SnowPro Advanced: Security Engineer Question 55
Select 3Design and manage leaked password and malicious IP protectionsA security engineer at a global company wants to reduce the risk of account takeover in Snowflake without forcing every employee onto SSO immediately. The company has seen recent credential-stuffing attempts against internet-facing services, and leadership wants stronger native Snowflake protections for users who still authenticate with passwords. Which combination of actions should the security engineer implement to best address both compromised credentials and suspicious source locations?
- A
Configure a network policy to allow logins only from approved corporate egress IP ranges, and assign it at the appropriate account or user scope.
- B
Enable leaked password protection so Snowflake can detect and block the use of passwords known to be compromised.
- C
Require key-pair authentication for all service users and federated authentication for human users where possible, reducing reliance on passwords.
- D
Create a masking policy on the LOGIN_HISTORY view to automatically deny authentication attempts from IP addresses Snowflake classifies as malicious.
- E
Increase the account password minimum length to 20 characters, which replaces the need for leaked password and malicious IP protections.
Show answer and explanation
Correct answers: A, B, C
Explanation
The best answer is the combination of options 1, 2, and 3 because Snowflake security is strongest when layered controls are used. Leaked password protection helps defend password-based accounts against known compromised credentials. Network policies help restrict where authentication can originate, which is the key native control for managing access by IP range. Reducing password usage through federated authentication for users and key-pair authentication for service accounts further lowers attack surface. By contrast, masking policies do not affect login enforcement, and password length alone is not an adequate substitute for leaked password and source-IP protections. These choices align with Snowflake best practices around authentication hardening, network policies, and minimizing password dependence.
- A. Correct.
Correct. Network policies are a native Snowflake control used to restrict access based on client IP addresses. Applying a policy at the account level or, where appropriate, the user level can reduce exposure from untrusted networks and is a practical way to limit successful login attempts from unexpected locations. This is one of the primary controls for managing source-IP-based access.
- B. Correct.
Correct. Leaked password protection is specifically designed to help defend against compromised credentials by detecting passwords that are known to have been exposed. This directly addresses the credential-stuffing risk described in the scenario for password-based users.
- C. Correct.
Correct. The scenario asks for stronger protections while some users still rely on passwords. Moving service users to key-pair authentication and human users to federated authentication where feasible is a best-practice risk reduction strategy because it minimizes the number of Snowflake users exposed to password-based attacks. This complements leaked password protection and IP-based controls.
- D. Incorrect.
Incorrect. Masking policies protect data at query time; they do not control authentication behavior or block login attempts. LOGIN_HISTORY is an account usage source for monitoring and investigation, not a mechanism for enforcing access decisions during authentication. This option reflects a misunderstanding of Snowflake governance features versus authentication controls.
- E. Incorrect.
Incorrect. Stronger password complexity can help, but it does not replace leaked password protection or IP-based access controls. A long password may still be compromised, reused, or exposed elsewhere. Snowflake security best practices rely on layered controls rather than assuming password length alone is sufficient.