SnowPro Advanced: Security Engineer Question 223
Single answerConduct periodic audits of replication configurationsA financial services company uses Snowflake database replication between a primary account in AWS us-east-1 and a secondary account in AWS us-west-2 for disaster recovery. As part of a quarterly security audit, the Security Engineer must verify that replication is still configured only for approved databases and that no unintended failover groups or replicated objects have been introduced. The team wants an approach that relies on Snowflake metadata rather than manual worksheets. Which action provides the most effective audit evidence?
- A
Run SHOW REPLICATION ACCOUNTS in both accounts to list every replicated database, object, and failover group, then compare the output to the approved inventory.
- B
Query account usage and/or information schema metadata related to databases and replication groups, and review SHOW/DESCRIBE output for replication or failover configurations to validate the current replicated scope against the approved baseline.
- C
Review network policies and login history to confirm that only the disaster recovery team has accessed the secondary account, which proves replication is limited to approved objects.
- D
Use Time Travel on the primary databases to determine whether any unapproved databases were replicated during the quarter, because replication history is preserved there.
Show answer and explanation
Correct answer: B
Explanation
For periodic audits of replication configurations, the Security Engineer should gather evidence directly from Snowflake metadata and supported administrative commands rather than relying on spreadsheets or indirect signals. In practice, that means reviewing metadata about databases, replication groups, and failover groups, along with SHOW/DESCRIBE output for those objects, and then comparing the results with the organization's approved replication baseline. This approach aligns with Snowflake administrative best practices: use account metadata to validate the actual configured state, especially for security-sensitive features such as cross-region or cross-account replication and failover. Access-related telemetry such as login history and network policy settings is useful for complementary security review, but it does not answer the core audit question of what data is configured to replicate. Similarly, Time Travel is not a replication-configuration audit tool. Candidates should recognize that strong audit evidence comes from current authoritative metadata about replication and failover configuration.
- A. Incorrect.
Incorrect. Snowflake does not provide a single command named SHOW REPLICATION ACCOUNTS that lists every replicated database, object, and failover group in the way described. This option sounds plausible because SHOW commands are commonly used for object inspection, but it invents a capability and overstates the scope of one command. An auditor should rely on actual metadata views and supported SHOW/DESCRIBE commands for replication-related objects.
- B. Correct.
Correct. A practical audit should use Snowflake metadata and supported administrative commands to inspect the current state of replication and failover configurations. This includes reviewing metadata for databases and replication/failover groups and using SHOW or DESCRIBE commands for the relevant objects to confirm what is currently configured. Comparing that output to an approved baseline is the most defensible way to verify that only authorized databases or groups are being replicated.
- C. Incorrect.
Incorrect. Network policies and login history are valuable for access audits, but they do not prove what is configured for replication. A secondary account could contain unauthorized replicated objects even if access is tightly restricted. This option reflects the common misconception that access controls alone validate data movement configuration.
- D. Incorrect.
Incorrect. Time Travel is designed for querying historical data changes within retention limits for supported objects, not for producing authoritative audit evidence of replication configuration across accounts over a quarter. It does not replace replication metadata inspection and would not reliably show whether a database was configured for replication or included in a failover group.