QuestionQ31

Official exam objectives/topics

A Data Engineer uses a Snowpark Python User-Defined Function (UDF) that invokes a third-party fraud-scoring REST API through the requests library. The API key is not hard-coded in the handler.

The UDF is registered as a permanent function and succeeds in local testing, but it consistently encounters name-resolution and network errors when run in Snowflake. The Engineer wants to avoid placing the API key in code while keeping all processing within Snowflake.

How should these requirements be fulfilled?

  • A Deploy an external Python service that uses the Snowflake Connector for Python to read unscored transactions. Call the fraud-scoring API with requests, and write the scores back to Snowflake tables. Then schedule this process by having Snowflake tasks insert work into a control table.
  • B Store the API key in a secure internal table and have the Python UDF read the key with a SELECT statement at runtime. Then configure a network policy on the account to allow outbound HTTPS traffic so the UDF can call the fraud scoring API directly over the public internet.
  • C Rewrite the fraud-scoring logic as a Snowpark stored procedure that uses the same request code and calls the procedure from SQL when scoring is needed. Then configure stored procedures to perform outbound HTTP calls to the external API.
  • D Create an external access integration with a network rule that allows outbound HTTPS to the fraud-scoring API host. Store the API key in a SECRET, and recreate the Python UDF specifying EXTERNAL_ACCESS_INTEGRATIONS and SECRETS so the handler uses the Snowflake APIs to read the secret and call the external service.
Explanation

Snowflake UDF handlers need an external access integration to reach approved external endpoints. The integration combines an egress network rule for the API host with the permitted secret; the UDF must reference that integration and bind the secret through SECRETS, allowing handler code to retrieve the credential through Snowflake’s secret API. This provides controlled outbound HTTPS access without embedding the API key in code.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!