SnowPro Advanced: Security Engineer Question 98
Single answerEgress proxy configurationsA security engineer is enabling an external network access integration so a Python UDF can call a third-party REST API. Company policy requires all outbound traffic from Snowflake code to pass through the corporate egress proxy for inspection and logging. During testing, the UDF can resolve the destination hostname, but HTTPS requests fail because direct outbound connections are blocked by the corporate firewall. Which configuration should the engineer implement to meet the requirement?
- A
Create a network rule for the corporate proxy host and port, create a secret for proxy authentication if required, and configure the external access integration to use that proxy so outbound requests are routed through it.
- B
Add the third-party API hostname to the allowed network rule and rely on Snowflake to automatically discover and use the corporate proxy when direct egress fails.
- C
Configure the storage integration for the third-party API endpoint and associate it with the UDF so HTTPS traffic is tunneled through the proxy.
- D
Create a private connectivity endpoint to the third-party API and use the same configuration as an egress proxy because private connectivity and proxy settings are interchangeable.
Show answer and explanation
Correct answer: A
Explanation
For handler code such as Python UDFs or stored procedures that need outbound network access, Snowflake uses external network access integrations together with supporting objects such as network rules and secrets. If an enterprise requires all outbound requests to traverse a corporate egress proxy, that proxy must be explicitly configured as part of the external access design; Snowflake does not automatically discover customer proxies. A network rule defines what outbound destination is allowed, and if the proxy requires authentication, credentials should be stored in a secret rather than embedded in code. This approach satisfies both connectivity and security requirements: policy enforcement, centralized logging, and credential management. By contrast, simply allowing the target host does not enforce proxy routing, storage integrations are unrelated to arbitrary REST calls from handler code, and private connectivity is a separate capability from proxy-based egress control. These distinctions are consistent with Snowflake documentation on external network access, network rules, secrets, and egress proxy support.
- A. Correct.
Correct. For outbound access from Snowflake code, the engineer must explicitly configure external network access with the appropriate objects. When an organization requires egress inspection, the integration can be configured to use a defined egress proxy rather than attempting direct internet access. In practice, this means allowing the proxy endpoint through a network rule and, if the proxy requires credentials, storing them in a secret that the integration can reference. This aligns with the requirement that all outbound traffic traverse the corporate proxy.
- B. Incorrect.
Incorrect. Allowing the destination API hostname alone does not force traffic through a corporate proxy. Snowflake does not automatically detect and fail over to a customer proxy simply because direct outbound access is blocked. Proxy use must be explicitly configured; otherwise, requests continue to attempt the normal egress path permitted by the integration.
- C. Incorrect.
Incorrect. Storage integrations are used for access to external storage services such as cloud object stores, not for routing arbitrary HTTPS requests from UDFs or procedures to REST APIs. This distractor reflects a common misunderstanding that all external connections in Snowflake are controlled through storage integrations.
- D. Incorrect.
Incorrect. Private connectivity and egress proxy configuration solve different problems. Private connectivity establishes non-public network paths to supported services or endpoints, while an egress proxy is an intermediary that outbound traffic is sent through for filtering, inspection, or policy enforcement. They are not interchangeable, and configuring private connectivity does not replicate proxy behavior.