ARA-C01 Accounts and Security — 25 Questions

Question 1

An organization requires that all users logging into Snowflake from outside the corporate network must provide a second authentication factor. How can an architect enforce this requirement globally?

Accepted Answer

Use an Authentication Policy to mandate MFA for specific network conditions.. To enforce Multi-Factor Authentication (MFA) globally, the ACCOUNTADMIN must configure the security integration or user properties. While MFA can be configured at the user level, enforcing it globally involves setting the authentication policy or ensuring that the identity provider manages the second factor. This is critical for maintaining zero-trust architecture and ensuring that compromised passwords alone are insufficient for unauthorized data access.

Answer

Apply a network policy that forces MFA for all IP ranges.

Answer

Set the global parameter MFA_ENFORCE to TRUE.

Answer

Configure the CLIENT_SESSION_KEEP_ALIVE parameter.

Question 2

A security architect needs to ensure that data access logs are immutable and available for auditing for at least one year. Which feature should be used to achieve this compliance requirement?

Accepted Answer

Create a scheduled task to clone the ACCESS_HISTORY view to a secured database.. Snowflake provides the ACCESS_HISTORY view within the SNOWFLAKE.ACCOUNT_USAGE schema to track data access. To ensure these logs are immutable and archived for compliance, the architect should utilize Snowflake's data sharing or replication features to move this data to a separate, locked-down security account. This prevents deletion or modification by users with account-level privileges who might attempt to scrub logs to hide unauthorized activities.

Answer

Enable Time Travel on the SNOWFLAKE database.

Answer

Configure Data Retention Period to 365 days on all tables.

Answer

Use the AUDIT_LOG_SETTING parameter.

Question 3

An architect is configuring SCIM for user provisioning. Why is the `provisioner_role` crucial in this setup?

Accepted Answer

It allows the SCIM integration to create, modify, and delete users.. The `provisioner_role` defines the permissions that the SCIM integration uses to manage users and roles within Snowflake. Without the correct privileges, the SCIM integration will fail to synchronize updates from the Identity Provider (IdP) to Snowflake. Properly scoping this role ensures that the SCIM integration can only perform the necessary provisioning tasks without having excessive account-wide privileges, maintaining a secure and automated identity lifecycle.

Answer

It determines the authentication method for the SCIM endpoint.

Answer

It enables MFA for users provisioned via SCIM.

Answer

It encrypts the traffic between the IdP and Snowflake.

Question 4

A security architect wants to prevent users from creating external stages with embedded credentials. What is the most effective approach?

Accepted Answer

Use Storage Integrations instead of direct credential passing.. To prevent the creation of insecure external stages, an architect should implement a custom role that does not have the `CREATE STAGE` privilege and ensure that only authorized administrators can create stages. Furthermore, using Storage Integrations allows the architect to abstract credentials, preventing users from ever seeing or managing access keys, which is a fundamental security practice for protecting cloud storage endpoints from unauthorized access.

Answer

Create a Resource Monitor on all stages.

Answer

Grant the SECURITYADMIN role to all users.

Answer

Modify the PUBLIC role to revoke all privileges.

Question 5

Which TWO actions should an architect take to ensure that data stored in Snowflake is protected from unauthorized access at rest?

Accepted Answer

Enable Tri-Secret Secure for account-level key control.. Protecting data at rest is handled automatically by Snowflake using AES-256 encryption. To complement this, architects should implement robust identity and access management (IAM) via role-based access control (RBAC) and utilize network policies to restrict access. These layers of defense ensure that even if encryption keys were compromised, the data remains inaccessible without valid credentials and network access, thereby maintaining a defense-in-depth posture for all data stored within the account.

Answer

Manually encrypt all files before uploading.

Answer

Disable all Time Travel features.

Answer

Set all database tables to read-only mode.

Question 6

A user reports they can see data in a table, but their assigned role does not have explicit SELECT permissions. What is the most likely cause?

Accepted Answer

The user is an owner of the table.. The most common reason for this behavior is that the user or their role is a member of a higher-level role that has been granted the required privileges. Snowflake's role hierarchy allows privileges to be inherited from parent roles to child roles. If a role is granted to another, the child role gains all the privileges of the parent, which often leads to unexpected visibility if the hierarchy is not properly managed.

Answer

The role has the BROWSE_ALL_DATA privilege.

Answer

The table has a global tag applied.

Answer

The user has access through the PUBLIC role.

Question 7

An architect is asked to ensure that an application service account does not use a password. What is the recommended strategy for machine authentication?

Accepted Answer

Use OAuth integration with an external IdP.. For machine-to-machine authentication, Snowflake recommends Key Pair Authentication. By generating an RSA key pair and storing the public key in the Snowflake user profile, applications can authenticate using a private key securely stored in a vault or local secure storage. This eliminates the risk of password rotation and credential exposure, which is the standard for secure, automated service-based connections in production environments.

Answer

Implement a shared session token.

Answer

Store the password in a clear-text environment variable.

Answer

Enable SSO for the service account.

Question 8

Which TWO statements are true regarding Snowflake's SCIM implementation with external Identity Providers?

Accepted Answer

SCIM can be used to synchronize users and groups from an IdP to Snowflake.. Snowflake supports System for Cross-domain Identity Management (SCIM) to automate the exchange of user identity information between Snowflake and identity providers like Okta or Microsoft Entra ID. Architects must understand that SCIM manages users and groups but does not handle the assignment of object-level privileges, which remains a task for Snowflake’s internal Role-Based Access Control system.

Answer

SCIM automatically grants ownership of existing databases to newly synced administrative users.

Answer

Snowflake stores the user's IdP password in plain text to facilitate SCIM sync operations.

Answer

Deactivating a user in the IdP will immediately drop all tables owned by that user.

Question 9

Refer to the exhibit. Based on the commands shown, what is the resulting privilege structure for the user 'jsmith'?

Accepted Answer

The user jsmith inherits all privileges from both the analyst and senior_analyst roles.. Understanding role inheritance is critical for architects to ensure that users have the correct permissions without redundant granting. In Snowflake, roles form a hierarchy where higher-level roles inherit all privileges of the roles granted to them. This structure simplifies management by allowing permissions to be aggregated and passed up the chain to the end user.

Answer

The user jsmith can only access objects granted directly to the senior_analyst role.

Answer

Role inheritance only works if the analyst role is also granted directly to the user jsmith.

Answer

The senior_analyst role must be a system-defined role for the inheritance to function.

Question 10

An architect needs to implement Key-Pair authentication for a service account used by an ETL tool. What is a requirement for the public key when configuring the user in Snowflake?

Accepted Answer

The public key must be stripped of its header, footer, and all newline characters.. Key-Pair authentication provides a more secure alternative to traditional password-based login for automated tools and services. Snowflake requires the public key to be assigned to the user profile, allowing the platform to verify the signature of the private key provided by the ETL tool during the connection phase.

Answer

The public key must be encrypted with a passphrase before being uploaded to Snowflake.

Answer

The public key must be stored in a Snowflake internal stage before it can be assigned.

Answer

The public key must be generated using the SHA-256 hashing algorithm exclusively.

Question 11

An Architect is designing a secure connection between a corporate VPC and Snowflake using AWS PrivateLink. Which TWO components are required to ensure the connection is private and secure?

Accepted Answer

An Interface VPC Endpoint created in the customer's AWS Virtual Private Cloud.. AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises applications. When using PrivateLink with Snowflake, traffic does not traverse the public internet, which significantly reduces the exposure to external threats and satisfies strict compliance requirements for data transit within highly regulated industries.

Answer

A public DNS record pointing to the Snowflake account's public URL.

Answer

A NAT Gateway configured in the Snowflake VPC to allow outbound responses.

Answer

A dedicated hardware security module (HSM) installed in the customer data center.

Question 12

When configuring Account Replication, which object type is NOT automatically replicated from the primary to the secondary account?

Accepted Answer

External stages and their associated storage integrations.. Account replication allows for the synchronization of account-level objects and data between different Snowflake accounts for disaster recovery. However, certain objects that are closely tied to the specific infrastructure or external integrations of an account are excluded from the automated replication process and must be managed manually.

Answer

User-defined roles and their associated privilege grants.

Answer

Network policies assigned to the account or specific users.

Answer

Users and their associated authentication metadata like public keys.

Question 13

Which TWO best practices should be followed when implementing Multi-Factor Authentication (MFA) for a Snowflake account?

Accepted Answer

Enforce MFA for all human users with administrative roles like ACCOUNTADMIN.. MFA adds a critical layer of security by requiring a second form of verification. While Snowflake makes MFA easy to implement via Duo Security, architects must balance security requirements with the need for automated service accounts to function without manual intervention, which often involves different authentication strategies.

Answer

Enable MFA for service accounts used by automated ETL processes.

Answer

Use the 'MINS_TO_BYPASS_MFA' property to permanently disable MFA for remote users.

Answer

Require users to change their MFA device every 30 days for maximum security.

Question 14

Refer to the exhibit. If a user with the role 'DEVELOPER' queries a column protected by this policy, what will they see?

Accepted Answer

The masked string '*********'.. Dynamic Data Masking allows architects to protect sensitive data at query time based on the user's current role. The policy logic uses the CURRENT_ROLE function to evaluate permissions dynamically. If the user's active role is not explicitly listed in the authorized set, the mask is applied to the output.

Answer

The actual email address stored in the table.

Answer

A NULL value for every row in the column.

Answer

An error message stating they have insufficient privileges.

Question 15

An architect is considering the use of Secondary Roles in a user session. Which TWO statements accurately describe the behavior of Secondary Roles?

Accepted Answer

Secondary roles can be activated using the command 'USE SECONDARY ROLES ALL'.. Secondary roles allow a user to aggregate privileges from multiple roles they have been granted without needing to switch their primary role. This feature is particularly useful for performing cross-functional tasks that require permissions from different parts of the role hierarchy simultaneously, improving productivity and simplifying session management.

Answer

Objects created in the session are owned by the active secondary role with the most privileges.

Answer

Secondary roles allow a user to perform actions that require the ACCOUNTADMIN role.

Answer

The privileges of secondary roles are only available for SELECT statements.

Question 16

Refer to the exhibit. What is the primary purpose of this row access policy when applied to a sales table?

Accepted Answer

It enforces data localization by restricting access based on the user's current role.. Row Access Policies provide fine-grained access control by filtering which rows are visible to a user based on their role or other session attributes. This specific policy implements a dynamic lookup against a mapping table, ensuring that sales managers can only see data for the regions they are assigned to manage.

Answer

It prevents any user from deleting rows in the sales table.

Answer

It masks the sales_region column for unauthorized users.

Answer

It optimizes query performance by partitioning the table by sales_region.

Question 17

In a Snowflake organization with multiple accounts, what is the unique capability of the ORGADMIN role?

Accepted Answer

It is the only role that can create and manage new Snowflake accounts within the organization.. The ORGADMIN role is a special system role introduced with the Organization feature to manage account-level resources across the entire organization. It provides a centralized point of control for creating new accounts, monitoring usage across the organization, and managing the replication of data between different accounts.

Answer

It can view and modify data in any table across all accounts in the organization.

Answer

It replaces the ACCOUNTADMIN role for security management within each account.

Answer

It must be manually granted to a user by Snowflake Support.

Question 18

Which TWO session parameters can be adjusted to control user session timeouts and security in Snowflake?

Accepted Answer

CLIENT_SESSION_KEEP_ALIVE. Managing session timeouts is a critical part of maintaining a secure environment, as it prevents idle sessions from remaining open indefinitely. Architects can configure these parameters at the account, user, or session level to align with their organization's security policies and compliance requirements for data access.

Answer

DATA_RETENTION_TIME_IN_DAYS

Answer

NETWORK_POLICY_BYPASS_TIMEOUT

Answer

MAX_CONCURRENT_QUERIES

Question 19

An architect is designing an authentication strategy for a large organization. Which TWO options are required to enable Key-Pair authentication for a service user?

Accepted Answer

Assign the public key to the user via ALTER USER.. Key-Pair authentication improves security for automated tasks by eliminating the need for hard-coded passwords. The process requires generating a private/public key pair, associating the public key with the Snowflake user, and then configuring the client to use the private key for signing authentication requests. This method is considered a best practice for service accounts to minimize the risk of credential theft compared to traditional username/password authentication methods used in legacy systems.

Answer

Set the user's password to NULL.

Answer

Store the private key in a Snowflake stage.

Answer

Enable MFA for the service user.

Question 20

Which THREE actions are necessary to implement a secure, multi-layered data access model using row-level security and column-level masking?

Accepted Answer

Apply a Row Access Policy to the table.. Implementing fine-grained access control requires a combination of Row Access Policies and Masking Policies. Row Access Policies filter which rows are returned in a query result, while Masking Policies obfuscate sensitive column values. Combining these with a structured Role-Based Access Control model ensures that even if users have broad access, the data they see is restricted to what they are explicitly authorized to view, satisfying privacy regulations and internal security requirements effectively.

Answer

Enable Always Encrypted on the driver.

Answer

Grant the PUBLIC role ownership of the policy.