COF-C03 - Account Management and Data Governance - Section 2.2

Describe authentication and network security including multi-factor authentication, single sign-on, key-pair authentication, and network policies.

Describe how Snowflake authenticates users and restricts connectivity: multi-factor authentication, single sign-on through a federated identity provider, key-pair authentication for service accounts, and network policies that allow or block IP ranges. Match a requirement (human users, automated services, restricted networks) to the right control.

multi-factor authenticationsingle sign-onfederated authenticationkey-pair authenticationnetwork policies

Practice question for this objective

Free sampleAccount Management and Data Governancemedium

A company already authenticates its workforce through an external SAML 2.0 identity provider and wants Snowflake users to sign in through that provider, with the identity provider asserting who the user is rather than Snowflake validating a password. Which Snowflake configuration object connects Snowflake to that external identity provider for browser-based single sign-on?

  • AA network policy listing the identity provider's IP ranges, so only logins originating from that provider's addresses are accepted.
  • BA masking policy that maps each federated identity to a Snowflake role and hides the user's external credentials at login.
  • CA security integration of type SAML2, which registers the external identity provider so Snowflake trusts its federated authentication assertions. Correct
  • DA key-pair assignment that stores the identity provider's public key on each user so the provider can sign each login request.
Federated single sign-on to an external SAML identity provider is configured in Snowflake with a SAML2 security integration. Single sign-on relies on Snowflake trusting assertions issued by an external identity provider. A security integration of type SAML2 registers that provider, recording its issuer and certificate, so Snowflake redirects browser logins to it and accepts the federated authentication response in place of validating a password directly.

Why A is wrong: A network policy filters source IP addresses and does nothing to establish trust in a provider's identity assertions, so it cannot deliver single sign-on.

Why B is wrong: Masking policies obfuscate column values at query time and have no connection to authentication, so they cannot federate sign-in to an external provider.

Why C is correct: A SAML2 security integration registers the provider's certificate and issuer so Snowflake trusts its assertions and redirects browser logins for single sign-on.

Why D is wrong: Key-pair authentication uses an RSA key on the Snowflake user for unattended access, not a browser redirect to an external SAML provider for single sign-on.

See more COF-C03 practice questions, answers explained.

More in this domain

Back to all Account Management and Data Governance objectives, or the COF-C03 cert hub.

Examworthy is not affiliated with or endorsed by Snowflake. Original, blueprint-aligned practice material only.