentication credential itself. The exposed private key could still be used to authenticate as that user if the matching public key remains registered. This option addresses authorization, not credential compromise.
- C. Incorrect.
Incorrect. Password rotation affects password-based authentication only. It does not invalidate key-pair authentication for a user whose RSA public key is still configured in Snowflake. This is a common misconception when multiple authentication methods may exist for the same account.
- D. Incorrect.
Incorrect. Dropping and recreating the user is unnecessary, operationally disruptive, and not how Snowflake handles key-pair rotation. Snowflake does not automatically generate a replacement key pair for the user in this workflow. The recommended approach is to rotate the RSA key material by updating the user's registered public key.