ADA-C01 practice question 3 of 10

What is required for stages, without credentials, to limit data exfiltration after a storage integration and associated stages are created?

Domain Account Management and Data Protection

Answer options

A: ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = true; ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION = true; ALTER ACCOUNT my_account SET PREVENT_UNLOAD_TO_INLINE_URL = false;

B: ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = false; ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION = false; ALTER ACCOUNT my_account SET PREVENT_UNLOAD_TO_INLINE_URL = true;

C: ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = false; ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_OPERATION = false; ALTER ACCOUNT my_account SET PREVENT_UNLOAD_TO_INLINE_URL = false;

D: ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = true; ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION FOR STAGE_OPERATION = true; ALTER ACCOUNT my_account SET PREVENT_UNLOAD_TO_INLINE_URL = true; Correct answer

Correct Answer:

D. ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = true; ALTER ACCOUNT my_account SET REQUIRE_STORAGE_INTEGRATION FOR STAGE_OPERATION = true; ALTER ACCOUNT my_account SET PREVENT_UNLOAD_TO_INLINE_URL = true;

Explanation

To comprehensively limit data exfiltration, multiple account-level controls must be enabled. Setting REQUIRESTORAGEINTEGRATIONFORSTAGECREATION = true ensures that users cannot create new external stages with their own credentials that could point to unauthorized locations. Setting REQUIRESTORAGEINTEGRATIONFORSTAGEOPERATION = true mandates that all data movement via stages uses a pre-approved storage integration. Finally, setting PREVENTUNLOADTOINLINEURL = true blocks users from bypassing stage controls by unloading data directly to a presigned URL. Collectively, these three parameters provide a robust defense against common data exfiltration vectors.

Why Incorrect

A. Setting PREVENTUNLOADTOINLINEURL to false leaves open a significant exfiltration path by allowing users to unload data to arbitrary presigned URLs.
B. Disabling the REQUIRESTORAGEINTEGRATION parameters removes the core security control that forces data movement through approved, administrator-configured cloud storage locations.
C. This configuration disables all relevant security controls, thereby increasing the risk of data exfiltration rather than preventing it.

References

1. Snowflake Documentation: Account Parameters » REQUIRESTORAGEINTEGRATIONFORSTAGECREATION. This document states, "Specifies whether to block the creation of a new external stage that does not reference a storage integration."

2. Snowflake Documentation: Account Parameters » REQUIRESTORAGEINTEGRATIONFORSTAGEOPERATION. This document explains, "Specifies whether to block a COPY, GET, or PUT command that accesses an external stage but does not reference a storage integration."

3. Snowflake Documentation: Account Parameters » PREVENTUNLOADTOINLINEURL. This document clarifies, "Specifies whether to block a COPY INTO command that unloads data to a presigned URL."

4. Snowflake Documentation: Administration » Security » Network & Private Connectivity » Blocking network traffic from Snowflake. Under the section "Prevent data exfiltration from stages," this page explicitly recommends setting all three parameters (REQUIRESTORAGEINTEGRATIONFORSTAGECREATION, REQUIRESTORAGEINTEGRATIONFORSTAGEOPERATION, and PREVENTUNLOADTOINLINEURL) to TRUE as a combined strategy.

Keep practicing

Take the free ADA-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test