SnowPro Advanced: Security Engineer Question 93
Single answerPasswordsA security engineer is reviewing Snowflake authentication controls after an internal audit found that several service accounts still use passwords, and some interactive users have weak password hygiene. The company wants to reduce password-related risk without immediately changing every integration to key-pair authentication or SSO. Which configuration change will best improve security for both existing and future password-based users while remaining practical for a phased rollout?
- A
Set a stricter custom password policy at the account level so stronger password requirements apply broadly to password-based users
- B
Disable network policies for password-based users so Snowflake can evaluate password complexity without IP restrictions interfering
- C
Require all users to rotate passwords by manually issuing ALTER USER statements for each account and avoid using a password policy
- D
Convert all password-based users to the TYPE = LEGACY_SERVICE user type because legacy service users are optimized for password security
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement a stricter custom password policy at the account level. In Snowflake, password policies are designed specifically to manage password strength and lifecycle controls, including requirements like length, complexity, expiration, reuse prevention, and lockout thresholds. This makes them the most effective native mechanism for reducing password-related risk across password-authenticated users in a phased rollout.
This scenario explicitly says the company cannot immediately move every integration to stronger alternatives such as key-pair authentication or federated SSO. In that situation, Snowflake best practice is to harden the password-based users that remain rather than rely on ad hoc manual administration. Password policies provide centralized, repeatable enforcement and are much more scalable than per-user password resets.
By contrast, network policies control source IP access and do not improve password hygiene. Manual ALTER USER operations may help tactically but are not a strategic or enforceable password standard. Reclassifying users to LEGACY_SERVICE does not solve the core password-strength problem and does not replace the need for proper password policy management.
Relevant Snowflake documentation areas include password policy administration, user management, and authentication best practices, especially guidance encouraging stronger authentication methods for service accounts where possible and the use of password policies for accounts that still rely on passwords.
- A. Correct.
Correct. In Snowflake, password policies are the native control for enforcing password requirements such as minimum length, complexity, password age, history, and lockout behavior. Applying a stricter custom password policy at the account level is a practical phased approach because it broadens protection across password-based users without requiring an immediate redesign of every authentication flow. It directly addresses weak password hygiene and reduces risk for existing and future users that still authenticate with passwords.
- B. Incorrect.
Incorrect. Network policies restrict where users can connect from based on IP rules; they do not strengthen password quality. Disabling network policies would reduce security, not improve it. A candidate might choose this if they confuse authentication controls with network access controls, but these are separate layers in Snowflake.
- C. Incorrect.
Incorrect. Manually rotating passwords with ALTER USER can be used operationally for individual accounts, but it is not the best broad control for improving password security across the environment. It is difficult to scale, inconsistently enforced, and does not provide the ongoing guardrails of a password policy. Someone might select this option if they focus only on password expiration rather than comprehensive password governance.
- D. Incorrect.
Incorrect. LEGACY_SERVICE is not the recommended way to improve password security. Snowflake guidance distinguishes user types for authentication patterns, but changing users to LEGACY_SERVICE does not inherently provide stronger password controls. In fact, the better security direction for service identities is typically to move away from passwords where possible, such as toward key-pair authentication, while using password policies for any password-based accounts that remain.