The correct answer is B. Restrict access to Snowflake to known networks using a network policy .
A network policy improves account access security by allowing or blocking access based on IP address ranges. This helps ensure that users can connect to Snowflake only from approved networks.
Why B is correct:
Network policies can restrict inbound access to Snowflake by defining allowed and blocked IP address ranges. This is a direct security control for user access to a Snowflake account.
Example concept:
CREATE NETWORK POLICY corp_network_policy
ALLOWED_IP_LIST = ( ' 203.0.113.0/24 ' );
ALTER ACCOUNT SET NETWORK_POLICY = corp_network_policy;
Why the other options are incorrect:
A. A UDF is not the correct tool for managing account access security. Monitoring security parameters may provide visibility, but it does not directly restrict access.
C. A short session timeout can reduce risk from idle sessions, but making it “very short” can harm usability and is not as direct as network restrictions.
D. Every user already has access to the PUBLIC role by default. Setting restrictive permissions on PUBLIC is good practice, but it is not as direct as restricting access through a network policy.
Official Snowflake documentation reference:
Snowflake documentation describes network policies as security controls that restrict access to Snowflake based on allowed and blocked IP address lists.
[Reference: Snowflake Documentation — Network policies; Snowflake Documentation — Network policy best practices; SnowPro Core Study Guide — Security and Access Control., ========================]
