COF-C02 · Question #166
Which of the following practices are recommended when creating a user in Snowflake? (Choose two.)
The correct answer is B. Force an immediate password change. C. Set a default role for the user. When creating Snowflake users, security best practices require forcing a password reset on first login and assigning a default role to define the user's initial access context.
Question
Which of the following practices are recommended when creating a user in Snowflake? (Choose two.)
Options
- AConfigure the user to be initially disabled.
- BForce an immediate password change.
- CSet a default role for the user.
- DSet the number of minutes to unlock to 15 minutes.
- ESet the user's access to expire within a specified timeframe.
How the community answered
(34 responses)- A6% (2)
- B88% (30)
- D3% (1)
- E3% (1)
Why each option
When creating Snowflake users, security best practices require forcing a password reset on first login and assigning a default role to define the user's initial access context.
Creating a user in a disabled state prevents any login and is not a recommended provisioning pattern - users should be created active with a temporary password and forced reset instead.
Forcing an immediate password change ensures the temporary admin-assigned credential is replaced by the user's own secret on first login, preventing unauthorized access if the initial password is intercepted. This is a standard identity security control recommended in Snowflake's user provisioning guidance.
Setting a default role ensures the user has a well-defined active role upon login, providing predictable and appropriate object-level permissions without requiring the user to manually switch roles each session.
The MINS_TO_UNLOCK parameter controls how long an account stays locked after failed login attempts; it is a lockout recovery setting, not a recommended user creation configuration.
Setting an expiry date via DAYS_TO_EXPIRY is an optional control for contractors or temporary accounts, not a universally recommended practice applied to all new user creation.
Concept tested: Snowflake user creation security best practices
Source: https://docs.snowflake.com/en/sql-reference/sql/create-user
Topics
Community Discussion
No community discussion yet for this question.