SnowPro Advanced: Security Engineer Question 189
Single answerAudit tagging using the TAG_REFERENCES and TAG_REFERENCES_HISTORY viewsA security engineer needs to prove to auditors that a governance tag named SENSITIVITY has been consistently applied to production data assets and to identify any objects from which the tag was removed during the last 90 days. The engineer wants a solution that distinguishes the current tag state from historical changes. Which approach best meets this requirement?
- A
Query ACCOUNT_USAGE.TAG_REFERENCES to list objects currently associated with the SENSITIVITY tag, and query ACCOUNT_USAGE.TAG_REFERENCES_HISTORY to identify past tag associations and removals within the last 90 days.
- B
Query INFORMATION_SCHEMA.TAG_REFERENCES once per database because it returns both current and historical tag assignments for all objects in the account.
- C
Query ACCOUNT_USAGE.OBJECT_DEPENDENCIES because tag inheritance and tag removals are recorded there for governance auditing.
- D
Query ACCOUNT_USAGE.TAGS to find all objects that currently and previously referenced the SENSITIVITY tag, because the TAGS view stores assignment history.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use both ACCOUNT_USAGE.TAG_REFERENCES and ACCOUNT_USAGE.TAG_REFERENCES_HISTORY. In Snowflake, TAG_REFERENCES is appropriate for determining the current assignment of a tag to objects, while TAG_REFERENCES_HISTORY supports audit and change analysis over time, including detecting when associations existed previously and were later removed. This is the practical pattern for compliance investigations: use the current-state view for present evidence and the history view for change tracking over the audit window. By contrast, INFORMATION_SCHEMA.TAG_REFERENCES is useful for metadata inspection but is not the primary account-level historical audit source, OBJECT_DEPENDENCIES is for lineage/dependency analysis rather than tag auditing, and TAGS describes tag definitions rather than assignment history. This aligns with Snowflake documentation on tag metadata and Account Usage views for governance and auditing.
- A. Correct.
Correct. ACCOUNT_USAGE.TAG_REFERENCES is used to report current tag associations on supported objects, which is appropriate for proving the present tagging state. ACCOUNT_USAGE.TAG_REFERENCES_HISTORY is designed for historical auditing of tag associations over time, allowing the engineer to identify changes such as tag removals during a defined period like the last 90 days. This combination matches the requirement to separate current state from historical change tracking.
- B. Incorrect.
Incorrect. INFORMATION_SCHEMA.TAG_REFERENCES is a table function used to inspect tag references, but it does not provide account-wide historical tracking of tag assignments and removals. It is not the best choice when auditors require evidence of both current state and historical changes across production assets over time. A common misconception is assuming INFORMATION_SCHEMA and ACCOUNT_USAGE provide equivalent audit history; they do not.
- C. Incorrect.
Incorrect. OBJECT_DEPENDENCIES is intended for object dependency lineage, such as how one object depends on another. It is not the audit source for tag assignment history or removals. Someone might choose this option because inherited tags can feel similar to dependency relationships, but Snowflake tracks tag references through dedicated tag metadata views instead.
- D. Incorrect.
Incorrect. ACCOUNT_USAGE.TAGS contains metadata about tags themselves, such as tag definitions, but not the full set of current and historical object-to-tag assignments. The misconception here is confusing tag metadata with tag reference metadata. To audit which objects were tagged and when assignments changed, the TAG_REFERENCES and TAG_REFERENCES_HISTORY views are the relevant sources.