ARA-C01 Accounts and Security Practice Test 1 — 15 Questions

Question 1

An organization requires that all users logging into Snowflake from outside the corporate network must provide a second authentication factor. How can an architect enforce this requirement globally?

Accepted Answer

Use an Authentication Policy to mandate MFA for specific network conditions.. To enforce Multi-Factor Authentication (MFA) globally, the ACCOUNTADMIN must configure the security integration or user properties. While MFA can be configured at the user level, enforcing it globally involves setting the authentication policy or ensuring that the identity provider manages the second factor. This is critical for maintaining zero-trust architecture and ensuring that compromised passwords alone are insufficient for unauthorized data access.

Answer

Apply a network policy that forces MFA for all IP ranges.

Answer

Set the global parameter MFA_ENFORCE to TRUE.

Answer

Configure the CLIENT_SESSION_KEEP_ALIVE parameter.

Question 2

A security architect needs to ensure that data access logs are immutable and available for auditing for at least one year. Which feature should be used to achieve this compliance requirement?

Accepted Answer

Create a scheduled task to clone the ACCESS_HISTORY view to a secured database.. Snowflake provides the ACCESS_HISTORY view within the SNOWFLAKE.ACCOUNT_USAGE schema to track data access. To ensure these logs are immutable and archived for compliance, the architect should utilize Snowflake's data sharing or replication features to move this data to a separate, locked-down security account. This prevents deletion or modification by users with account-level privileges who might attempt to scrub logs to hide unauthorized activities.

Answer

Enable Time Travel on the SNOWFLAKE database.

Answer

Configure Data Retention Period to 365 days on all tables.

Answer

Use the AUDIT_LOG_SETTING parameter.

Question 3

An architect is configuring SCIM for user provisioning. Why is the `provisioner_role` crucial in this setup?

Accepted Answer

It allows the SCIM integration to create, modify, and delete users.. The `provisioner_role` defines the permissions that the SCIM integration uses to manage users and roles within Snowflake. Without the correct privileges, the SCIM integration will fail to synchronize updates from the Identity Provider (IdP) to Snowflake. Properly scoping this role ensures that the SCIM integration can only perform the necessary provisioning tasks without having excessive account-wide privileges, maintaining a secure and automated identity lifecycle.

Answer

It determines the authentication method for the SCIM endpoint.

Answer

It enables MFA for users provisioned via SCIM.

Answer

It encrypts the traffic between the IdP and Snowflake.

Question 4

A security architect wants to prevent users from creating external stages with embedded credentials. What is the most effective approach?

Accepted Answer

Use Storage Integrations instead of direct credential passing.. To prevent the creation of insecure external stages, an architect should implement a custom role that does not have the `CREATE STAGE` privilege and ensure that only authorized administrators can create stages. Furthermore, using Storage Integrations allows the architect to abstract credentials, preventing users from ever seeing or managing access keys, which is a fundamental security practice for protecting cloud storage endpoints from unauthorized access.

Answer

Create a Resource Monitor on all stages.

Answer

Grant the SECURITYADMIN role to all users.

Answer

Modify the PUBLIC role to revoke all privileges.

Question 5

Which TWO actions should an architect take to ensure that data stored in Snowflake is protected from unauthorized access at rest?

Accepted Answer

Enable Tri-Secret Secure for account-level key control.. Protecting data at rest is handled automatically by Snowflake using AES-256 encryption. To complement this, architects should implement robust identity and access management (IAM) via role-based access control (RBAC) and utilize network policies to restrict access. These layers of defense ensure that even if encryption keys were compromised, the data remains inaccessible without valid credentials and network access, thereby maintaining a defense-in-depth posture for all data stored within the account.

Answer

Manually encrypt all files before uploading.

Answer

Disable all Time Travel features.

Answer

Set all database tables to read-only mode.

Question 6

A user reports they can see data in a table, but their assigned role does not have explicit SELECT permissions. What is the most likely cause?

Accepted Answer

The user is an owner of the table.. The most common reason for this behavior is that the user or their role is a member of a higher-level role that has been granted the required privileges. Snowflake's role hierarchy allows privileges to be inherited from parent roles to child roles. If a role is granted to another, the child role gains all the privileges of the parent, which often leads to unexpected visibility if the hierarchy is not properly managed.

Answer

The role has the BROWSE_ALL_DATA privilege.

Answer

The table has a global tag applied.

Answer

The user has access through the PUBLIC role.

Question 7

An architect is asked to ensure that an application service account does not use a password. What is the recommended strategy for machine authentication?

Accepted Answer

Use OAuth integration with an external IdP.. For machine-to-machine authentication, Snowflake recommends Key Pair Authentication. By generating an RSA key pair and storing the public key in the Snowflake user profile, applications can authenticate using a private key securely stored in a vault or local secure storage. This eliminates the risk of password rotation and credential exposure, which is the standard for secure, automated service-based connections in production environments.

Answer

Implement a shared session token.

Answer

Store the password in a clear-text environment variable.

Answer

Enable SSO for the service account.

Question 8

Which TWO statements are true regarding Snowflake's SCIM implementation with external Identity Providers?

Accepted Answer

SCIM can be used to synchronize users and groups from an IdP to Snowflake.. Snowflake supports System for Cross-domain Identity Management (SCIM) to automate the exchange of user identity information between Snowflake and identity providers like Okta or Microsoft Entra ID. Architects must understand that SCIM manages users and groups but does not handle the assignment of object-level privileges, which remains a task for Snowflake’s internal Role-Based Access Control system.

Answer

SCIM automatically grants ownership of existing databases to newly synced administrative users.

Answer

Snowflake stores the user's IdP password in plain text to facilitate SCIM sync operations.

Answer

Deactivating a user in the IdP will immediately drop all tables owned by that user.

Question 9

Refer to the exhibit. Based on the commands shown, what is the resulting privilege structure for the user 'jsmith'?

Accepted Answer

The user jsmith inherits all privileges from both the analyst and senior_analyst roles.. Understanding role inheritance is critical for architects to ensure that users have the correct permissions without redundant granting. In Snowflake, roles form a hierarchy where higher-level roles inherit all privileges of the roles granted to them. This structure simplifies management by allowing permissions to be aggregated and passed up the chain to the end user.

Answer

The user jsmith can only access objects granted directly to the senior_analyst role.

Answer

Role inheritance only works if the analyst role is also granted directly to the user jsmith.

Answer

The senior_analyst role must be a system-defined role for the inheritance to function.

Question 10

An architect needs to implement Key-Pair authentication for a service account used by an ETL tool. What is a requirement for the public key when configuring the user in Snowflake?

Accepted Answer

The public key must be stripped of its header, footer, and all newline characters.. Key-Pair authentication provides a more secure alternative to traditional password-based login for automated tools and services. Snowflake requires the public key to be assigned to the user profile, allowing the platform to verify the signature of the private key provided by the ETL tool during the connection phase.

Answer

The public key must be encrypted with a passphrase before being uploaded to Snowflake.

Answer

The public key must be stored in a Snowflake internal stage before it can be assigned.

Answer

The public key must be generated using the SHA-256 hashing algorithm exclusively.

Question 11

An Architect is designing a secure connection between a corporate VPC and Snowflake using AWS PrivateLink. Which TWO components are required to ensure the connection is private and secure?

Accepted Answer

An Interface VPC Endpoint created in the customer's AWS Virtual Private Cloud.. AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises applications. When using PrivateLink with Snowflake, traffic does not traverse the public internet, which significantly reduces the exposure to external threats and satisfies strict compliance requirements for data transit within highly regulated industries.

Answer

A public DNS record pointing to the Snowflake account's public URL.

Answer

A NAT Gateway configured in the Snowflake VPC to allow outbound responses.

Answer

A dedicated hardware security module (HSM) installed in the customer data center.

Question 12

When configuring Account Replication, which object type is NOT automatically replicated from the primary to the secondary account?

Accepted Answer

External stages and their associated storage integrations.. Account replication allows for the synchronization of account-level objects and data between different Snowflake accounts for disaster recovery. However, certain objects that are closely tied to the specific infrastructure or external integrations of an account are excluded from the automated replication process and must be managed manually.

Answer

User-defined roles and their associated privilege grants.

Answer

Network policies assigned to the account or specific users.

Answer

Users and their associated authentication metadata like public keys.

Question 13

Which TWO best practices should be followed when implementing Multi-Factor Authentication (MFA) for a Snowflake account?

Accepted Answer

Enforce MFA for all human users with administrative roles like ACCOUNTADMIN.. MFA adds a critical layer of security by requiring a second form of verification. While Snowflake makes MFA easy to implement via Duo Security, architects must balance security requirements with the need for automated service accounts to function without manual intervention, which often involves different authentication strategies.

Answer

Enable MFA for service accounts used by automated ETL processes.

Answer

Use the 'MINS_TO_BYPASS_MFA' property to permanently disable MFA for remote users.

Answer

Require users to change their MFA device every 30 days for maximum security.

Question 14

Refer to the exhibit. If a user with the role 'DEVELOPER' queries a column protected by this policy, what will they see?

Accepted Answer

The masked string '*********'.. Dynamic Data Masking allows architects to protect sensitive data at query time based on the user's current role. The policy logic uses the CURRENT_ROLE function to evaluate permissions dynamically. If the user's active role is not explicitly listed in the authorized set, the mask is applied to the output.

Answer

The actual email address stored in the table.

Answer

A NULL value for every row in the column.

Answer

An error message stating they have insufficient privileges.

Question 15

An architect is considering the use of Secondary Roles in a user session. Which TWO statements accurately describe the behavior of Secondary Roles?

Accepted Answer

Secondary roles can be activated using the command 'USE SECONDARY ROLES ALL'.. Secondary roles allow a user to aggregate privileges from multiple roles they have been granted without needing to switch their primary role. This feature is particularly useful for performing cross-functional tasks that require permissions from different parts of the role hierarchy simultaneously, improving productivity and simplifying session management.

Answer

Objects created in the session are owned by the active secondary role with the most privileges.

Answer

Secondary roles allow a user to perform actions that require the ACCOUNTADMIN role.

Answer

The privileges of secondary roles are only available for SELECT statements.