ARA-C01 Snowflake Architecture Practice Question
An architect is configuring a Snowflake account to use Federated Authentication with Okta. The requirement is that users must authenticate through Okta and receive Snowflake roles based on their Okta group membership. The architect has already configured the SAML integration. What additional step is required to map Okta groups to Snowflake roles?
⚠ Common exam trap
Candidates often confuse authentication (SAML) with provisioning (SCIM); SAML alone does not synchronize group memberships or assign roles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a SCIM integration in Snowflake and configure the Okta provisioning connector.
To map Okta groups to Snowflake roles automatically, the architect must set up SCIM integration. SCIM allows Okta to provision users and groups into Snowflake, and Snowflake can then assign roles based on group membership. SAML alone handles authentication but not provisioning. The other options either misunderstand the role of SAML or propose custom solutions that are not standard.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the Snowflake JDBC driver to pass Okta group information as a session parameter.
Why it's wrong here
The JDBC driver is used for client connections and does not manage role provisioning. Passing group information as a session parameter would not automatically create or assign roles. Role mapping must be handled at the identity provider integration level, typically via SCIM, not through client drivers.
- ✗
Create a SAML integration with the attribute 'Role' in the Okta SAML assertion.
Why it's wrong here
While SAML assertions can include custom attributes, Snowflake does not automatically map arbitrary SAML attributes to roles. The SAML integration is used for authentication, not for role provisioning. Role mapping requires SCIM or manual role assignment. Including a 'Role' attribute in the SAML assertion would not automatically assign roles in Snowflake.
- ✗
Create a stored procedure that queries the Okta API and assigns roles based on group membership.
Why it's wrong here
A custom stored procedure could technically be written to call the Okta API, but it would be a manual, non-standard solution. Snowflake provides native SCIM integration for this purpose, which is more reliable and maintainable. The scenario expects the standard architectural approach, which is SCIM, not a custom stored procedure.
- ✓
Create a SCIM integration in Snowflake and configure the Okta provisioning connector.
Why this is correct
SCIM integration allows Snowflake to receive user and group information from Okta, enabling automatic provisioning and role mapping. By configuring the Okta provisioning connector, group memberships can be synchronized, and Snowflake roles can be assigned based on those groups. This is the standard way to map Okta groups to Snowflake roles without manual intervention.
About these practice questions
One of 209 original ARA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Snowflake exam blueprint
This ARA-C01 practice question is part of Courseiva's free Snowflake certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ARA-C01 exam.