COF-C03 - Account Management and Data Governance (20% of the exam) - Section 2.2

Describe authentication and network security including multi-factor authentication, single sign-on, key-pair authentication, and network policies.

Describe how Snowflake authenticates users and restricts connectivity: multi-factor authentication, single sign-on through a federated identity provider, key-pair authentication for service accounts, and network policies that allow or block IP ranges. Match a requirement (human users, automated services, restricted networks) to the right control.

multi-factor authenticationsingle sign-onfederated authenticationkey-pair authenticationnetwork policies

Practice question for this objective

Free sampleAccount Management and Data Governancemedium

A company already authenticates its workforce through an external SAML 2.0 identity provider and wants Snowflake users to sign in through that provider, with the identity provider asserting who the user is rather than Snowflake validating a password. Which Snowflake configuration object connects Snowflake to that external identity provider for browser-based single sign-on?

AA network policy listing the identity provider's IP ranges, so only logins originating from that provider's addresses are accepted.
BA masking policy that maps each federated identity to a Snowflake role and hides the user's external credentials at login.
CA security integration of type SAML2, which registers the external identity provider so Snowflake trusts its federated authentication assertions. Correct
DA key-pair assignment that stores the identity provider's public key on each user so the provider can sign each login request.

Federated single sign-on to an external SAML identity provider is configured in Snowflake with a SAML2 security integration. Single sign-on relies on Snowflake trusting assertions issued by an external identity provider. A security integration of type SAML2 registers that provider, recording its issuer and certificate, so Snowflake redirects browser logins to it and accepts the federated authentication response in place of validating a password directly.

Why A is wrong: A network policy filters source IP addresses and does nothing to establish trust in a provider's identity assertions, so it cannot deliver single sign-on.

Why B is wrong: Masking policies obfuscate column values at query time and have no connection to authentication, so they cannot federate sign-in to an external provider.

Why C is correct: A SAML2 security integration registers the provider's certificate and issuer so Snowflake trusts its assertions and redirects browser logins for single sign-on.

Why D is wrong: Key-pair authentication uses an RSA key on the Snowflake user for unattended access, not a browser redirect to an external SAML provider for single sign-on.

See more COF-C03 practice questions, answers explained.

Exam traps in Account Management and Data Governance

Answers that look right on this material and are not. Each one is a distractor from a different question in the COF-C03 bank for this domain.

Configure key-pair authentication for each user, so the external identity provider issues a private key that every employee uses in place of their corporate password when signing in
Why it is wrong: Key-pair authentication relies on RSA keys registered per user and does not delegate sign-in to an identity provider, so it does not give the corporate-credential single sign-on experience required.
Multi-factor authentication, because enrolling the service account in 'Multi-factor authentication' lets the pipeline complete the second factor automatically on every programmatic connection it makes
Why it is wrong: 'Multi-factor authentication' requires an interactive second factor such as a push approval or passcode, which an unattended pipeline cannot supply, so it is unsuitable for a headless service account.
The SYSADMIN role, which owns warehouses and databases and is therefore the natural place to administer authentication and network security settings.
Why it is wrong: SYSADMIN manages compute and data objects, not account security controls, so it is the wrong role for network policies, integrations, and MFA enrolment.

Examworthy is not affiliated with or endorsed by Snowflake. Original, blueprint-aligned practice material only.