SnowPro Advanced: Security Engineer Question 72
Select 2Support multi-cloud network policy enforcementA global company runs Snowflake accounts in AWS, Azure, and Google Cloud. The security team must enforce a consistent rule: users may connect only from corporate egress IP ranges and approved private connectivity paths, while blocking all other public network access. The team wants an approach that works across cloud providers and minimizes drift between environments. Which TWO actions should the security engineer take?
- A
Create Snowflake network rules that define the approved corporate IP ranges and private connectivity identifiers, then reference those rules in a network policy applied at the account level.
- B
Rely on each cloud provider's native firewall, NSG, or VPC security controls only, because Snowflake network access enforcement is inherited automatically from the underlying cloud network.
- C
Create separate account-level network policies per cloud provider and attach all of them simultaneously to the same Snowflake account so Snowflake evaluates them in order.
- D
Use allowed network rules in the network policy for approved sources and pair them with blocked network rules only when specific deny exceptions are required.
- E
Implement masking policies on login-related columns so users connecting from unapproved networks cannot retrieve data even if the session is established.
Show answer and explanation
Correct answers: A, D
Explanation
To support multi-cloud network policy enforcement in Snowflake, the security engineer should use Snowflake network policies backed by network rules. Network rules let administrators define network identifiers such as public IPv4 ranges and supported private connectivity identifiers, and then reuse those definitions in a network policy. This is the Snowflake-native mechanism for controlling where connections may originate, and it provides a more maintainable approach than trying to replicate logic separately in each cloud provider.
In practice, the engineer should define approved corporate egress IP ranges and approved private connectivity paths in network rules, then reference those rules from a network policy and apply that policy at the account level. When a deny exception is needed, blocked network rules can be used to exclude specific sources even if broader allows exist. This design reduces configuration drift and aligns with Snowflake guidance to use network rules with network policies for inbound network restrictions.
Key exam-relevant points:
- Snowflake network access is enforced by Snowflake network policies, not solely by AWS Security Groups, Azure NSGs, or Google Cloud firewall rules.
- Only one network policy can be set at the account level at a time.
- Network rules are the preferred building blocks for maintainable allowlists and blocklists.
- Data governance features such as masking policies do not control login or network admission.
These practices align with Snowflake documentation for network policies and network rules, including support for private connectivity scenarios across cloud platforms.
- A. Correct.
Correct. Snowflake network policies can reference network rules, which are the modern way to define sets of allowed or blocked network identifiers such as IPv4 ranges and supported private connectivity identifiers. Applying the network policy at the account level is the appropriate control point for enforcing inbound access restrictions consistently within each Snowflake account, regardless of whether the account is hosted in AWS, Azure, or Google Cloud.
- B. Incorrect.
Incorrect. Cloud-native firewalls and routing controls are important in the overall architecture, but they do not replace Snowflake network policies. Snowflake evaluates its own access controls for client connectivity. Assuming Snowflake automatically inherits and enforces the organization's cloud firewall intent is a common misconception, especially in multi-cloud environments where Snowflake is a managed service boundary.
- C. Incorrect.
Incorrect. A Snowflake account can have only one network policy assigned at the account level at a time. Snowflake does not chain multiple account-level network policies and evaluate them sequentially. If different rules are needed, they must be consolidated into the network rules referenced by the single effective network policy or applied at supported lower scopes where appropriate.
- D. Correct.
Correct. Best practice is to define approved sources explicitly with allowed network rules and use blocked network rules for targeted exceptions or overlaps that must be denied. This supports clearer governance and easier cross-cloud standardization. For example, the organization can allow corporate NAT ranges and approved private endpoints while blocking a subset that should be excluded.
- E. Incorrect.
Incorrect. Masking policies protect data values after access control and query execution paths are reached; they are not a network access control mechanism. If a session is established from an unapproved source, masking policies do not prevent login or stop general connectivity. Choosing this option reflects confusion between data protection controls and perimeter access controls.