SnowPro Advanced: Security Engineer Question 384
Select 25.1 Secure and govern applications with Snowpark Container Services.A financial services company is deploying an internal risk-scoring application on Snowpark Container Services (SPCS). The application must call an external model API on the internet, read customer features from Snowflake tables, and ensure that containerized services cannot broadly exfiltrate data. The security team wants a design that follows least privilege and uses Snowflake-native governance controls wherever possible. Which TWO actions should the security engineer implement?
- A
Create and use an EXTERNAL ACCESS INTEGRATION that explicitly allows only the required outbound network destinations, and associate it with the service or code path that needs internet access.
- B
Grant the service owner broad ACCOUNTADMIN privileges so the container can inherit enough permissions to access tables and external endpoints without additional configuration.
- C
Use a service role with only the required privileges on the specific database objects the application needs, instead of granting broad object access to the service.
- D
Configure the Snowpark Container Services compute pool to automatically permit outbound internet access to any destination, and rely on application code to restrict which endpoints are used.
- E
Store the external API key directly in the container image so the service can authenticate without relying on Snowflake security objects.
Show answer and explanation
Correct answers: A, C
Explanation
The best answer is to combine least-privilege data access with tightly controlled outbound connectivity. In Snowpark Container Services, security engineers should avoid broad administrative grants and instead grant only the specific object privileges required by the application. For external calls, Snowflake provides EXTERNAL ACCESS INTEGRATION to control which external network locations Snowflake-hosted code can reach. This is the preferred governance model for reducing exfiltration risk. In addition, secrets should be managed using Snowflake security features rather than being baked into container images. These practices align with Snowflake documentation and security guidance around external network access, secret handling, and role-based access control for Snowpark Container Services.
- A. Correct.
Correct. For outbound access from Snowflake-hosted code to external network locations, Snowflake uses external network access controls through an EXTERNAL ACCESS INTEGRATION. Restricting allowed destinations to only the required API endpoint is the least-privilege approach and helps reduce data exfiltration risk. In a real deployment, this is a core control for governing external connectivity rather than allowing unrestricted egress.
- B. Incorrect.
Incorrect. Granting ACCOUNTADMIN or similarly broad privileges violates least privilege and is not how Snowpark Container Services should be secured. Containerized applications should use narrowly scoped privileges through Snowflake roles and object grants. High-level administrative privileges would create unnecessary risk and do not substitute for explicit network access configuration.
- C. Correct.
Correct. Snowpark Container Services supports access control through Snowflake roles and grants. The application should run with only the permissions needed for the specific tables, schemas, or other objects it must access. This aligns with Snowflake security best practices and reduces blast radius if the service is misconfigured or compromised.
- D. Incorrect.
Incorrect. Security best practice is to explicitly limit egress rather than permit unrestricted outbound access and rely only on application logic. Network controls should be enforced through Snowflake governance mechanisms such as external access integrations and related allowlists. Application-level checks alone are not sufficient for preventing exfiltration.
- E. Incorrect.
Incorrect. Embedding secrets such as API keys directly in a container image is a poor security practice because the secret becomes tied to the artifact lifecycle and may be exposed to anyone with access to the image. Snowflake-native secret management mechanisms should be used instead of hardcoding credentials in images.