ARA-C01 Accounts and Security Practice Question
Which TWO of the following statements correctly describe the behavior of Key Pair Authentication in Snowflake?
⚠ Common exam trap
Candidates often assume that Key Pair Authentication requires a certificate authority or that the private key must be uploaded to Snowflake. They fail to understand that only the public key is registered in Snowflake.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The public key must be associated with the user profile.
Key Pair Authentication replaces traditional password authentication with a cryptographic approach using a private key stored locally and a public key registered in Snowflake. This is essential for automated services and programmatic access where hardcoded passwords pose security risks. By rotating keys and managing the public key in the user object, security architects can implement high-assurance machine-to-machine authentication protocols that eliminate the risks of credential leakage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The private key is stored in the Snowflake user object.
Why it's wrong here
Snowflake only stores the public key associated with the user. The private key must remain securely with the client application or user and should never be uploaded to Snowflake. Storing the private key in Snowflake would defeat the purpose of the asymmetric cryptographic handshake used during the authentication process.
- ✓
The public key must be associated with the user profile.
Why this is correct
To enable key pair authentication, the public key must be converted to a specific format and associated with the Snowflake user via an ALTER USER command. Snowflake uses this stored public key to verify the signature generated by the client's private key during the authentication sequence, confirming the user's identity.
- ✗
Key pair authentication is only supported for the ACCOUNTADMIN role.
Why it's wrong here
Key pair authentication is supported for all roles in Snowflake, not just privileged roles like ACCOUNTADMIN. It is a standard method for programmatic access, enabling developers and service accounts to authenticate securely without needing to rotate passwords or embed sensitive credentials within their application configuration files or environment variables.
- ✓
Key rotation involves updating the public key in the Snowflake user object.
Why this is correct
Key rotation is a standard security practice that involves generating a new key pair and updating the public key stored within the Snowflake user profile. This ensures that even if a private key is compromised, it has a limited lifetime, maintaining the integrity and security of the automated service connections.
- ✗
Snowflake manages the generation of the private key.
Why it's wrong here
The user is responsible for generating the public and private key pair on their local machine or secure vault using industry-standard tools like OpenSSL. Snowflake does not have the capability to generate or distribute private keys to users, as the private key must never leave the secure client-side environment.
About these practice questions
One of 209 original ARA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Snowflake exam blueprint
This ARA-C01 practice question is part of Courseiva's free Snowflake certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ARA-C01 exam.