SnowPro Advanced: Security Engineer exam dumps: questions 301 to 400 of 431

Correct answer: A

• A. Correct.

  Correct. This is the most accurate and practical statement. Snowflake does maintain recognized third-party certifications and attestations, including examples such as SOC reports and ISO certifications, which can help customers with vendor assessments. However, these do not transfer full compliance responsibility to the customer automatically. Under the shared responsibility model, customers remain accountable for how they configure access controls, govern data, manage keys where applicable, and use Snowflake features in support of their own legal and regulatory obligations.

• B. Incorrect.

  Incorrect. This reflects a common misconception that a cloud provider’s certifications automatically make every customer deployment compliant. Snowflake certifications and attestations demonstrate controls at the service-provider level, but customer compliance depends on the customer’s own implementation, governance, data classification, user access, monitoring, retention, and contractual/regulatory scope. Regulations such as GDPR are not achieved through certification inheritance alone.

• C. Incorrect.

  Incorrect. Snowflake does provide externally validated security and compliance materials, including third-party attestations and certifications. Saying that customers can rely only on internal whitepapers is inaccurate and would underrepresent the assurance artifacts Snowflake makes available for due diligence and audit support.

• D. Incorrect.

  Incorrect. This option incorrectly minimizes the relevance of Snowflake’s certifications. Security certifications and attestations are specifically important to customers because they help demonstrate the control environment surrounding the Snowflake service. While not a substitute for customer controls, they are highly relevant to environments where customer data is processed and stored.

Correct answer: A

• A. Correct.

  Correct. Snowflake provides customer-accessible compliance documentation through its Trust Center and related compliance report access process. This is the supported way to obtain formal third-party assessment materials such as SOC reports and information about certifications. For a vendor review, this is the appropriate source because it provides official Snowflake-issued or Snowflake-authorized compliance documentation rather than internally generated evidence.

• B. Incorrect.

  Incorrect. ACCOUNT_USAGE views expose metadata about activity in the customer's Snowflake environment, such as login, query, access, and governance-related information. They do not contain Snowflake's independent third-party compliance assessment reports like SOC attestations or ISO certification packages. This option reflects a common misconception that internal account telemetry can substitute for vendor compliance evidence.

• C. Incorrect.

  Incorrect. Snowsight dashboards can help analyze security posture and user activity within the customer's account, but they do not provide Snowflake corporate compliance artifacts such as SOC reports or certification letters. Access History is useful for auditing data access, not for proving that Snowflake as a service has passed external assessments.

• D. Incorrect.

  Incorrect. Although Snowflake runs on public cloud infrastructure, Snowflake maintains its own compliance program and provides its own service-level compliance documentation. Cloud provider reports do not replace Snowflake's reports because the reviewer is assessing Snowflake's controls and attestations, not just the infrastructure provider's controls.

Correct answer: A

• A. Correct.

  Correct. Snowflake publishes compliance documentation, certifications, and related security assurance materials through its Trust Center. When an auditor requests Snowflake-issued compliance evidence, the right approach is to obtain the official reports and certifications from Snowflake's published compliance resources rather than creating internal reports from account metadata.

• B. Incorrect.

  Incorrect. ACCOUNT_USAGE views are useful for internal governance, monitoring, and evidence gathering about how a specific Snowflake account is configured or used. However, they do not replace Snowflake-issued third-party compliance reports such as SOC reports or certifications. This option reflects the common misconception that account telemetry is equivalent to vendor compliance attestation.

• C. Incorrect.

  Incorrect. Snowflake does not provide custom, one-off compliance attestation documents for each customer's account in the way this option suggests. Official compliance materials are made available through Snowflake's established compliance reporting channels. A support case may help with access questions, but it is not the primary mechanism for obtaining official compliance reports.

• D. Incorrect.

  Incorrect. Login history and network policy exports can support an internal audit or security review of the customer's Snowflake environment, but they are not official Snowflake compliance reports. This distractor targets the misconception that operational security data from a tenant account can serve as vendor-level certification evidence.

Correct answer: A

• A. Correct.

  Correct. Disabling the user is the best first response because it immediately prevents further authentication while preserving the account, metadata, and historical evidence needed for forensics. After containment, reviewing QUERY_HISTORY and ACCESS_HISTORY is appropriate to determine what statements were run and what data objects were accessed. This aligns with incident response best practice in Snowflake: contain first, preserve evidence, then investigate using account usage and organization/account-level history views where available.

• B. Incorrect.

  Incorrect. Dropping the user is too destructive as an initial response because it can complicate investigation and disrupt evidence preservation or attribution workflows. Also, LOGIN_HISTORY alone is insufficient to determine whether sensitive tables were queried; it shows authentication events, not full object access details. Investigators typically need QUERY_HISTORY and ACCESS_HISTORY for deeper analysis.

• C. Incorrect.

  Incorrect. Revoking role grants may reduce future privilege use, but it is not the best first step for containment. It also does not guarantee that active sessions are terminated automatically in the way many candidates assume. The core misconception is treating privilege revocation as equivalent to account containment. Disabling the user is more direct and reliable for stopping additional logins while preserving the principal for investigation.

• D. Incorrect.

  Incorrect. Rotating the password is weaker than disabling the account during an active incident. It may prevent future logins if the attacker only knows the old password, but it does not address the need for immediate containment as clearly as disabling the user. Waiting for failed logins is also not an appropriate first response when suspicious access to regulated data may already have occurred.

Correct answers: A, B

• A. Correct.

  Correct. QUERY_HISTORY is one of the primary forensic sources for incident investigation in Snowflake. It captures executed SQL text, execution status, session details, timing, and other metadata. In this scenario, it helps identify whether the user ran sensitive SELECT statements or COPY INTO commands that could indicate unloading data to a stage or cloud storage. This is a first-stop source for reconstructing user activity.

• B. Correct.

  Correct. ACCESS_HISTORY is designed to show which data objects were accessed by queries, including base objects and, where applicable, column-level lineage and access details. For a suspected exfiltration event, this is essential for determining exactly which sensitive tables or columns were touched by the suspicious queries identified in QUERY_HISTORY.

• C. Incorrect.

  Incorrect. SHOW USERS provides metadata about users, such as names and properties, but it does not provide forensic evidence about worksheet result downloads or user query result handling. Investigators might choose this if they are thinking about user attribution, but it is not an appropriate first source for determining data access or exfiltration actions.

• D. Incorrect.

  Incorrect. WAREHOUSE_METERING_HISTORY is used for warehouse credit consumption and metering analysis, not for query result contents or row-level forensic evidence. It can help with cost or activity correlation at a high level, but it cannot confirm which rows were returned or what data was accessed or exported.

• E. Incorrect.

  Incorrect. COPY_HISTORY is useful for investigating data loading activity, especially COPY INTO

  operations. However, it is not the primary source for identifying all unload behavior in this scenario. For unload investigations, QUERY_HISTORY is more reliable as a first source because it captures the actual SQL statements, including COPY INTO . A candidate might select this option because of the word 'COPY', but COPY_HISTORY is commonly associated with load history rather than comprehensive unload forensics.