SnowPro Advanced: Security Engineer Question 64
Single answerApply network policies to accounts and usersA company uses Snowflake for both corporate employees and third-party contractors. Security policy requires that all users be restricted to the corporate NAT IP range by default, but a small group of contractors must be allowed to connect only from a separate partner VPN IP range. The security engineer has already created two network policies: CORP_POLICY and PARTNER_POLICY. The engineer must enforce the requirement with the least ongoing administrative effort and without affecting service users that authenticate through key pair authentication. Which action should the engineer take?
- A
Set CORP_POLICY at the account level, and set PARTNER_POLICY on each contractor user who needs the exception.
- B
Set PARTNER_POLICY at the account level, and set CORP_POLICY on each employee user so employees override the account-level policy.
- C
Assign both CORP_POLICY and PARTNER_POLICY to the account so Snowflake evaluates them in order and applies the first matching policy.
- D
Create a single merged network policy containing both the corporate NAT range and the partner VPN range, then assign it only to the contractor users.
Show answer and explanation
Correct answer: A
Explanation
The best practice is to apply the broad default restriction at the account level and then use user-level network policies only for exceptions. In Snowflake, network policies control allowed and blocked client IP addresses for login, and a user-level network policy overrides the account-level network policy for that specific user. This makes option 1 the most secure and operationally efficient design.
This scenario tests two important implementation details: first, understanding the precedence of user-level over account-level network policies; second, designing for least administrative effort by setting the common rule once at the account level. Snowflake documentation on network policies and ALTER ACCOUNT / ALTER USER behavior supports this precedence model and deployment pattern.
The note about not affecting service users authenticated with key pairs is a common distraction. Network policies govern login access based on source IP rather than changing because of authentication method, so the correct design still centers on where the policy is applied and how exceptions are handled.
- A. Correct.
Correct. In Snowflake, a network policy can be applied at the account level or at the user level. A user-level network policy takes precedence over an account-level network policy. Applying CORP_POLICY to the account enforces the corporate restriction by default for most users, and applying PARTNER_POLICY only to contractor users creates targeted exceptions with minimal administration. This matches the requirement to restrict everyone by default while allowing a defined subset to use a different IP range.
- B. Incorrect.
Incorrect. This reverses the intended default and would require individually assigning CORP_POLICY to potentially many employee users, increasing administrative overhead. It also makes the broader partner range the default for all users, which does not satisfy the requirement that corporate restrictions apply by default.
- C. Incorrect.
Incorrect. Snowflake does not support assigning multiple network policies simultaneously to a single account and evaluating them in sequence. A single account can have at most one network policy assigned at that level, and individual users can each optionally have their own user-level policy.
- D. Incorrect.
Incorrect. A merged policy assigned only to contractor users would not enforce the corporate NAT restriction for all other users by default. In addition, merging both ranges into one policy for contractors would allow contractors from both ranges unless the policy were carefully limited, which is not the requirement. The main issue is that this option leaves the rest of the account without the needed default account-level restriction.