SnowPro Advanced: Security Engineer Question 51
Single answerRotate user credentialsA security engineer must rotate credentials for a legacy ETL service account used by an external scheduler to connect to Snowflake with a username and password. The account cannot be migrated to key-pair authentication until next quarter, but the organization requires minimizing disruption during rotation and reducing the chance that the old credential remains usable longer than necessary. Which action is the MOST appropriate?
- A
Use ALTER USER to set a new password for the service account, update the scheduler to use the new password, and then verify the connection succeeds.
- B
Create a second Snowflake user with the same roles and grants, switch the scheduler to the new user, and keep the old user for rollback.
- C
Force a password reset for the service account so Snowflake prompts the scheduler to change its password on the next login.
- D
Rotate the password by changing the login name of the user first, then set a new password so the old credential pair is invalidated immediately.
Show answer and explanation
Correct answer: A
Explanation
The best practice for rotating credentials on a legacy Snowflake service account that still uses password authentication is to change the password on the existing user and coordinate the application update. In Snowflake, password rotation for a local Snowflake user is performed with ALTER USER. This invalidates the previous password and preserves the user's grants, role assignments, and other configuration, which minimizes disruption.
Creating a replacement user is usually unnecessary for simple password rotation and can complicate access management. Forcing password reset is suitable for human users, not non-interactive service accounts. Changing the login name is unrelated to password rotation and introduces avoidable outage risk.
From a security engineering perspective, this scenario also highlights a broader best practice: service accounts should preferably use stronger non-password methods such as key-pair authentication, OAuth, or workload identity/federated approaches where supported. However, given the stated constraint that migration cannot happen yet, rotating the password on the current user is the correct immediate action.
- A. Correct.
Correct. For a username/password-based service account, the practical credential rotation method is to set a new password on the existing user with ALTER USER ... SET PASSWORD, then update the dependent application or scheduler and validate connectivity. This directly rotates the credential and minimizes operational changes because object ownership, grants, role assignments, and integrations tied to the existing user do not need to be recreated. Once the password is changed in Snowflake, the previous password is no longer valid.
- B. Incorrect.
Incorrect. Creating a second user can work operationally, but it is not the most appropriate approach for simple password rotation. It adds administrative overhead, can introduce drift in grants or default settings, and may leave an unnecessary active credential behind if the old user is retained. This is more of a user replacement pattern than direct credential rotation.
- C. Incorrect.
Incorrect. A forced password reset is intended for interactive users who can respond to a password-change prompt. Service accounts and external schedulers typically cannot complete an interactive reset workflow, so this would likely cause downtime rather than reduce it.
- D. Incorrect.
Incorrect. Changing the login name is not a standard or necessary step for password rotation. Rotating a password does not require changing the user's login name, and doing so would break the application's configured username without providing a security benefit specific to password rotation.