ADA-C01 Question 374
Select 2Use log data to monitor user activity, threat detection, and access controlA security team needs to investigate whether a contractor account was used to access sensitive data outside approved hours and from unexpected client applications. The Snowflake administrator wants a solution that supports ongoing monitoring for suspicious activity and can also help validate whether role changes may have enabled the access. Which TWO actions should the administrator take to best meet these requirements?
- A
Query ACCOUNT_USAGE views such as LOGIN_HISTORY, QUERY_HISTORY, and GRANTS_TO_USERS to correlate login events, executed statements, and role grants over time.
- B
Use ACCESS_HISTORY to identify which objects were accessed by the contractor account and correlate that with query activity for sensitive tables.
- C
Rely on WAREHOUSE_LOAD_HISTORY to determine whether the contractor accessed sensitive data, because warehouse utilization directly identifies the user and objects involved.
- D
Review TASK_HISTORY to detect all interactive user logins and client application details, because task metadata captures session-level access behavior.
- E
Enable and review the event table as the primary source for historical user login and object access auditing, because it replaces ACCOUNT_USAGE security monitoring views.
Show answer and explanation
Correct answers: A, B
Explanation
For monitoring user activity, threat detection, and access control, Snowflake administrators commonly use SNOWFLAKE.ACCOUNT_USAGE views and, where available for lineage-style auditing, ACCESS_HISTORY. LOGIN_HISTORY helps identify sign-in patterns, including timing and connection context. QUERY_HISTORY shows executed SQL and can be correlated with the user and session. GRANTS_TO_USERS helps determine whether privilege or role changes contributed to the access. ACCESS_HISTORY is especially valuable when the goal is to verify which sensitive objects were actually queried. By contrast, WAREHOUSE_LOAD_HISTORY and TASK_HISTORY are operational monitoring views, not primary security audit sources. This aligns with Snowflake best practices for auditing and investigation using ACCOUNT_USAGE views and access history data.
- A. Correct.
Correct. ACCOUNT_USAGE views are a core source for administrative monitoring and forensic analysis. LOGIN_HISTORY can show authentication events and client connection details, QUERY_HISTORY helps identify when statements were executed and by whom, and GRANTS_TO_USERS helps determine whether role or privilege changes may have enabled access. Together, these views support timeline-based investigation of user activity and access control changes.
- B. Correct.
Correct. ACCESS_HISTORY is designed to help determine what data objects were accessed by queries, including underlying base objects in many cases. For an investigation into possible sensitive data access, it is one of the best sources for confirming which tables or views were actually touched by the user's activity.
- C. Incorrect.
Incorrect. WAREHOUSE_LOAD_HISTORY is useful for monitoring warehouse usage and load characteristics, not for determining which specific user accessed which sensitive objects. A candidate might choose this because it is a log-style history view, but it does not provide the object-level user access evidence needed for threat detection or audit analysis.
- D. Incorrect.
Incorrect. TASK_HISTORY is for monitoring execution of Snowflake tasks, not interactive user sessions, login attempts, or client application behavior. It would not help determine whether a contractor logged in after hours from an unexpected tool.
- E. Incorrect.
Incorrect. Event tables in Snowflake are associated with observability data collection for telemetry-style events, not a replacement for ACCOUNT_USAGE security/audit history views for login and object-access investigation. A candidate might select this if they confuse observability event ingestion with built-in account usage auditing.