SnowPro Advanced Architect

Even with IdP/SSO integration, Snowflake best practice is to retain username/password login for at least one ACCOUNTADMIN as a break-glass path in case the IdP becomes unavailable (A). In addition, not all Snowflake clients/drivers support federated authentication, so applications that cannot use SSO must connect with a username and password (B). A malfunctioning or disabled IdP (D, E) would block those users entirely rather than let them fall back to passwords, and while a user could set a separate Snowflake password (C), that is not the recommended/expected reason the exam is testing. Therefore A and B.