SnowPro Advanced: Security Engineer Question 390
Select 2Manage secrets and EXTERNAL_ACCESS_INTEGRATIONS for controlled external network access from servicesA security engineer is enabling a Snowflake service to call an external REST API that uses an API key for authentication. The company requires that outbound access be restricted to only the approved API endpoint, and that developers must not hard-code credentials in service code. Which combination of actions should the engineer take to meet these requirements?
- A
Create a SECRET to store the API credential, create a NETWORK RULE that allows only the approved external host, and create an EXTERNAL ACCESS INTEGRATION that references both the allowed network rule and the allowed secret.
- B
Store the API key in a table encrypted with masking policies, then allow the service to read the key at runtime without using a SECRET because masking protects the value from unauthorized users.
- C
Configure the service to use an EXTERNAL ACCESS INTEGRATION, and ensure the integration explicitly lists the SECRET in ALLOWED_AUTHENTICATION_SECRETS so the service can use only approved credentials for outbound calls.
- D
Create an EXTERNAL ACCESS INTEGRATION that allows all outbound destinations temporarily, then rely on application logic inside the service to restrict which endpoint is actually called.
- E
Embed the API key in the service specification as an environment variable and use a NETWORK RULE for the approved host, because environment variables are the recommended way to manage sensitive credentials for external access.
Show answer and explanation
Correct answers: A, C
Explanation
To securely enable outbound network access from Snowflake services, Snowflake uses a layered model. First, define where code is allowed to connect by using a NETWORK RULE for the approved external host or endpoint pattern. Second, store credentials in a SECRET object rather than embedding them in code, tables, or service specifications. Third, create an EXTERNAL ACCESS INTEGRATION that references the allowed network rules and explicitly permits the required secret through the integration's allowed secrets settings. This enforces least privilege for both network egress and credential usage. These controls align with Snowflake best practices for external network access from handlers and services: restrict destinations with network rules, manage credentials with secrets, and govern usage through EXTERNAL ACCESS INTEGRATIONS.
- A. Correct.
Correct. This is the recommended Snowflake pattern for controlled outbound connectivity from handlers and services that need external network access. A SECRET is used to store sensitive authentication material instead of hard-coding credentials. A NETWORK RULE defines the specific external destinations that can be reached, and an EXTERNAL ACCESS INTEGRATION ties these controls together by specifying the allowed network locations and the secrets that may be used. This satisfies both requirements: least-privilege outbound access and secure credential handling.
- B. Incorrect.
Incorrect. Masking policies protect query results for users, but they are not a substitute for Snowflake SECRET objects when handling credentials for outbound authentication from code. Storing API keys in tables increases exposure risk and operational complexity, and it does not integrate with EXTERNAL_ACCESS_INTEGRATIONS the way secrets do. The requirement explicitly calls for developers not to hard-code credentials; using a SECRET is the proper mechanism.
- C. Correct.
Correct. Even if a SECRET exists, the external access path is not fully controlled unless the EXTERNAL ACCESS INTEGRATION explicitly permits use of that secret. Using ALLOWED_AUTHENTICATION_SECRETS ensures the service can use only approved credentials with the integration. This is a key governance control for services making external calls.
- D. Incorrect.
Incorrect. Allowing all outbound destinations violates the requirement to restrict access to only the approved API endpoint. Snowflake external access controls are designed to enforce destination restrictions through NETWORK RULES and EXTERNAL ACCESS INTEGRATIONS, not to depend on application code for network governance. Relying on code-level checks is weaker and easier to bypass or misconfigure.
- E. Incorrect.
Incorrect. Embedding an API key in an environment variable within the service specification is not the recommended Snowflake approach for managing credentials used with external access. Secrets should be stored in SECRET objects and explicitly allowed through the EXTERNAL ACCESS INTEGRATION. Although a NETWORK RULE for the approved host is appropriate, the credential management approach here is not.