SnowPro Advanced: Security Engineer Question 389
Select 2Manage secrets and EXTERNAL_ACCESS_INTEGRATIONS for controlled external network access from servicesA security engineer is enabling a Snowflake service to call a third-party incident management API over HTTPS. The API requires an OAuth access token that must not be hardcoded in application code. The engineer must ensure the service can reach only the approved external endpoint and can access only the stored credential intended for that API. Which combination of steps should the engineer take to meet these requirements?
- A
Create a SECRET to store the API credential, create a NETWORK RULE that allows the approved external host, create an EXTERNAL ACCESS INTEGRATION that references the network rule and explicitly allows the secret, and configure the service to use that integration and secret.
- B
Store the token in a service environment variable, create an EXTERNAL ACCESS INTEGRATION with ALLOWED_NETWORK_RULES set to all outbound destinations, and rely on code review to prevent calls to other hosts.
- C
Create a SECRET for the OAuth credential, but skip the EXTERNAL ACCESS INTEGRATION because secrets alone control whether outbound network access is permitted.
- D
Create a NETWORK RULE for the approved host and an EXTERNAL ACCESS INTEGRATION that references it, but do not list the secret in the integration because any secret in the same schema is automatically available to the service.
- E
Grant the service owner role access to the SECRET object, and configure the service so its external access integration references both the specific network rule and the allowed secret.
Show answer and explanation
Correct answers: A, E
Explanation
For Snowflake services and other supported code execution contexts that require outbound calls, secure design has two separate but related controls: destination control and credential control. Destination control is implemented with a NETWORK RULE that identifies approved external host(s), and an EXTERNAL ACCESS INTEGRATION that references those network rules. Credential control is implemented with a SECRET object for storing sensitive values such as OAuth tokens or related credentials, and the EXTERNAL ACCESS INTEGRATION must explicitly allow the secret for use. The service must also be configured to use the integration and have the necessary privileges to use the secret. This reflects Snowflake best practices for least privilege: do not hardcode credentials, do not allow broad outbound connectivity, and do not assume schema placement makes secrets automatically accessible. Relevant Snowflake documentation areas include CREATE SECRET, CREATE NETWORK RULE, CREATE EXTERNAL ACCESS INTEGRATION, and the guidance for using secrets and external network access from Snowflake-hosted code and services.
- A. Correct.
Correct. This is the intended design for controlled outbound access from Snowflake code/services. A SECRET stores sensitive credentials outside the application code. A NETWORK RULE defines the approved external destination(s). An EXTERNAL ACCESS INTEGRATION ties outbound access to allowed network rules and allowed authentication secrets. The service must be configured to use the integration and the secret, which enforces both destination restriction and credential scoping.
- B. Incorrect.
Incorrect. Storing tokens in environment variables undermines secret management and increases exposure risk compared with using Snowflake SECRET objects. In addition, configuring outbound access broadly instead of restricting it to specific approved hosts violates least privilege. EXTERNAL ACCESS INTEGRATIONS are specifically meant to constrain external connectivity rather than rely on procedural controls such as code review.
- C. Incorrect.
Incorrect. A SECRET stores credentials, but it does not by itself authorize outbound network connectivity. Outbound access from Snowflake services/code requires an EXTERNAL ACCESS INTEGRATION that defines what external network locations and which secrets are allowed. This option reflects the misconception that credential storage and network authorization are the same control.
- D. Incorrect.
Incorrect. The NETWORK RULE and EXTERNAL ACCESS INTEGRATION are necessary, but secrets are not implicitly available just because they are in the same schema. The integration must explicitly allow the secret, and the relevant privileges must still be granted. This option tests a common misunderstanding about object locality automatically conferring access.
- E. Correct.
Correct. In addition to creating the objects, the service needs authorization to use the SECRET object, and the EXTERNAL ACCESS INTEGRATION must explicitly reference both the approved network rule and allowed secret. This supports least privilege by limiting both where the service can connect and which credential it can use.