ARA-C01 Accounts and Security — 10 Questions

Question 1

An organization requires that all users logging into Snowflake from outside the corporate network must provide a second authentication factor. How can an architect enforce this requirement globally?

Accepted Answer

Use an Authentication Policy to mandate MFA for specific network conditions.. To enforce Multi-Factor Authentication (MFA) globally, the ACCOUNTADMIN must configure the security integration or user properties. While MFA can be configured at the user level, enforcing it globally involves setting the authentication policy or ensuring that the identity provider manages the second factor. This is critical for maintaining zero-trust architecture and ensuring that compromised passwords alone are insufficient for unauthorized data access.

Answer

Apply a network policy that forces MFA for all IP ranges.

Answer

Set the global parameter MFA_ENFORCE to TRUE.

Answer

Configure the CLIENT_SESSION_KEEP_ALIVE parameter.

Question 2

A security architect needs to ensure that data access logs are immutable and available for auditing for at least one year. Which feature should be used to achieve this compliance requirement?

Accepted Answer

Create a scheduled task to clone the ACCESS_HISTORY view to a secured database.. Snowflake provides the ACCESS_HISTORY view within the SNOWFLAKE.ACCOUNT_USAGE schema to track data access. To ensure these logs are immutable and archived for compliance, the architect should utilize Snowflake's data sharing or replication features to move this data to a separate, locked-down security account. This prevents deletion or modification by users with account-level privileges who might attempt to scrub logs to hide unauthorized activities.

Answer

Enable Time Travel on the SNOWFLAKE database.

Answer

Configure Data Retention Period to 365 days on all tables.

Answer

Use the AUDIT_LOG_SETTING parameter.

Question 3

An architect is configuring SCIM for user provisioning. Why is the `provisioner_role` crucial in this setup?

Accepted Answer

It allows the SCIM integration to create, modify, and delete users.. The `provisioner_role` defines the permissions that the SCIM integration uses to manage users and roles within Snowflake. Without the correct privileges, the SCIM integration will fail to synchronize updates from the Identity Provider (IdP) to Snowflake. Properly scoping this role ensures that the SCIM integration can only perform the necessary provisioning tasks without having excessive account-wide privileges, maintaining a secure and automated identity lifecycle.

Answer

It determines the authentication method for the SCIM endpoint.

Answer

It enables MFA for users provisioned via SCIM.

Answer

It encrypts the traffic between the IdP and Snowflake.

Question 4

A security architect wants to prevent users from creating external stages with embedded credentials. What is the most effective approach?

Accepted Answer

Use Storage Integrations instead of direct credential passing.. To prevent the creation of insecure external stages, an architect should implement a custom role that does not have the `CREATE STAGE` privilege and ensure that only authorized administrators can create stages. Furthermore, using Storage Integrations allows the architect to abstract credentials, preventing users from ever seeing or managing access keys, which is a fundamental security practice for protecting cloud storage endpoints from unauthorized access.

Answer

Create a Resource Monitor on all stages.

Answer

Grant the SECURITYADMIN role to all users.

Answer

Modify the PUBLIC role to revoke all privileges.

Question 5

Which TWO actions should an architect take to ensure that data stored in Snowflake is protected from unauthorized access at rest?

Accepted Answer

Enable Tri-Secret Secure for account-level key control.. Protecting data at rest is handled automatically by Snowflake using AES-256 encryption. To complement this, architects should implement robust identity and access management (IAM) via role-based access control (RBAC) and utilize network policies to restrict access. These layers of defense ensure that even if encryption keys were compromised, the data remains inaccessible without valid credentials and network access, thereby maintaining a defense-in-depth posture for all data stored within the account.

Answer

Manually encrypt all files before uploading.

Answer

Disable all Time Travel features.

Answer

Set all database tables to read-only mode.

Question 6

A user reports they can see data in a table, but their assigned role does not have explicit SELECT permissions. What is the most likely cause?

Accepted Answer

The user is an owner of the table.. The most common reason for this behavior is that the user or their role is a member of a higher-level role that has been granted the required privileges. Snowflake's role hierarchy allows privileges to be inherited from parent roles to child roles. If a role is granted to another, the child role gains all the privileges of the parent, which often leads to unexpected visibility if the hierarchy is not properly managed.

Answer

The role has the BROWSE_ALL_DATA privilege.

Answer

The table has a global tag applied.

Answer

The user has access through the PUBLIC role.

Question 7

An architect is asked to ensure that an application service account does not use a password. What is the recommended strategy for machine authentication?

Accepted Answer

Use OAuth integration with an external IdP.. For machine-to-machine authentication, Snowflake recommends Key Pair Authentication. By generating an RSA key pair and storing the public key in the Snowflake user profile, applications can authenticate using a private key securely stored in a vault or local secure storage. This eliminates the risk of password rotation and credential exposure, which is the standard for secure, automated service-based connections in production environments.

Answer

Implement a shared session token.

Answer

Store the password in a clear-text environment variable.

Answer

Enable SSO for the service account.

Question 8

Which TWO statements are true regarding Snowflake's SCIM implementation with external Identity Providers?

Accepted Answer

SCIM can be used to synchronize users and groups from an IdP to Snowflake.. Snowflake supports System for Cross-domain Identity Management (SCIM) to automate the exchange of user identity information between Snowflake and identity providers like Okta or Microsoft Entra ID. Architects must understand that SCIM manages users and groups but does not handle the assignment of object-level privileges, which remains a task for Snowflake’s internal Role-Based Access Control system.

Answer

SCIM automatically grants ownership of existing databases to newly synced administrative users.

Answer

Snowflake stores the user's IdP password in plain text to facilitate SCIM sync operations.

Answer

Deactivating a user in the IdP will immediately drop all tables owned by that user.

Question 9

Refer to the exhibit. Based on the commands shown, what is the resulting privilege structure for the user 'jsmith'?

Accepted Answer

The user jsmith inherits all privileges from both the analyst and senior_analyst roles.. Understanding role inheritance is critical for architects to ensure that users have the correct permissions without redundant granting. In Snowflake, roles form a hierarchy where higher-level roles inherit all privileges of the roles granted to them. This structure simplifies management by allowing permissions to be aggregated and passed up the chain to the end user.

Answer

The user jsmith can only access objects granted directly to the senior_analyst role.

Answer

Role inheritance only works if the analyst role is also granted directly to the user jsmith.

Answer

The senior_analyst role must be a system-defined role for the inheritance to function.

Question 10

An architect needs to implement Key-Pair authentication for a service account used by an ETL tool. What is a requirement for the public key when configuring the user in Snowflake?

Accepted Answer

The public key must be stripped of its header, footer, and all newline characters.. Key-Pair authentication provides a more secure alternative to traditional password-based login for automated tools and services. Snowflake requires the public key to be assigned to the user profile, allowing the platform to verify the signature of the private key provided by the ETL tool during the connection phase.

Answer

The public key must be encrypted with a passphrase before being uploaded to Snowflake.

Answer

The public key must be stored in a Snowflake internal stage before it can be assigned.

Answer

The public key must be generated using the SHA-256 hashing algorithm exclusively.