Configure Authentication Including SSO, MFA, OAuth, and Key Pair SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 4)

Questions 16–17

1. 16application · medium

   An organization has an authentication policy that requires MFA for all users. They want to allow a specific group of users to use SSO without MFA, because their identity provider does not support MFA. What should they do?

   • ACreate a new role and assign the authentication policy to that role.
   • BCreate a new authentication policy that allows SSO without MFA and attach it to the specific users.
   • CDisable MFA enforcement at the account level and rely on the identity provider for MFA.
   • DModify the existing authentication policy to allow SSO without MFA for all users.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is implementing SSO for Snowflake using their corporate SAML 2.0 identity provider. They want to enforce MFA for all Snowflake users, but the identity provider does not support MFA. What should they do to meet the MFA requirement?

   • AKeep SAML SSO for most users, but create a separate authentication policy that requires MFA for users who log in with username/password.
   • BEnable MFA enforcement in the authentication policy and configure the identity provider to pass a SAML attribute indicating MFA was performed.
   • CConfigure Snowflake to require MFA in the authentication policy, and set the SAML SSO to use the 'snowflake' login flow.
   • DUse a different identity provider that supports MFA, or configure Snowflake to use a non-SSO authentication method (e.g., username/password with MFA) for those users.
   Reveal Solution Discussion Select an answer first