SnowPro Advanced: Security Engineer Question 73
Single answerSupport multi-cloud network policy enforcementA global company runs Snowflake accounts in AWS us-east-1, Azure East US, and Google Cloud us-central1. Security requirements state that administrators and service users must connect only from approved corporate egress IP addresses, regardless of cloud provider, and that the same restrictions should be applied consistently to every account. During an audit, the security engineer finds that some accounts allow broader access because IP allowlists were configured differently by local administrators. Which approach best enforces the requirement with the least operational drift?
- A
Create a standardized network policy containing the approved corporate IP ranges and set it at the account level in each Snowflake account, maintaining the approved ranges centrally and applying the same policy pattern across AWS, Azure, and Google Cloud accounts.
- B
Configure cloud-provider native firewall rules for each Snowflake account endpoint and remove Snowflake network policies, because provider firewalls are the only reliable way to enforce IP restrictions across multiple clouds.
- C
Create one network rule in a single Snowflake account and share it to the other accounts so that all accounts inherit the same IP restrictions automatically across clouds.
- D
Restrict access by assigning user-level network policies only to administrators, and rely on authentication policies for service users because network policies are not intended for non-interactive workloads.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake network policies consistently at the account level in each account. Network policies are Snowflake's built-in mechanism for restricting connections by client IP address using allowed and blocked lists. Because they are enforced within Snowflake, they work similarly across AWS, Azure, and Google Cloud accounts, making them the appropriate control for multi-cloud network policy enforcement. In practice, organizations reduce drift by centrally managing the approved corporate egress IP list and deploying the same account-level policy pattern everywhere, while reserving user-level policies only for limited exceptions. This aligns with Snowflake guidance that network policies can be assigned at the account and user levels, with account-level assignment providing broad coverage. Cloud-provider controls may complement the design, but they are not a substitute for Snowflake network policy enforcement at the Snowflake service boundary.
- A. Correct.
Correct. Snowflake network policies restrict access based on allowed and blocked IP lists, and they are enforced by Snowflake regardless of whether the account runs on AWS, Azure, or Google Cloud. To support multi-cloud consistency, the practical pattern is to define the same approved corporate egress ranges and apply equivalent account-level network policies in each account. Setting the policy at the account level reduces drift compared to managing many user-level exceptions and aligns with centralized security governance.
- B. Incorrect.
Incorrect. Cloud-provider firewalls can be part of an overall network security architecture, but they do not replace Snowflake network policies for controlling which client IP addresses may authenticate to Snowflake. Also, Snowflake is a managed service, so customers do not directly manage all service-side endpoint firewall behavior in a way that substitutes for Snowflake account network policies. Relying only on provider-native controls would not be the best answer for consistent Snowflake access enforcement.
- C. Incorrect.
Incorrect. Network rules and policies are account-scoped objects; there is no mechanism to create one in a single account and have other Snowflake accounts automatically inherit it across clouds. A candidate might choose this because central reuse sounds operationally attractive, but Snowflake access restrictions still need to be created and managed within each account.
- D. Incorrect.
Incorrect. User-level network policies can be useful for exceptions, but they do not meet the stated requirement to enforce consistent restrictions for all administrators and service users with minimal drift. Account-level enforcement is the stronger baseline. Authentication policies control authentication behavior such as MFA-related settings and client types, not source IP allowlisting in place of network policies.