SnowPro Advanced: Security Engineer Question 56
Single answer1.3 Implement network security controls.A financial services company uses Snowflake Business Critical Edition on AWS and must restrict all production access so that users and workloads connect only through private network paths. Analysts connect from Amazon VPCs, and an ETL platform running in a separate AWS account also needs private connectivity. The security team wants to prevent access from the public internet and reduce the risk of data exfiltration through unmanaged network paths. Which solution best meets these requirements?
- A
Configure AWS PrivateLink for the Snowflake account and require clients to use the account's private connectivity URLs for both user and ETL connections.
- B
Create a network policy that allows only the company's public NAT IP addresses, and continue using the standard Snowflake public URL.
- C
Enable Tri-Secret Secure so that all traffic to Snowflake is forced over private network routes.
- D
Use a storage integration with restricted AWS IAM policies so Snowflake access occurs only through private endpoints.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use AWS PrivateLink and require the private connectivity URLs. In Snowflake, private connectivity is the appropriate control when an organization must keep traffic off the public internet and connect over private cloud networking. For AWS-hosted Snowflake accounts, this is implemented through AWS PrivateLink. This is distinct from network policies, which filter access based on source IP address but still apply to public endpoint access unless private connectivity is separately configured and used. Security engineers should also recognize that encryption features such as Tri-Secret Secure and access mechanisms such as storage integrations solve different problems and are not substitutes for network-level controls. Snowflake documentation on private connectivity and network policies supports this design approach: use private connectivity for private routing, and use network policies as an additional layer when appropriate.
- A. Correct.
Correct. On AWS, Snowflake private connectivity is implemented with AWS PrivateLink and is available for supported editions such as Business Critical. This allows clients in Amazon VPCs, including workloads in another AWS account, to connect to Snowflake over private network paths rather than the public internet. Using the private connectivity URLs is the key operational requirement; simply enabling the feature is not enough if clients still use the public endpoint. This best satisfies the requirement to keep production access off the public internet.
- B. Incorrect.
Incorrect. A network policy can restrict which public IP addresses may connect to Snowflake, which is useful for perimeter control, but the connection still uses Snowflake's public endpoint. That does not meet the stated requirement that users and workloads connect only through private network paths. This option reflects a common misconception that IP allowlisting is equivalent to private connectivity.
- C. Incorrect.
Incorrect. Tri-Secret Secure is a key management and encryption control, not a network security control. It governs encryption key protection by combining a customer-managed key with Snowflake-managed keys, but it does not change whether traffic traverses public or private network routes.
- D. Incorrect.
Incorrect. Storage integrations control secure access between Snowflake and cloud storage services such as Amazon S3 for stages and data loading/unloading. They do not provide private client connectivity to the Snowflake service itself. Restricted IAM policies can limit storage access, but they do not force user or ETL sessions to use private endpoints.