SnowPro Advanced: Security Engineer Question 92
Select 2PasswordsA security engineer is reviewing Snowflake authentication settings after an internal audit found that several service accounts still use password-based logins. The company wants to reduce password-related risk without immediately redesigning all integrations. One requirement is to force users to change the initial password at first sign-in, and another is to prevent users from reusing recent passwords when they are rotated. Which Snowflake controls should the engineer implement to meet these requirements?
- A
Set MUST_CHANGE_PASSWORD = TRUE when creating or altering the user, and assign a password policy that defines PASSWORD_HISTORY.
- B
Configure a network policy for the users, because network policies enforce password rotation and first-login password changes.
- C
Assign a password policy to the users that includes PASSWORD_HISTORY and other password settings, and use MUST_CHANGE_PASSWORD = TRUE for the initial password reset workflow.
- D
Enable key-pair authentication for the accounts, because this automatically forces a password change on first login and prevents password reuse.
- E
Create a session policy that sets idle session timeout and login timeout values, because session policies control password lifecycle requirements.
Show answer and explanation
Correct answers: A, C
Explanation
The best answer is to use Snowflake's password management features directly. MUST_CHANGE_PASSWORD is a user property that forces a password reset at the next login, which is commonly used when issuing an initial or temporary password. To prevent reuse of prior passwords, Snowflake password policies support settings such as PASSWORD_HISTORY. In practice, security engineers often combine user-level controls like MUST_CHANGE_PASSWORD with an assigned password policy for consistent governance. Network policies and session policies are important security controls, but they do not manage password lifecycle requirements. Key-pair authentication can reduce password usage for service accounts, but it does not inherently enforce first-login password changes or password history. This aligns with Snowflake documentation on CREATE USER / ALTER USER and password policy configuration.
- A. Correct.
Correct. In Snowflake, MUST_CHANGE_PASSWORD can be set on a user so that a user must change the password at the next login. To prevent reuse of recent passwords, a password policy can be assigned with PASSWORD_HISTORY configured. This directly addresses both stated requirements using the intended controls.
- B. Incorrect.
Incorrect. Network policies restrict access based on allowed or blocked IP addresses. They do not manage password lifecycle behavior such as forcing a password change at first login or preventing password reuse. This is a common confusion because both are account security controls, but they address different layers of security.
- C. Correct.
Correct. Password policies in Snowflake are the appropriate mechanism for password-related settings such as password length, complexity, lockout behavior, and password history. MUST_CHANGE_PASSWORD is a separate user-level setting used to force a password change on next sign-in. Together, these satisfy the scenario requirements.
- D. Incorrect.
Incorrect. Key-pair authentication is an alternative authentication method commonly used for programmatic access, and it can reduce dependence on passwords. However, enabling key-pair authentication does not itself force a password change on first login or enforce password history for password reuse. It also does not solve the stated requirement for existing password-based users without additional changes.
- E. Incorrect.
Incorrect. Session policies govern session behavior such as idle timeout and UI session settings. They do not enforce password change workflows or password history restrictions. Someone might choose this option because session policies affect login-related behavior, but they are not password management controls.