ARA-C01 Accounts and Security Practice Test 3 — 15 Questions

Question 1

An architect is configuring a Snowflake account to use federated authentication with Okta. They want to ensure that users are automatically assigned to the appropriate roles based on their Okta group memberships. Which Snowflake feature should they configure to map Okta groups to Snowflake roles?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SAML attribute mapping. SAML attribute mapping is the correct feature to map Okta groups to Snowflake roles. During SAML authentication, the identity provider can send group attributes in the SAML assertion, and Snowflake can map these to roles, enabling automatic role assignment based on Okta group membership. This aligns with the requirement for federated authentication with role mapping.

Answer

OAuth integration

Answer

SCIM integration

Answer

Key pair authentication

Question 2

A Snowflake architect is configuring federated authentication using Okta as a SAML2 identity provider. The architect needs to ensure that users are automatically assigned to the correct Snowflake roles based on their Okta group memberships. Which two steps are required to achieve this? (Choose two.)

Accepted Answer

Configure Snowflake to use the SAML attribute for group membership to assign roles.. To automatically assign Snowflake roles based on Okta groups during SAML authentication, two steps are essential: Okta must send group attributes in the SAML assertion, and Snowflake must be configured to map those attributes to roles. This is done by setting the SAML_IDENTITY_PROVIDER parameter with the attribute name for groups. SCIM and JIT provisioning handle user lifecycle but not role mapping.

Answer

In Snowflake, create roles that match the Okta group names and grant them to users.

Answer

Enable Just-In-Time (JIT) provisioning for SAML in Snowflake.

Answer

Create a SCIM integration in Okta to provision users and groups to Snowflake.

Question 3

An architect needs to grant a service account the ability to read all tables in a database and also create temporary tables in a specific schema. The service account should not have any other privileges. Which sequence of SQL statements should the architect use?

Accepted Answer

GRANT USAGE ON DATABASE mydb TO ROLE svc_role; GRANT USAGE ON ALL SCHEMAS IN DATABASE mydb TO ROLE svc_role; GRANT SELECT ON ALL TABLES IN DATABASE mydb TO ROLE svc_role; GRANT CREATE TEMPORARY TABLE ON SCHEMA mydb.myschema TO ROLE svc_role;. The correct sequence must grant read access to all tables in the database and allow creating temporary tables only in the specified schema. Granting USAGE on the database and all schemas is necessary for accessing objects. SELECT on all tables in the database provides read access. CREATE TEMPORARY TABLE on the schema allows creating temporary tables without granting permanent table creation.

Answer

GRANT USAGE ON DATABASE mydb TO ROLE svc_role; GRANT USAGE ON SCHEMA mydb.myschema TO ROLE svc_role; GRANT SELECT ON ALL TABLES IN SCHEMA mydb.myschema TO ROLE svc_role; GRANT CREATE TEMPORARY TABLE ON SCHEMA mydb.myschema TO ROLE svc_role;

Answer

GRANT USAGE ON DATABASE mydb TO ROLE svc_role; GRANT USAGE ON SCHEMA mydb.myschema TO ROLE svc_role; GRANT SELECT ON ALL TABLES IN SCHEMA mydb.myschema TO ROLE svc_role; GRANT CREATE TABLE ON SCHEMA mydb.myschema TO ROLE svc_role;

Answer

GRANT USAGE ON DATABASE mydb TO ROLE svc_role; GRANT USAGE ON ALL SCHEMAS IN DATABASE mydb TO ROLE svc_role; GRANT SELECT ON ALL TABLES IN DATABASE mydb TO ROLE svc_role; GRANT CREATE TABLE ON SCHEMA mydb.myschema TO ROLE svc_role;

Question 4

A financial institution uses Snowflake with Tri-Secret Secure. They need to ensure that data encrypted at rest cannot be accessed by Snowflake support without customer consent. They have already configured a customer-managed key in AWS KMS. What additional step must they take to fully enable Tri-Secret Secure?

Accepted Answer

Configure a customer-managed key in a supported cloud provider's KMS and enable Tri-Secret Secure in Snowflake.. To enable Tri-Secret Secure, the customer must configure a customer-managed key in a supported cloud provider's KMS and then enable Tri-Secret Secure in Snowflake. This creates a composite master key that includes both the customer-managed key and a Snowflake-managed key, ensuring that Snowflake cannot decrypt data without the customer's key. This meets the requirement for customer consent.

Answer

Enable Snowflake-managed keys for the account.

Answer

Rotate the Snowflake-managed key periodically.

Answer

Use a Snowflake-managed key and a customer-managed key together.

Question 5

A security architect is designing a Snowflake account structure for a multinational corporation with strict data residency requirements. They need to ensure that data for European users remains in EU regions and that access is restricted to authorized personnel. Which two configurations should the architect implement? (Choose two.)

Accepted Answer

Implement network policies that restrict access to specific IP ranges from EU offices.. To meet data residency, data must be stored and processed within the EU. Creating separate accounts in EU regions ensures that data remains local. Network policies restricting access to EU IP ranges further secure the environment. Other options like masking or Tri-Secret Secure do not enforce residency, and replicating to the US violates it.

Answer

Enable Tri-Secret Secure to encrypt data with customer-managed keys.

Answer

Configure account-level replication to copy data to a central US account for analytics.

Answer

Use Snowflake's data masking policies to mask PII for non-EU users.

Question 6

An architect is implementing a data governance strategy in Snowflake. They need to ensure that all data access is logged and that logs are retained for at least one year for compliance. They also need to be able to query the logs easily. Which two Snowflake features should they use to meet these requirements? (Choose two.)

Accepted Answer

Event Table. Access History provides detailed data access logging with a default retention of 365 days, and it can be queried directly. To extend retention beyond that or to centralize logs, an Event Table can be used to store telemetry data for longer periods. Together, they meet the requirements for logging, retention, and queryability.

Answer

Account Usage views

Answer

Snowflake Audit Logging

Answer

Query History

Question 7

A Snowflake architect is setting up federated authentication using SAML 2.0 with Okta as the identity provider. The organization wants to ensure that users are automatically assigned to the appropriate roles upon login based on their Okta group memberships. Which configuration is required to achieve this?

Accepted Answer

Configure the SAML integration to include a custom attribute in the SAML assertion that maps Okta groups to Snowflake roles, and set the integration's attribute mapping accordingly.. Automatic role assignment based on Okta groups requires the SAML assertion to include a custom attribute containing group information, and the Snowflake SAML integration must map that attribute to roles. This allows Snowflake to assign roles dynamically at login. SCIM handles provisioning but not dynamic role assignment during authentication, and there is no global parameter for this. Manual grants are not automatic.

Answer

Create a SCIM integration in Snowflake and configure Okta to push group memberships to Snowflake.

Answer

Use the ACCOUNTADMIN role to manually grant roles to each user after they log in via SAML.

Answer

Enable the 'SAML_ROLE_ASSIGNMENT' parameter in the Snowflake account and set it to 'AUTO'.

Question 8

A security team at a healthcare company wants to enforce that all data at rest in Snowflake is encrypted with keys they control, and they require that Snowflake itself never has access to the key material. They also need to be able to revoke access to the data immediately if a breach is suspected. Which Snowflake feature should the architect implement?

Accepted Answer

Tri-Secret Secure. Tri-Secret Secure is designed for organizations that need customer-controlled encryption keys and the ability to revoke access instantly. By combining a Snowflake-managed key with a customer-managed key in a cloud KMS, it ensures that Snowflake cannot decrypt data without the customer's key, satisfying both compliance and breach-response requirements.

Answer

Snowflake-managed encryption with periodic key rotation

Answer

Client-side encryption with a customer-supplied passphrase

Answer

Column-level encryption using ENCRYPT() and DECRYPT() functions

Question 9

A healthcare company needs to ensure that only users with the role 'PHI_ACCESS' can view columns containing protected health information. They also need to prevent users with ACCOUNTADMIN from viewing the data unless they explicitly assume the PHI_ACCESS role. Which Snowflake feature should the architect implement?

Accepted Answer

A masking policy that returns NULL for all roles except PHI_ACCESS, applied to the PHI columns. The requirement is to restrict viewing of PHI columns to only the PHI_ACCESS role, even for ACCOUNTADMIN. Dynamic Data Masking with a policy that checks CURRENT_ROLE() and masks for all other roles achieves this. Masking policies are applied at query time and cannot be bypassed by ACCOUNTADMIN unless the policy allows. Row Access Policies filter rows, not columns. Secure views rely on grants that ACCOUNTADMIN can override. Therefore, the masking policy is correct.

Answer

A secure view that filters columns and grants access only to the PHI_ACCESS role

Answer

Dynamic Data Masking with a masking policy that checks CURRENT_ROLE()

Answer

Row Access Policies with a mapping table that grants access based on role

Question 10

A Snowflake architect needs to grant a user the ability to create and manage users and roles, but should not have the ability to modify account-level settings or access data. Which role should be granted to this user?

Accepted Answer

SECURITYADMIN. SECURITYADMIN is the correct role because it can create and manage users and roles, and it has the MANAGE GRANTS privilege to grant or revoke privileges. It does not have the ability to modify account-level settings or access data by default. ACCOUNTADMIN is too powerful, SYSADMIN manages objects but not users, and USERADMIN lacks the ability to manage grants.

Answer

USERADMIN

Answer

SYSADMIN

Answer

ACCOUNTADMIN

Question 11

An organization uses Snowflake with Federated Authentication via Okta. They want to enforce that users must authenticate with MFA through Okta before accessing Snowflake, and they want to ensure that Snowflake does not allow any other authentication method. Which configuration should the architect implement?

Accepted Answer

Set up Okta as a SAML identity provider, configure Snowflake to use SSO, and set the account parameter SAML_IDENTITY_PROVIDER to Okta; also remove all password users and disable password sign-in.. To enforce Okta MFA and restrict authentication to Okta, you must configure Okta as a SAML identity provider for Snowflake SSO. Then, set the account to use SSO and disable password authentication by ensuring no password users exist or by setting the account to SSO-only. The correct parameter for SSO is SAML_IDENTITY_PROVIDER, and there is no PASSWORD_AUTHENTICATION parameter; disabling passwords is done by removing password users and setting the account to require SSO. The other options either use incorrect parameters or do not fully disable other methods.

Answer

Configure Okta as a SAML identity provider and set the account parameter ALLOW_CLIENT_MFA_CACHING to false, and enforce MFA in Okta.

Answer

Use Okta as an OAuth provider and set the account parameter OAUTH_ENABLED to true, and disable password authentication by setting PASSWORD_AUTHENTICATION to false.

Answer

Set the account parameter SAML_IDENTITY_PROVIDER to Okta and disable password authentication by setting PASSWORD_AUTHENTICATION to false.

Question 12

An architect is designing a security model for a Snowflake account that will host sensitive financial data. The organization wants to implement row-level security to ensure that users can only see data relevant to their region. They also need to audit all access to the data. Which two features should the architect use to achieve these requirements? (Choose two.)

Accepted Answer

Access History. Row Access Policies are designed to implement row-level security by dynamically filtering rows based on the user's role or other attributes. Access History provides a detailed audit log of all data access, including row-level details when row access policies are used. Together, they satisfy the requirements for row-level security and auditing.

Answer

Network Policies

Answer

Column-level Security with masking policies

Answer

Secure Views

Question 13

A multinational corporation uses Snowflake with multiple business units. They want to enforce that all data access is logged and that logs are retained for 7 years for compliance. They also need to ensure that users cannot delete or modify these logs. Which Snowflake feature should the architect implement?

Accepted Answer

Configure Snowflake to write access logs to an external stage and use cloud provider immutable storage with a 7-year retention policy.. To achieve immutable, long-term log retention, logs must be exported to an external system where immutability can be enforced. Snowflake's internal retention limits (1 year for Access History, 90 days for Time Travel) are insufficient. Using cloud provider immutable storage with a 7-year policy ensures compliance.

Answer

Enable Account Usage and configure a retention period of 7 years on the ACCOUNT_USAGE schema.

Answer

Use Access History and periodically copy the data to a separate table with a 7-year Time Travel retention.

Answer

Implement Snowflake's Access History and enable the `ENABLE_ACCESS_HISTORY` parameter with a 7-year retention.

Question 14

A security team wants to enforce that all users authenticate to Snowflake using their corporate identity provider, with no local password fallback. They have configured SAML SSO but want to prevent users from bypassing it. Which account-level setting should the architect enable?

Accepted Answer

Set the account parameter ENABLE_PASSWORD_AUTHENTICATION to false.. The account parameter ENABLE_PASSWORD_AUTHENTICATION, when set to false, disables password logins for all users, compelling them to use SSO or key-pair authentication. This is the definitive way to enforce SSO-only access and prevent users from bypassing the identity provider with local credentials. Other options either configure SSO without disabling passwords or address unrelated features.

Answer

Create a network policy that blocks all IP addresses except the IdP's.

Answer

Enable the account parameter PREVENT_UNLOAD_TO_INLINE_URL.

Answer

Set the account parameter SAML_IDENTITY_PROVIDER to the IdP's metadata URL.

Question 15

A company uses Snowflake with a network policy that allows access only from specific IP ranges. They now need to allow a set of data scientists to connect from their home offices using dynamic IP addresses. The security team wants to maintain security without disabling the network policy. Which two approaches are valid? (Choose two.)

Accepted Answer

Configure Snowflake to use a VPN or a proxy that presents a static IP address for the data scientists.. To accommodate dynamic IPs while maintaining a network policy, you can route traffic through a static IP (VPN/proxy) or use a cloud VDI with a known IP range. Both approaches ensure that connections to Snowflake come from allowed IPs, preserving security without disabling the policy.

Answer

Create a new network policy with the data scientists' current IP addresses and assign it to their users.

Answer

Enable Multi-Factor Authentication (MFA) for the data scientists and allow all IP addresses in the network policy.

Answer

Use Snowflake's Federated Authentication with an identity provider that supports IP whitelisting.