ARA-C01 Accounts and Security Practice Test 4 — 15 Questions

Question 1

A financial services firm runs Snowflake on AWS in us-east-1. A security architect must ensure that all data written to Snowflake-managed storage is encrypted with a key the firm controls, that the key material never leaves the firm's AWS KMS managed HSM, and that revoking the key renders the data immediately unreadable. Which configuration should the architect implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the account parameter ENCRYPTION_KEY_TYPE to CUSTOMER_MANAGED_KEY and configure Tri-Secret Secure with a customer-managed key in AWS KMS.. The requirement for customer-controlled key material held in the firm's own KMS, combined with the ability to instantly revoke access, maps directly to Tri-Secret Secure with a customer-managed key. Only this approach keeps a key component outside Snowflake's control while still protecting Snowflake-managed storage, tables, and time travel data. Application-level encryption and external bucket encryption do not cover internal storage or provide the required key custody.

Answer

Enable client-side encryption by having all ingestion pipelines call the ENCRYPT() function before writing to internal stages.

Answer

Create a storage integration that points to an external S3 bucket encrypted with SSE-KMS and load all data through external stages.

Answer

Set the account parameter DATA_RETENTION_TIME_IN_DAYS to zero and rely on Snowflake's default AES-256 encryption for all stored data.

Question 2

An architect is designing a multi-account strategy using Snowflake Organizations. They need to ensure that a central security team can monitor login activity across all accounts and enforce consistent network policies. Which approach best meets these requirements while adhering to Snowflake's security model?

Accepted Answer

Implement a centralized logging solution by exporting login events to a cloud storage bucket and use a script to apply network policies in each account via SQL.. Centralized monitoring and policy enforcement across multiple accounts require aggregating login data from each account and applying policies individually, since Snowflake does not provide a built-in cross-account network policy or login history view. Exporting events to a central location and using automation to apply policies in each account is the most feasible approach within Snowflake's security model.

Answer

In each account, create a role with MONITOR and SECURITYADMIN privileges, and have the central team assume that role via role hierarchy from the organization account.

Answer

Create a dedicated security account, grant the security team the ORGADMIN role in that account, and use it to manage network policies across all accounts.

Answer

Use the ORGANIZATION_USAGE schema in the organization account to query LOGIN_HISTORY and configure network policies via replication.

Question 3

An architect manages a Snowflake account where a dynamic data masking policy is applied to a column containing national ID numbers. A compliance officer must be able to view unmasked values for investigations, but only while working from an approved corporate network range and only using a dedicated role. Which combination should the architect implement?

Accepted Answer

Modify the masking policy body to return the raw column only when CURRENT_ROLE() equals the compliance role, and enforce the network restriction with a role-level network policy.. Revealing masked values to a specific role is done inside the masking policy using a CURRENT_ROLE() condition, while network restrictions are enforced separately by a network policy attached to that role. This layered approach keeps the masking policy as the single source of truth for data visibility and uses the network policy purely for connectivity control. Granting administrative privileges or inventing exemption privileges does not produce the required behavior.

Answer

Apply an account-level network policy that permits only the corporate range, and grant the compliance role the EXEMPT_ACCESS privilege on the masking policy.

Answer

Create a mapping table that lists the compliance role and the approved IP range, then reference it in the masking policy's condition using CURRENT_ROLE() and the network context.

Answer

Grant the compliance role the MASKING_ADMIN privilege and add the corporate IP range to a network policy assigned to that role.

Question 4

A healthcare company must prove to auditors that privileged access to PHI is tightly governed. The security team wants to enforce that no single administrator can both grant access to a sensitive database and read its contents without oversight. Which two capabilities should the architect combine in Snowflake to satisfy this segregation-of-duties requirement? (Choose two.)

Accepted Answer

Grant the MANAGE GRANTS privilege only to a dedicated SECURITYADMIN-style custom role that does not hold SELECT on the PHI database.. Segregation of duties is achieved by ensuring the authority to grant access and the authority to read protected data reside in different roles. A dedicated grant-management role without SELECT on the PHI database, paired with database roles that scope read privileges inside the PHI database, creates that separation. Account-wide superuser roles, key-custody features, and shares do not split these two authorities and therefore fail the audit objective.

Answer

Create a share of the PHI database to a reader account and rely on the share's grants to enforce least privilege.

Answer

Assign the ACCOUNTADMIN role to the security team lead so that all privileged operations are funneled through one accountable individual.

Answer

Enable Tri-Secret Secure so that only the key custodian can decrypt PHI, effectively separating read access from administration.

Question 5

A global retailer uses Snowflake with Okta as its SAML identity provider. The security team wants users to authenticate with Okta but wants Snowflake to accept only assertions that include a specific group attribute, and wants users to receive roles automatically based on that attribute at login. Which two mechanisms must the architect configure to meet these goals?

Accepted Answer

Use an External OAuth integration with Okta as the authorization server, map Okta groups to Snowflake roles via a session policy and the integration's scope-to-role mapping, and validate the group claim.. Login-time role assignment based on identity-provider group claims is a feature of External OAuth integrations combined with session policies, where scopes or claims map to Snowflake roles. Restricting acceptance to tokens carrying a specific group attribute is enforced by validating the claim during the OAuth exchange. Plain SAML integrations pass attributes but do not natively perform this role mapping, and SCIM handles provisioning rather than login-time role selection.

Answer

Configure the SAML integration with a custom ASSERTION attribute mapping and define SCIM-based role assignment through the Okta provisioning connector.

Answer

Enable the SAML integration's REQUIRE_ASSERTION_ATTRIBUTE and use the DEFAULT_ROLE and DEFAULT_SECONDARY_ROLES session parameters to apply roles from the assertion.

Answer

Use a SAML2 integration with a custom attribute mapping for group membership and configure the login to honor the assertion by setting session parameters through the integration's custom claims handling.

Question 6

Which TWO of the following statements correctly describe the behavior of Key Pair Authentication in Snowflake?

Accepted Answer

The public key must be associated with the user profile.. Key Pair Authentication replaces traditional password authentication with a cryptographic approach using a private key stored locally and a public key registered in Snowflake. This is essential for automated services and programmatic access where hardcoded passwords pose security risks. By rotating keys and managing the public key in the user object, security architects can implement high-assurance machine-to-machine authentication protocols that eliminate the risks of credential leakage.

Answer

The private key is stored in the Snowflake user object.

Answer

Key pair authentication is only supported for the ACCOUNTADMIN role.

Answer

Snowflake manages the generation of the private key.

Question 7

An architect is designing a security model where a specific service account should only have access to perform SELECT operations on tables within a specific schema. How should this be implemented to adhere to the principle of least privilege?

Accepted Answer

Create a custom role, grant USAGE on database and schema, then grant SELECT on all tables.. Implementing least privilege requires defining specific roles with limited scope. The best approach is to create a custom role, grant USAGE on the database and schema, and grant SELECT on the tables. This prevents the service account from performing DDL or DML operations, limiting the impact of a compromised account. This granular control is essential for preventing lateral movement and ensuring data integrity in production pipelines.

Answer

Grant the SECURITYADMIN role to the service account.

Answer

Assign the ACCOUNTADMIN role to the service account.

Answer

Grant SELECT on the whole database to the PUBLIC role.

Question 8

Which THREE of the following are valid methods for securing data in transit for connections to Snowflake?

Accepted Answer

Enforcing TLS 1.2+ for all client drivers.. Snowflake enforces TLS 1.2 or higher for all client connections. Securing data in transit is a non-negotiable requirement for compliance (e.g., HIPAA, SOC2). Architects must ensure that the client software and drivers are configured to use secure protocols, that private connectivity is utilized for sensitive environments, and that connections are validated against trusted sources, thereby mitigating the risk of man-in-the-middle attacks and data interception during transit.

Answer

Implementing client-side data encryption with PGP.

Answer

Enabling the Snowflake data sharing feature.

Question 9

An architect needs to audit all queries executed by users in the last 30 days. Which approach is most efficient?

Accepted Answer

Query the SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY view.. The SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY view is the standard interface for auditing executed queries. It provides a comprehensive historical record of all SQL commands, their execution times, and the users who ran them. This is the most efficient and scalable method for auditing compared to manual logs or local metadata, as it is maintained and optimized by Snowflake, ensuring minimal impact on production query performance.

Answer

Query the INFORMATION_SCHEMA.QUERY_HISTORY view.

Answer

Enable query logging in the user profile.

Answer

Use the GET_QUERY_HISTORY() function.

Question 10

Which feature is essential for ensuring that queries on PII (Personally Identifiable Information) columns are masked from unauthorized users?

Accepted Answer

Dynamic Data Masking (DDM).. Dynamic Data Masking is the correct feature for protecting sensitive data like PII. It allows an architect to apply a policy to a table column that masks the data based on the user's role. This ensures that unauthorized users see masked, non-sensitive versions of the data, while authorized users see the original raw values, providing a robust solution for compliance and data protection without duplicating data or creating complex views.

Answer

Row-Level Security (RLS).

Answer

Data Encryption at Rest.

Answer

Object Tagging.

Question 11

An organization has a Network Policy applied at the Account level to restrict IP ranges. A specific user requires access from a home office IP not in the account range. How should the architect configure this while maintaining the strictest security posture?

Accepted Answer

Create a user-level network policy and assign it directly to that specific user account.. Snowflake evaluates network policies at the most granular level first, starting with the user, then the account. Applying a specific policy to the individual user overrides the account-level restrictions without opening access for the entire organization. This hierarchy allows for precise control over entry points while maintaining a broad security baseline for all other platform participants.

Answer

Modify the existing account-level network policy to include the user's home IP address.

Answer

Create a new role for the user and attach the network policy to that specific role.

Answer

Disable the account-level network policy and rely solely on multi-factor authentication for security.

Question 12

A Snowflake architect is using the Data Exchange to share data with a partner who does not have a Snowflake account. What is the most appropriate feature to use?

Accepted Answer

The creation of a Managed (Reader) Account for the partner.. Managed accounts, also known as reader accounts, allow Snowflake customers to share data with parties who do not have their own Snowflake subscription. This feature enables the provider to bear the cost of the consumer's queries, facilitating easy and secure data collaboration without requiring the partner to manage an account.

Answer

Direct Data Sharing to the partner's corporate email address.

Answer

FTP export to the partner's secure external storage bucket.

Answer

Granting the partner access via a temporary security token.

Question 13

What is the primary benefit of implementing Snowflake Tri-Secret Secure?

Accepted Answer

It allows customers to have total control over data access by managing one of the master keys.. Tri-Secret Secure is an advanced security feature that combines a customer-managed key with Snowflake-managed keys to encrypt data. This provides an additional layer of control, as it allows the customer to revoke access to their data by disabling their key in their own cloud provider's Key Management Service.

Answer

It automatically rotates data encryption keys every 24 hours.

Answer

It enables the use of three different identity providers for authentication.

Answer

It provides a three-way handshake for all data transfers via Snowpipe.

Question 14

Which security integration type should an architect use to allow a third-party BI tool to access Snowflake without storing the user's credentials in the tool?

Accepted Answer

External OAuth Security Integration.. OAuth is the industry-standard protocol for delegated authorization, allowing third-party applications to access Snowflake on behalf of a user. By using OAuth, the BI tool never sees the user's password; instead, it receives a secure token that grants specific, time-limited access to the Snowflake environment.

Answer

SAML2 Security Integration.

Answer

SCIM Security Integration.

Answer

API Authentication Integration.

Question 15

A financial organization needs to ensure that only connections originating from their corporate VPN IP range can access their Snowflake account. Which feature should the architect implement?

Accepted Answer

Apply a Network Policy at the account level.. Network Policies provide the primary mechanism for controlling access based on IP addresses. By defining an allowed list of CIDR blocks, the architect creates a perimeter defense that prevents unauthorized access from public networks. This is crucial for compliance in highly regulated industries, ensuring that data exposure risks are mitigated by restricting the attack surface to trusted network locations only, effectively blocking any connection attempts outside the defined enterprise perimeter.

Answer

Enable MFA for all users.

Answer

Configure SCIM provisioning.

Answer

Implement OAuth security integration.