SnowPro Advanced: Security Engineer Question 35
Single answerExternally-managed MFAA company uses Okta as its identity provider for Snowflake and wants all interactive Snowflake logins to satisfy the company's MFA policy in Okta instead of using Snowflake-managed MFA prompts. Security administrators also want to avoid duplicate MFA challenges and keep authentication centralized in the IdP. Which configuration best meets these requirements?
- A
Configure federated authentication with the external IdP and enable EXTERNAL_OAUTH for all users so Snowflake defers MFA decisions to Okta.
- B
Configure SAML-based federated authentication with Okta and set the account-level security integration to require clients to use SSO for interactive authentication, relying on Okta to enforce MFA.
- C
Enable Snowflake MFA for all users and configure Okta Adaptive MFA so both systems can independently challenge users for stronger authentication.
- D
Create a network policy restricting access to corporate IP ranges and disable SSO, because network controls can replace MFA requirements for interactive logins.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use federated SSO with the external identity provider and have the IdP enforce MFA as part of that login flow. In Snowflake, externally managed MFA is achieved by integrating with a supported external IdP for SSO, typically via SAML 2.0, and relying on the IdP's MFA policies. To avoid users bypassing IdP-based MFA with native Snowflake authentication, administrators should require SSO where appropriate for interactive access. This aligns with Snowflake security best practices: centralize identity controls in the enterprise IdP, enforce MFA there, and avoid running parallel MFA prompts in both Snowflake and the IdP unless there is a specific reason to do so. Network policies and OAuth integrations serve different purposes and do not substitute for externally managed MFA in interactive user authentication.
- A. Incorrect.
Incorrect. EXTERNAL_OAUTH is for OAuth-based authorization to Snowflake using an external authorization server, commonly for programmatic access patterns, not as the primary mechanism to make interactive user logins rely on IdP-managed MFA. It does not by itself establish the standard SSO flow needed for centralized interactive MFA enforcement.
- B. Correct.
Correct. For externally managed MFA in Snowflake, the practical pattern is to federate authentication to an external IdP such as Okta using SAML SSO and have the IdP enforce MFA during the authentication flow. Requiring clients to use SSO for interactive logins helps ensure users authenticate through the IdP rather than bypassing it with native username/password authentication, which is how you avoid duplicate MFA prompts and centralize MFA policy enforcement.
- C. Incorrect.
Incorrect. This approach conflicts with the stated goal of avoiding duplicate MFA challenges. If Snowflake-managed MFA and IdP-managed MFA are both active for the same interactive sign-in population, users may face redundant prompts. The scenario specifically asks for MFA to be managed externally by Okta rather than by Snowflake.
- D. Incorrect.
Incorrect. Network policies are useful as a compensating access control, but they do not replace MFA. Restricting source IPs can reduce exposure, yet it does not provide proof of possession or a second factor. Disabling SSO would also undermine the goal of centralizing authentication and MFA in Okta.