SnowPro Advanced: Security Engineer Question 209
Single answerManage replication protocols and policies:A global company uses Snowflake Business Critical Edition and has a primary account in AWS us-east-1 and a secondary account in AWS eu-west-1 for disaster recovery. The security team needs failover-ready copies of a production database that contains masking policies, row access policies, tags, and a secure view. During a quarterly DR test, they discover that the database data replicated successfully, but some governance objects were not available in the secondary account as expected. The team wants to redesign the replication approach so that governance controls needed by the replicated database are available after failover, while minimizing operational overhead. Which action should the security engineer take?
- A
Create a failover group that includes the production database and the account-level objects required by the database, then replicate and fail over using the failover group.
- B
Enable replication only on the production database and use Time Travel in the secondary account to restore missing masking policies and row access policies after failover.
- C
Share the production database to the secondary account and convert the share into a replicated database during failover so that all policy objects are inherited automatically.
- D
Configure replication for the database and recreate the missing governance objects manually in the secondary account after each refresh, because policy objects cannot be included in cross-region replication.
Show answer and explanation
Correct answer: A
Explanation
For DR scenarios that require a secondary account to assume production duties, replicating only the database may be insufficient when the workload depends on additional supported account-level objects and governance controls. Snowflake's failover groups are intended for business continuity and disaster recovery by allowing administrators to group and replicate eligible objects together across regions/clouds, then perform failover in a controlled manner. This is especially important for security-sensitive workloads using features such as masking policies, row access policies, tags, and secure objects. A common misconception is that database replication alone captures every dependency, or that Time Travel or data sharing can substitute for failover design. In practice, security engineers should identify object dependencies and use failover groups to replicate the required set of supported objects together, consistent with Snowflake documentation on replication and failover, object dependencies, and failover groups.
- A. Correct.
Correct. In Snowflake, failover groups are designed to replicate and fail over a defined set of objects across accounts/regions, including databases and supported account-level objects that are required for a functional failover posture. This is the appropriate approach when a replicated database depends on governance and security-related objects beyond just table data. Using a failover group reduces manual steps and is the recommended DR design for business continuity across regions.
- B. Incorrect.
Incorrect. Time Travel is used to access historical data states within a retention period in the same account context; it is not a mechanism to recreate missing governance objects in a secondary account after cross-region failover. Also, if the needed policy-related dependencies were not replicated, Time Travel in the target account would not solve that gap.
- C. Incorrect.
Incorrect. Secure data sharing and database replication/failover are different features. A shared database does not become a replicated failover-ready database by 'conversion' during failover, and shares do not automatically provide the secondary account with independent replicated governance objects required for DR operations.
- D. Incorrect.
Incorrect. The premise is wrong: supported governance/security dependencies can be included through the proper replication construct. Manually recreating policies after each refresh increases operational risk and undermines DR objectives. Snowflake provides failover groups specifically to reduce this type of manual dependency management.