SnowPro Advanced: Administrator (ADA-C02) Practice Tests

Explanation

The SERVICE user type is explicitly designed for programmatic access only and prevents login via Snowsight and other interactive clients. This is the appropriate designation for automated ETL pipelines and non-human service accounts. The PERSON type is the default for interactive human users who require UI access and should not be used for pipelines. LEGACY_SERVICE exists solely for backward compatibility with service accounts created before dedicated user types were introduced, and should not be used for new accounts. FUNCTIONAL is not a valid Snowflake user type.

Explanation

AWSVPCEID is the Network Rule type designed specifically for AWS VPC endpoint identifiers. It allows administrators to restrict Snowflake access based on specific AWS VPC endpoint IDs rather than IP address ranges, providing precise and stable access control for VPC-based connectivity. This approach is preferred over IP_RANGE for VPC scenarios because VPC endpoint identifiers remain constant even when underlying IP addresses change. IP_RANGE is used for CIDR-based IP address filtering and cannot target VPC endpoints by their identifier. HOST_PORT is used to control access based on hostname and port combinations, typically for outbound or service-level restrictions. AZURELINKID is the equivalent type for Azure Private Link subscriptions, not AWS VPC endpoints. Using the correct rule type ensures the Network Rule is evaluated against the appropriate connection attribute.

Explanation

Configuring the AWS IAM trust relationship requires two specific values returned by DESCRIBE INTEGRATION: STORAGE_AWS_IAM_USER_ARN and STORAGE_AWS_EXTERNAL_ID. The STORAGE_AWS_IAM_USER_ARN identifies the Snowflake-provisioned IAM principal that will assume the customer-managed IAM role — this ARN is placed in the trust policy's Principal element to authorize Snowflake to assume the role. The STORAGE_AWS_EXTERNAL_ID is a unique identifier that must appear as a Condition in the trust policy, preventing confused deputy attacks where unauthorized third parties could trick the IAM role into being assumed. STORAGE_AWS_ROLE_ARN is not returned by Snowflake from DESCRIBE INTEGRATION; it is the customer-created IAM role ARN that the customer provides when creating the storage integration. STORAGE_ALLOWED_LOCATIONS defines which S3 paths are accessible to Snowflake but plays no role in the IAM trust relationship configuration. STORAGE_AWS_ACCOUNT_ID is not a field returned by DESCRIBE INTEGRATION for storage integrations.

Explanation

The SERVICE user type is specifically designed for programmatic access and enforces that the account cannot authenticate through any interactive interface, including Snowsight, SnowSQL, JDBC clients, or ODBC clients. A SERVICE user is intended for automated pipelines using non-password authentication methods such as key pair authentication or OAuth tokens. PERSON is the default user type for human users who require interactive login capabilities and must not be used for automated workloads. LEGACY_SERVICE exists for backward compatibility with older service account configurations but does not enforce the strict prohibition on interactive authentication that SERVICE provides. OPERATOR is not a valid Snowflake user type.

Explanation

SERVICE is the user type specifically designed for programmatic-only access in Snowflake. Users of this type cannot log in through the Snowsight web interface or any other interactive login method, which directly satisfies the requirement. This reduces the attack surface by ensuring the ETL account is only accessible via drivers, connectors, or APIs. PERSON is the default type for human users who require interactive access and would allow Snowsight logins. LEGACY_SERVICE exists for backward compatibility with older service account configurations but does not provide the clean interactive-login restriction that SERVICE type enforces. ACCOUNTADMIN is a system-defined role, not a user type, and granting it to automated pipeline accounts violates the principle of least privilege and contradicts Snowflake best practices.