SnowPro Advanced: Security Engineer Question 59
Single answerCreate, implement, and manage network and rules policies:A security engineer at a financial services company must restrict Snowflake access for a sensitive production account. The requirements are: (1) only users connecting from the corporate NAT public IP range 198.51.100.0/24 can authenticate directly to Snowflake, (2) a small break-glass admin group must also be able to connect from 203.0.113.10/32, and (3) all other source IPs must be denied. The company wants the control enforced centrally at the account level so it applies consistently across users unless explicitly overridden later for a specific integration scenario. Which action should the engineer take?
- A
Create a network policy with ALLOWED_IP_LIST = ('198.51.100.0/24','203.0.113.10/32') and set the network policy on the Snowflake account.
- B
Create a network rule containing the two IP ranges and attach it directly to the account as the account network restriction control.
- C
Create a network policy with BLOCKED_IP_LIST = ('0.0.0.0/0') and rely on user-level exceptions for the corporate and break-glass IP addresses.
- D
Create a password policy and session policy at the account level, because network restrictions are enforced through authentication and session controls rather than a network policy.
Show answer and explanation
Correct answer: A
Explanation
For Snowflake login restrictions based on client source IP addresses, the appropriate control is a network policy. Network policies can be applied at the account level for centralized enforcement and can also be applied at the user level when a more specific override is needed for an individual principal. In this scenario, using ALLOWED_IP_LIST with the corporate NAT range and the break-glass admin IP satisfies the requirement that only those source IPs can authenticate; any source IP not listed is denied. This aligns with Snowflake best practices for minimizing exposure of sensitive accounts by restricting access paths. Password policies and session policies serve different purposes and do not enforce network-origin restrictions. Candidates should recognize the practical distinction between network policy objects used for client login IP controls and other security policy types that govern authentication strength or session behavior.
- A. Correct.
Correct. A Snowflake network policy is the account- or user-level object used to restrict login access by source IP address. Defining the corporate CIDR and the break-glass admin IP in ALLOWED_IP_LIST and then applying that network policy at the account level meets all stated requirements: access is centrally enforced, only the specified source IPs are allowed, and all unspecified IPs are implicitly denied. This is the standard approach for controlling inbound client authentication to Snowflake by IP address.
- B. Incorrect.
Incorrect. Network rules are Snowflake objects used with features such as network policies and other security/governance controls, but they are not attached directly to an account as the primary account-level login restriction mechanism in place of a network policy. For restricting client login source IPs at the account level, the engineer should apply a network policy to the account.
- C. Incorrect.
Incorrect. Blocking 0.0.0.0/0 would deny every IPv4 address, including the corporate and break-glass addresses, unless a valid allow/deny design is used through the network policy logic. This option also depends on user-level exceptions to satisfy a requirement that specifically asks for centralized account-level enforcement by default. It introduces unnecessary administrative complexity and does not represent the cleanest or intended design.
- D. Incorrect.
Incorrect. Password policies govern password characteristics and rotation behavior, while session policies govern session-related settings such as idle timeout and session duration. Neither policy type is used to restrict source IP addresses for Snowflake login access. Choosing these policies reflects a misconception that authentication hardening controls replace network-based access controls.