SnowSQL supports key pair authentication and key rotation, and does not support unencrypted private keys.

• A. False
• B. Unknown
• C. True
• D. Not applicable

Answer: (C)

Key pair authentication uses a private key on the client and a corresponding public key stored in Snowflake for the user. SnowSQL supports this authentication method and also supports key rotation, which lets you replace the key pair by uploading a new public key to Snowflake and pointing SnowSQL to the new private key. Rotating keys helps keep access secure, because you can revoke an older key and adopt a new one without changing user settings.

Regarding private keys, SnowSQL requires the private key to be encrypted with a passphrase. This protects the key at rest and ensures that even if the file is exposed, it isn’t usable without the passphrase. Unencrypted private keys aren’t supported for this authentication flow, so if you have one, you would need to re-secure it with a passphrase before using key pair authentication.

So the statement aligns with SnowSQL behavior: key pair authentication and key rotation are supported, and unencrypted private keys are not.