SnowPro Advanced: Security Engineer Question 50
Single answerRotate user credentialsA security engineer must rotate credentials for a legacy service account used by an external reporting tool to connect to Snowflake with a username and password. The account cannot be moved to key-pair authentication this quarter, but the company wants to reduce the risk of disruption during the password change. Which approach should the engineer take to rotate the credentials with the least operational impact?
- A
Set a new password on the existing user and immediately distribute it to the reporting team, because Snowflake keeps the previous password active until existing sessions expire.
- B
Create a second login for the same Snowflake user so the old and new passwords can overlap during the transition window.
- C
Use the ALTER USER command to set a temporary second password for the service account, update the reporting tool to use that password, validate connectivity, and then remove the old password.
- D
Force a password reset on next login for the service account, then have the reporting tool administrator complete the reset interactively during the next scheduled run.
Show answer and explanation
Correct answer: C
Explanation
The best answer is to use Snowflake's temporary second password capability during credential rotation. For password-based users, this enables a staged cutover: add a second password, update dependent applications, validate successful authentication, and then remove the old password. This is the lowest-risk method when a service account cannot yet be migrated to stronger authentication such as key-pair authentication or federated authentication. In practice, security engineers should also inventory all consuming applications, schedule the cutover during a controlled window, and verify no hard-coded secrets remain after the old password is removed. This aligns with Snowflake user management and credential rotation best practices documented for ALTER USER and user authentication management.
- A. Incorrect.
Incorrect. When you change a user's password in Snowflake, the password is changed to the new value; Snowflake does not provide an overlap period where the prior password remains valid for new logins. Assuming both passwords will work can cause immediate connection failures for applications that have not yet been updated.
- B. Incorrect.
Incorrect. Snowflake users do not support multiple concurrent primary logins in the way described here. You cannot create a second password-based login identity for the same user simply to overlap credentials. This reflects a common misconception based on patterns used in some other platforms.
- C. Correct.
Correct. Snowflake supports setting a temporary second password for a user, which is specifically useful for rotating credentials with minimal downtime. The engineer can add the second password, update and test the reporting tool, and then remove the original password after the cutover. This approach reduces disruption and aligns with a controlled credential rotation process for password-based service accounts.
- D. Incorrect.
Incorrect. Forcing a reset at next login is designed for interactive user workflows, not non-interactive service accounts. A reporting tool using stored credentials typically cannot complete an interactive reset flow, so this would likely break scheduled jobs rather than provide a safe rotation path.