Snowflake ADA-C01 Exam - Topic 1 Question 2 Discussion

Actual exam question for Snowflake's ADA-C01 exam

Question #: 2
Topic #: 1

[All ADA-C01 Questions]

A user with the proper role issues the following commands when setting up and activating network policies:

CREATE OR REPLACE NETWORK POLICY foo_policy

ALLOWED_IP_LIST = ( '1.1.1.0/24', '2.2.2.0/24' , '3.3. 3. 0/24' )

BLOCKED IP LIST = ( '1.1.1.1')

COMMENT = 'Account level policy';

ALTER ACCOUNT SET NETWORK_POLICY=FOO_POLICY;

CREATE OR REPLACE NETWORK POLICY bar_policy

ALLOWED_IP_LIST = ('3.3.3.0/24')

BLOCKED IP LIST = ('3.3.3.10')

COMMENT = 'user level policy';

ALTER USER userl SET NETWORK_POLICY=BAR_POLICY;

Afterwards, user1 attempts to log in to Snowflake from IP address 3.3.3.10.

Will the login be successful?

AYes, because 3.3.3.10 is found in the ALLOWED_IP_LIST of bar_policy.

BNo, because 3.3.3.10 is found in the BLOCKED_IP_LIST of bar_policy.

CYes, because 3.3.3.10 is found in the ALLOWED_IP_LIST of foo_policy.

DNo, because 3.3.3.10 is not found in the ALLOWED_IP_LIST of foo_policy.

Show Suggested Answer

Suggested Answer: B

According to the Snowflake documentation1, network policies are a feature that allows restricting access to your account based on user IP address. A network policy can be applied to an account, a user, or a security integration, and can specify a list of allowed IP addresses and a list of blocked IP addresses. If there are network policies applied to more than one of these, the most specific network policy overrides more general network policies. In this case, the user1 has a network policy (bar_policy) applied to them, which overrides the account-level network policy (foo_policy). The bar_policy allows access only from the IP range 3.3.3.0/24, and blocks access from the IP address 3.3.3.10. Therefore, the user1 will not be able to log in to Snowflake from IP address 3.3.3.10, as it is found in the BLOCKED_IP_LIST of bar_policy. Option A is incorrect because the ALLOWED_IP_LIST of bar_policy does not override the BLOCKED_IP_LIST of bar_policy. Option C is incorrect because the ALLOWED_IP_LIST of foo_policy does not apply to user1, as it is overridden by the user-level network policy. Option D is incorrect because the ALLOWED_IP_LIST of foo_policy does not matter, as it is overridden by the user-level network policy.

by Gregoria at Jan 26, 2024, 12:31 PM

Limited Time Offer

25%

5 months ago

I'm pretty sure the Visualization tab is where I've seen those types of charts before, so I'll go with option D.

upvoted 0 times

...