SnowPro Advanced: Security Engineer Question 349
Single answerRevoke compromised credentials or API keysA security engineer discovers that a service account's RSA private key, used for Snowflake key-pair authentication by an external automation process, was accidentally committed to a public source code repository. The automation must be blocked from creating any new Snowflake sessions as quickly as possible, while allowing the organization to later restore access with a newly generated key. What is the MOST appropriate immediate action in Snowflake?
- A
Unset the user's RSA public key from the Snowflake user object, then generate and register a new public key after the private key is rotated.
- B
Disable network policies on the user so the compromised key can no longer be used from external networks.
- C
Revoke all active roles granted to the service account so authentication attempts using the leaked key will fail.
- D
Drop and recreate the service account because Snowflake does not support rotating key-pair credentials on an existing user.
Show answer and explanation
Correct answer: A
Explanation
The core security objective is to revoke the compromised credential itself, not just reduce permissions or add compensating controls. In Snowflake, key-pair authentication works by associating an RSA public key with a user; the client proves possession of the matching private key. If the private key is exposed, administrators should remove or replace the corresponding public key on the user object so that new authentication attempts with the leaked key fail. Once a new key pair is generated, the new public key can be registered for the same user. This approach aligns with Snowflake best practices for credential rotation and revocation: immediately invalidate the compromised authentication factor, then rotate to a new credential. Network policies and role changes may be useful additional controls, but they are not substitutes for revoking the compromised key.
- A. Correct.
Correct. For Snowflake key-pair authentication, Snowflake stores the user's RSA public key on the user object. If the corresponding private key is compromised, the fastest way to prevent new logins using that key is to remove or replace the registered public key on the user. After the external process generates a new private/public key pair, the new public key can be set on the same user. This directly addresses the compromised credential and supports controlled recovery.
- B. Incorrect.
Incorrect. Network policies restrict allowed client IP addresses, but they do not revoke a compromised key itself. If the attacker can authenticate from an allowed IP range, or if the policy is later changed, the compromised key could still be used. This is not the most direct or reliable credential revocation step.
- C. Incorrect.
Incorrect. Roles control authorization after authentication succeeds. Removing role grants may limit what the account can do, but it does not prevent the compromised key from authenticating and establishing a session. The question asks for the best immediate action to block creation of new sessions.
- D. Incorrect.
Incorrect. Snowflake supports updating key-pair authentication on an existing user by setting or unsetting the RSA public key attributes. Recreating the user is unnecessary, disruptive, and can break ownership, grants, integrations, and audit continuity.