SnowPro Advanced: Security Engineer Question 65
Single answerApply network policies to accounts and usersA Snowflake security engineer is tightening access after a third-party audit. The company wants all users to connect only from corporate egress IP ranges, except for a small group of break-glass administrators who must also be able to connect from a secure incident-response network. The engineer has already created two network policies: CORP_ONLY and ADMIN_EXTENDED. Most users authenticate directly as Snowflake users, and the administrators use their own named user accounts. The requirement is to enforce the stricter policy for all standard users while allowing the exception only for the administrator accounts, without creating a separate Snowflake account. Which approach should the engineer take?
- A
Apply CORP_ONLY to the Snowflake account, and apply ADMIN_EXTENDED directly to each administrator user account.
- B
Apply ADMIN_EXTENDED to the Snowflake account, and apply CORP_ONLY to each standard user account.
- C
Apply both CORP_ONLY and ADMIN_EXTENDED to the Snowflake account; Snowflake will evaluate the most restrictive policy first.
- D
Apply CORP_ONLY to a role granted to standard users, and ADMIN_EXTENDED to a role granted to administrators.
Show answer and explanation
Correct answer: A
Explanation
The best practice in this scenario is to set a restrictive account-level network policy as the default and then use user-level policies only for explicitly approved exceptions. In Snowflake, a network policy can be set on the account and separately on individual users. When a user has a user-level network policy, it takes precedence over the account-level network policy for that user. This makes option 1 the cleanest and safest implementation: standard users are automatically restricted by the account-level CORP_ONLY policy, while the break-glass administrators receive the broader ADMIN_EXTENDED policy only on their user objects. This aligns with least privilege and reduces administrative overhead for onboarding new users. Snowflake documentation on network policies and ALTER ACCOUNT / ALTER USER behavior describes account-level and user-level assignment and precedence rules.
- A. Correct.
Correct. In Snowflake, network policies can be assigned at the account level and at the user level. A user-level network policy overrides the account-level network policy for that specific user. Applying CORP_ONLY at the account level enforces the baseline restriction for everyone, while assigning ADMIN_EXTENDED to the administrator user objects creates the intended exception for those named users only.
- B. Incorrect.
Incorrect. This reverses the intended security model. If ADMIN_EXTENDED is applied at the account level, all users inherit the broader access unless every standard user is individually assigned CORP_ONLY. That is harder to manage and increases risk because new users would default to the less restrictive policy.
- C. Incorrect.
Incorrect. Snowflake does not support assigning multiple network policies simultaneously to the same account and having them merged or evaluated by 'most restrictive wins' logic. An account can have one network policy association at a time, and a user can have one user-level policy association.
- D. Incorrect.
Incorrect. Network policies are not applied to roles in Snowflake. They are associated with accounts, users, and integration objects that support network rules in specific contexts, but not role-based access control objects. This option reflects a common misconception that all security controls in Snowflake are role-scoped.