Snowflake ARA-C01 Exam - Topic 1 Question 9 Discussion

Actual exam question for Snowflake's ARA-C01 exam

Question #: 9
Topic #: 1

A company is using a Snowflake account in Azure. The account has SAML SSO set up using ADFS as a SCIM identity provider. To validate Private Link connectivity, an Architect performed the following steps:

* Confirmed Private Link URLs are working by logging in with a username/password account

* Verified DNS resolution by running nslookups against Private Link URLs

* Validated connectivity using SnowCD

* Disabled public access using a network policy set to use the company's IP address range

However, the following error message is received when using SSO to log into the company account:

IP XX.XXX.XX.XX is not allowed to access snowflake. Contact your local security administrator.

What steps should the Architect take to resolve this error and ensure that the account is accessed using only Private Link? (Choose two.)

AAlter the Azure security integration to use the Private Link URLs.

BAdd the IP address in the error message to the allowed list in the network policy.

CGenerate a new SCIM access token using system$generate_scim_access_token and save it to Azure AD.

DUpdate the configuration of the Azure AD SSO to use the Private Link URLs.

EOpen a case with Snowflake Support to authorize the Private Link URLs' access to the account.

Show Suggested Answer

Suggested Answer: B, C

by Yolando at May 29, 2023, 11:01 PM

Limited Time Offer

25%

Off

Get Premium ARA-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Leonie

3 months ago

I thought Private Link was supposed to prevent this kind of access?

upvoted 0 times

...

Justine

3 months ago

Agree, altering the security integration is key here.

upvoted 0 times

...

Weldon

4 months ago

Wait, why would you add that IP to the allowed list? Seems risky.

upvoted 0 times

...

Mignon

4 months ago

Definitely need to update Azure AD SSO settings!

upvoted 0 times

...

Lachelle

4 months ago

Sounds like a network policy issue.

upvoted 0 times

...

Nickie

4 months ago

I'm leaning towards altering the Azure security integration, but I wonder if that would actually resolve the SSO issue or if we need to do something else first.

upvoted 0 times

...

Fallon

4 months ago

I practiced a similar question where we had to generate a SCIM access token, but I can't recall if that was necessary for this scenario.

upvoted 0 times

...

Dustin

5 months ago

I think adding the IP address to the allowed list could be a quick fix, but it feels like a temporary solution rather than addressing the root cause.

upvoted 0 times

...

Matthew

5 months ago

I remember something about needing to update the Azure AD SSO configuration, but I'm not sure if it's specifically about the Private Link URLs.

upvoted 0 times

...

Adelina

5 months ago

This is a tricky one. I need to make sure I fully comprehend the differences between the options and how they relate to the NSR configuration. I'll take my time and work through this methodically.

upvoted 0 times

...

Mitsue

5 months ago

Okay, let's think this through step-by-step. The question mentions using the same template, so the issue is likely not in the l-BGP setup. I'll focus on examining the E-BGP neighbor configurations and any potential routing policies that could be blocking the route exchange.

upvoted 0 times

...

Joana

5 months ago

I feel like running shoes require more thought and effort to purchase, so they might not be considered convenience items. I'm leaning towards the soda as well, but the online concert tickets are throwing me off.

upvoted 0 times

...

Wade

5 months ago

I'm kind of stumped on this one. "Voluntary" sounds like it could apply, but I keep thinking about how plans usually enforce compliance with a closed formulary. So maybe it's "closed / mandatory"?

upvoted 0 times

...

Tonette

5 months ago

I feel like I've seen a similar question before, but I'm kind of torn between just saying the first one is true and whether the second one could be true too.

upvoted 0 times

...

Werner

5 months ago

I practiced similar questions before and I'm pretty certain risk identification is key, but I keep second-guessing myself on the order of the steps!

upvoted 0 times

...

Nobuko

5 months ago

Ah, this is a good one. I'm pretty confident the answer is VLAN. In a cloud environment, using VLANs allows you to isolate different IP spaces and create logical network segments. That's exactly what the question is asking about.

upvoted 0 times

...