SnowPro Advanced: Security Engineer Question 46
Single answerImplement Programmatic Access Token (PAT) authenticationA security engineer needs to enable a CI/CD service to connect to Snowflake without using passwords, while still allowing the security team to revoke access quickly if the build agent is compromised. The service cannot perform an interactive browser login, and the organization wants to minimize long-lived credentials stored in the pipeline. Which approach best meets these requirements when implementing Programmatic Access Token (PAT) authentication?
- A
Create a Snowflake user for the CI/CD service, configure a network policy and least-privilege role for that user, generate a PAT for the user, store the token securely in the pipeline secret manager, and use the PAT for non-interactive authentication.
- B
Create a Snowflake user for the CI/CD service and authenticate with a key pair, because PATs require a browser-based SSO flow before each connection and therefore cannot be used by automated services.
- C
Use a shared human user account with MFA disabled, then generate a PAT from that account so the pipeline can reuse the same token across multiple teams.
- D
Configure external OAuth for the CI/CD service, but store the Snowflake username and password as a fallback in the pipeline in case the PAT expires.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a dedicated Snowflake user for the CI/CD service and authenticate with a Programmatic Access Token stored in a secure secrets system. This approach aligns with Snowflake security best practices: use non-interactive authentication for automated workloads, avoid shared human accounts, apply least privilege, and restrict access with controls such as network policies where appropriate. PATs are useful when organizations want a revocable token-based method for programmatic access without embedding passwords in scripts or pipelines. Compared with password-based authentication, PATs improve operational security by reducing password handling and supporting token revocation. Compared with the distractors, the correct option also preserves auditability by associating actions with a dedicated service identity. Candidates should also recognize that PATs are intended for programmatic clients and that combining PATs with weaker fallback methods, such as stored passwords, defeats the security objective. Refer to Snowflake documentation on authentication methods, service users, access control best practices, and Programmatic Access Tokens for implementation details and limitations.
- A. Correct.
Correct. PATs are designed for programmatic, non-interactive access and are appropriate when a service needs to authenticate without a browser login. Creating a dedicated service user, restricting access with least-privilege roles, and optionally applying network policies follows Snowflake security best practices. Storing the PAT in a secure secret manager rather than embedding it in code reduces exposure, and PATs can be revoked if compromise is suspected, which directly addresses the requirement for rapid access removal.
- B. Incorrect.
Incorrect. This option is plausible because key-pair authentication is also valid for automation, but the statement about PATs requiring a browser-based SSO flow for each connection is false. PAT authentication is specifically intended for programmatic use cases and does not require an interactive login for every connection. Choosing this answer reflects a misconception that PATs are only an extension of user SSO sessions rather than a supported authentication method for automated clients.
- C. Incorrect.
Incorrect. Using a shared human account is a poor security practice because it reduces accountability, complicates auditing, and increases operational risk. Disabling MFA on a human account to support automation is also inappropriate. PATs should be associated with properly managed identities, and service workloads should use dedicated service users or other approved non-human identities rather than shared personal accounts.
- D. Incorrect.
Incorrect. External OAuth can be a valid solution in some architectures, but it does not answer the requirement to implement PAT authentication. In addition, storing a username and password as a fallback undermines the goal of minimizing long-lived credentials and introduces a weaker authentication path. This option mixes multiple mechanisms in a way that increases attack surface instead of simplifying and securing access.