SnowPro Advanced: Security Engineer Question 74
Single answer1.4 Manage external access integrations.A security engineer is enabling a Snowpark Python stored procedure to call a third-party REST API that is hosted at https://api.vendor-example.com. The company wants to follow least-privilege principles and avoid embedding long-lived credentials directly in code. The procedure should only be able to reach the approved endpoint, and the API key must be managed securely through Snowflake. Which configuration should the engineer implement?
- A
Create a NETWORK RULE that allows api.vendor-example.com, create a SECRET to store the API key, create an EXTERNAL ACCESS INTEGRATION that references the network rule and allowed secret, and configure the stored procedure to use that integration and secret.
- B
Store the API key in a procedure variable, grant the developer role USAGE on the warehouse, and allow outbound access by creating a SECURITY INTEGRATION for api.vendor-example.com.
- C
Create an API INTEGRATION for api.vendor-example.com, store the API key in an external stage credential, and reference the API integration from the stored procedure.
- D
Create a NETWORK POLICY that allows api.vendor-example.com, store the API key in a masked table column, and let the stored procedure read the key at runtime before making the outbound call.
Show answer and explanation
Correct answer: A
Explanation
To enable outbound connectivity from Snowpark Python stored procedures or UDFs, Snowflake requires an EXTERNAL ACCESS INTEGRATION. That integration governs which external destinations are reachable and which secrets may be used. The approved destinations are typically defined through NETWORK RULE objects, and credentials such as API keys are stored in SECRET objects so they are not hardcoded in application logic. This aligns with least-privilege and credential-management best practices. Candidates often confuse EXTERNAL ACCESS INTEGRATION with API INTEGRATION or SECURITY INTEGRATION, but those serve different purposes. They may also confuse NETWORK RULES used for egress control with NETWORK POLICIES, which regulate inbound client access to Snowflake. Relevant Snowflake documentation includes the sections on external network access, CREATE EXTERNAL ACCESS INTEGRATION, CREATE NETWORK RULE, and CREATE SECRET.
- A. Correct.
Correct. For outbound calls from Snowpark handlers such as Python stored procedures or UDFs, Snowflake uses external network access with an EXTERNAL ACCESS INTEGRATION. Least privilege is enforced by referencing one or more NETWORK RULE objects that define allowed egress destinations, and credentials are handled through SECRET objects rather than hardcoding values. The procedure can then reference the integration and authorized secret, which is the recommended pattern for secure outbound access.
- B. Incorrect.
Incorrect. Embedding the API key in code or procedure variables violates the requirement to avoid long-lived credentials in code. Also, a SECURITY INTEGRATION is not the object used to permit outbound network access for Snowpark handlers. Warehouse privileges do not control external network egress in this way.
- C. Incorrect.
Incorrect. API INTEGRATION is used for specific Snowflake features such as external functions or cloud eventing-related integrations, not for general outbound HTTP calls from Snowpark stored procedures. External stage credentials are for accessing cloud storage locations, not for securely supplying API credentials to an outbound REST call from handler code.
- D. Incorrect.
Incorrect. NETWORK POLICY controls how users connect to Snowflake, typically by restricting client IP addresses, and does not define outbound destinations for handler code. Storing an API key in a table column, even if masked, is not the intended secure credential-management mechanism for external network access from Snowpark code. SECRET objects are designed for this use case.