SnowPro Advanced: Administrator free question 3 / 10 · Domain 1: Snowflake Security, RBAC, and User Administration
With a Snowflake OAuth custom client, a reporting tool opens sessions as user U8 with the ANALYST role. The administrator wants to give consent in advance so that U8 does not have to pass the consent screen for ANALYST on each authentication. Which approach matches the documentation?
- Remove ANALYST from BLOCKED_ROLES_LIST of the integration so its sessions skip the consent screen
- Add ANALYST to ALLOWED_ROLES_LIST of the integration so listed roles skip the consent screen
- Set OAUTH_CLIENT_TYPE of the integration to 'PUBLIC' so that the consent screen is skipped for its users
- A SECURITYADMIN or higher runs ALTER USER ... ADD DELEGATED AUTHORIZATION for ANALYST and the integration
Show the answer and explanation
Answer: D
Why this is correct
Security administrators (users with the SECURITYADMIN role) or higher can pre-authorize consent for a client to initiate a session for a user with a specified role and integration. The consent is granted with ALTER USER and the ADD DELEGATED AUTHORIZATION keywords, and it can be revoked later. Without this delegated authorization, the user must consent to the role after authenticating. Granting U8 a delegation for ANALYST and the integration lets the tool open ANALYST sessions without the consent screen.
Why the other options are wrong
"Remove ANALYST from BLOCKED_ROLES_LIST of the integration so its sessions skip the consent screen" … BLOCKED_ROLES_LIST lists roles that users cannot consent to use with the integration. Removing a role only makes consent possible; the consent itself still comes from the user in the flow or from a delegation by an administrator.
"Add ANALYST to ALLOWED_ROLES_LIST of the integration so listed roles skip the consent screen" … ALLOWED_ROLES_LIST defines the roles a user can consent to use with the integration, and roles outside it are implicitly refused. Listing a role makes it eligible for consent; it does not give the consent.
"Set OAUTH_CLIENT_TYPE of the integration to 'PUBLIC' so that the consent screen is skipped for its users" … OAUTH_CLIENT_TYPE says whether the client is confidential or public, which affects how the client secret is handled. It is not a consent setting, and a public client still shows the consent screen.
Key point
OAuth access tokens are short-lived; the default is 600 seconds (10 minutes). When one expires, a refresh token, if issued, obtains a new access token without asking the user to sign in again.