DAA-C01 Question 111
Single answerAnomaly DetectionA retail analytics team stores daily order counts in a Snowflake table with columns ORDER_DATE, STORE_ID, and ORDER_COUNT. They need to identify stores whose daily order volume deviates unexpectedly from normal behavior and make the results available to downstream BI tools. The team wants a solution that stays inside Snowflake, minimizes custom ML code, and can score both historical and newly arriving data. Which approach best meets these requirements?
- A
Create a forecast for each store and label any day where actual ORDER_COUNT differs from the forecast by more than a manually chosen threshold.
- B
Use Snowflake ML anomaly detection by training on historical ORDER_COUNT grouped by STORE_ID and timestamped by ORDER_DATE, then score the time series and persist the anomaly results in a table for BI consumption.
- C
Create a dynamic table that calculates z-scores over ORDER_COUNT for all stores combined, because dynamic tables automatically detect anomalies as part of refresh processing.
- D
Use a classification model in Snowflake to predict whether each row is anomalous, without needing prior labels, because anomaly detection is just a binary classification problem.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use Snowflake ML's anomaly detection capability because it is specifically intended for detecting unusual behavior in time-series data while keeping data and scoring inside Snowflake. In this scenario, ORDER_DATE serves as the timestamp, STORE_ID identifies the individual series, and ORDER_COUNT is the measured value. This aligns with Snowflake best practices for using native ML functionality where possible rather than building custom threshold logic or relying on unrelated features like dynamic tables. Forecasting can sometimes be used as a proxy for anomaly detection, but it typically requires additional business rules and threshold selection. Dynamic tables support transformation pipelines, not anomaly detection by themselves. Classification is inappropriate here unless labeled anomaly data already exists. For exam purposes, candidates should recognize when a native Snowflake ML method is a better fit than SQL-only heuristics or supervised learning approaches that depend on labels.
- A. Incorrect.
This is plausible because forecasting can help identify unusual deviations, but it is not the best answer to the stated requirement. A forecast-based workaround requires custom logic to define thresholds, handle seasonality and store-level variation, and operationalize anomaly labeling. The scenario explicitly asks to minimize custom ML code and use a purpose-built in-Snowflake approach for anomaly detection. Forecasting is related, but it is not the most direct fit when Snowflake provides anomaly detection capabilities designed for this use case.
- B. Correct.
This is correct. Snowflake ML provides anomaly detection for time-series-style data and supports training on historical observations with a timestamp column and one or more series identifiers such as STORE_ID. This fits the requirement to remain inside Snowflake, reduce custom ML implementation, and score historical as well as new data. Persisting results to a table makes them accessible to BI tools and downstream pipelines.
- C. Incorrect.
This is incorrect. Dynamic tables materialize the results of SQL transformations, but they do not perform anomaly detection automatically. A z-score approach is also a hand-built statistical rule, not a native anomaly detection workflow. In addition, calculating z-scores across all stores combined can mask store-specific behavior and seasonality, leading to poor detection quality.
- D. Incorrect.
This is incorrect. Standard classification requires labeled examples of anomalous and non-anomalous rows. In many anomaly detection scenarios, such labels are unavailable or extremely sparse. The option reflects a common misconception that unsupervised or semi-supervised anomaly detection can be replaced directly with binary classification without labeled training data.