SnowPro Advanced: Security Engineer Question 188
Single answerAudit tagging using the TAG_REFERENCES and TAG_REFERENCES_HISTORY viewsA security engineer needs to prove whether a sensitive-data tag named PII_CLASSIFICATION was ever removed from a production table after a compliance incident was reported last week. The team also wants to know which object currently has that tag. Which approach best satisfies both requirements with the least ambiguity?
- A
Query ACCOUNT_USAGE.TAG_REFERENCES to determine both the current and historical tag assignments for the table and filter by the incident date range.
- B
Query ACCOUNT_USAGE.TAG_REFERENCES_HISTORY to investigate whether the tag assignment changed over time, and query ACCOUNT_USAGE.TAG_REFERENCES to confirm the current object-tag association.
- C
Use SHOW TAGS to determine when the tag was removed from the table, then query ACCOUNT_USAGE.TAG_REFERENCES to verify the current assignment.
- D
Query INFORMATION_SCHEMA.TAG_REFERENCES on the database that contains the table to retrieve the complete account-wide history of tag assignments and removals.
Show answer and explanation
Correct answer: B
Explanation
For security and compliance investigations, Snowflake provides separate views for current versus historical tag associations. ACCOUNT_USAGE.TAG_REFERENCES is used to inspect current tag references, while ACCOUNT_USAGE.TAG_REFERENCES_HISTORY is designed for auditing changes to tag assignments over time. In this scenario, the engineer must answer two distinct questions: whether the PII_CLASSIFICATION tag was ever removed after the reported incident, and which object currently has the tag. The most reliable approach is therefore to query TAG_REFERENCES_HISTORY for the change timeline and TAG_REFERENCES for the present state. This aligns with Snowflake best practices for separating historical audit analysis from current metadata inspection in ACCOUNT_USAGE views.
- A. Incorrect.
Incorrect. ACCOUNT_USAGE.TAG_REFERENCES is used to view current tag references, not the full historical timeline of changes. It is appropriate for identifying the current object-tag relationship, but it does not by itself provide a complete record of when a tag was added or removed over time.
- B. Correct.
Correct. ACCOUNT_USAGE.TAG_REFERENCES_HISTORY is the appropriate source for auditing historical tag associations, including changes over time such as assignments and removals. Using ACCOUNT_USAGE.TAG_REFERENCES alongside it is the clearest way to validate the current state after reviewing the historical record. This directly addresses both audit requirements: past changes and present assignment.
- C. Incorrect.
Incorrect. SHOW TAGS lists tag objects and their definitions, but it is not the right mechanism to determine when a specific tag reference was removed from a specific object. That is a common confusion between tag metadata and tag-object association history.
- D. Incorrect.
Incorrect. INFORMATION_SCHEMA.TAG_REFERENCES is useful for retrieving tag references in a scoped context, but it is not the authoritative source for complete account-wide historical auditing of tag assignment changes. For historical tracking, the ACCOUNT_USAGE TAG_REFERENCES_HISTORY view is the better fit.