SnowPro Advanced: Security Engineer Question 47
Single answerImplement Programmatic Access Token (PAT) authenticationA security engineering team is replacing embedded username/password credentials used by an internal automation service that connects to Snowflake through the SQL API. The team wants the service to authenticate without storing a user password, reduce the blast radius if a credential is exposed, and keep the implementation simple for an application that already runs under a dedicated Snowflake service user. Which approach best meets these requirements when implementing Programmatic Access Token (PAT) authentication?
- A
Configure the application to obtain and use a Programmatic Access Token issued for the dedicated Snowflake user, and present that token instead of a password when connecting.
- B
Store the service user's Snowflake password in the application secret store and rotate it weekly, because PATs are only for Snowsight browser sessions.
- C
Use key-pair authentication only, because Snowflake does not support PAT-based authentication for programmatic clients.
- D
Enable MFA on the service user and require the automation service to complete an interactive MFA challenge each time it calls the SQL API.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a Programmatic Access Token for the dedicated Snowflake service user and have the application authenticate with that token instead of a stored password. This approach is appropriate when an existing application needs a programmatic, non-interactive authentication method tied to a Snowflake user account. Compared with passwords, PATs help reduce exposure by avoiding long-lived password reuse and by enabling token lifecycle controls such as expiration and revocation. Compared with interactive MFA, PATs are suitable for automation. Compared with key-pair authentication, PATs can be simpler to adopt when the application team wants to avoid private key distribution and storage. Snowflake documentation on authentication methods and programmatic access identifies PATs as a supported mechanism for client and API-based access patterns, with best practices centered on least privilege, dedicated service identities, token expiration, and revocation when compromise is suspected.
- A. Correct.
Correct. Programmatic Access Tokens are designed for programmatic authentication scenarios where an application or automation process needs to connect as a Snowflake user without embedding a reusable password. This aligns with the goals in the scenario: no password storage, simpler application integration than some alternatives, and reduced blast radius because the token can be scoped by user context and managed with expiration and revocation.
- B. Incorrect.
Incorrect. This is a common misconception. Snowflake PATs are intended specifically for programmatic access use cases, not just browser-based access. Although rotating passwords is better than never rotating them, it still leaves the application dependent on a long-lived password secret, which the scenario is trying to eliminate.
- C. Incorrect.
Incorrect. Key-pair authentication is a valid non-password authentication method in Snowflake, but the statement that Snowflake does not support PAT-based authentication for programmatic clients is false. The scenario explicitly asks for an approach using PAT authentication, and PATs are supported for programmatic access. Also, key-pair authentication may require private key management that the team wants to avoid for implementation simplicity.
- D. Incorrect.
Incorrect. Requiring interactive MFA for every automated SQL API call is not practical for a non-interactive automation service. MFA strengthens human user authentication but does not satisfy the requirement for a simple, non-interactive service authentication mechanism. PATs are intended for this kind of programmatic workflow.