SnowPro Advanced: Security Engineer Question 161
Single answerImplement Time Travel and Fail-safe for data recovery:A security engineer is investigating an incident in which a privileged user accidentally executed a DROP TABLE command against a sensitive table in a permanent schema 12 hours ago. The organization must restore the data as quickly as possible while preserving auditability. The account uses the Standard edition of Snowflake, and no data retention parameters were customized at the object, schema, or database level. Which action should the engineer take to recover the table?
- A
Use UNDROP TABLE to restore the dropped permanent table, because it is still within the Time Travel retention period.
- B
Open a Snowflake Support case to retrieve the table from Fail-safe, because dropped tables cannot be restored directly by customers.
- C
Use CLONE ... AT (TIMESTAMP => ...) to recover the table, because dropped tables can only be recovered by cloning from historical metadata.
- D
Recreate the table manually from query history, because Standard edition does not support Time Travel for permanent tables.
Show answer and explanation
Correct answer: A
Explanation
Snowflake provides Time Travel for recovering data changed or deleted within the configured retention period, and Fail-safe as a separate Snowflake-managed recovery window after Time Travel ends. For permanent tables in Standard edition, the default Time Travel retention is 1 day. Because the table was dropped 12 hours ago, it is still recoverable through Time Travel, and UNDROP TABLE is the correct recovery method. Fail-safe is not a customer-operated feature for routine recovery and should not be used when Time Travel is still available. This aligns with Snowflake documentation on Time Travel, UNDROP, and Fail-safe behavior for permanent database objects.
- A. Correct.
Correct. In Snowflake Standard edition, permanent objects have a default Time Travel retention period of 1 day unless changed where permitted. Since the table was dropped 12 hours ago, it remains within the Time Travel window. UNDROP TABLE is the most direct and operationally appropriate way to recover a dropped table while maintaining object continuity and auditability. This is the standard recovery action for accidental drops that are still within retention.
- B. Incorrect.
Incorrect. Fail-safe is not intended for self-service operational recovery and is only available after the Time Travel period has expired. It is a Snowflake-managed disaster recovery mechanism, typically requiring Snowflake involvement, but it is not the first step when the object is still within Time Travel. Because the drop happened only 12 hours ago, the engineer should use Time Travel-based recovery instead.
- C. Incorrect.
Incorrect. Historical cloning can be used for some recovery scenarios, but UNDROP TABLE is the correct and simpler action for a dropped table that still exists in Time Travel metadata. The statement that dropped tables can only be recovered by cloning is false. A candidate might choose this if they know cloning supports point-in-time access, but for an accidental DROP within retention, UNDROP is the more appropriate feature.
- D. Incorrect.
Incorrect. Standard edition does support Time Travel for permanent tables, with a default retention of 1 day. Manual reconstruction from query history would be unnecessary, slower, more error-prone, and less complete than native recovery. This option reflects a misconception that advanced recovery requires higher editions in all cases.