SnowPro Advanced: Security Engineer Question 230
Single answerMonitor audit logs for anomalies during the transition processA company is migrating from password-based authentication to federated SSO in Snowflake. During the two-week transition, both methods are temporarily allowed for a subset of users to avoid business disruption. The security team needs to monitor for suspicious authentication activity and quickly identify users who continue to authenticate in unexpected ways after their accounts are moved to SSO. Which approach should the security engineer implement to provide the most effective audit monitoring during this transition?
- A
Query the ACCOUNT_USAGE.LOGIN_HISTORY view to compare authentication events over time, flagging users who authenticate with methods or client IP patterns that deviate from the expected transition plan
- B
Rely on QUERY_HISTORY to identify authentication anomalies because every successful login generates a query event that includes the authentication method used
- C
Monitor only failed logins in ACCOUNT_USAGE.LOGIN_HISTORY because successful logins after the SSO rollout are expected and do not indicate risk
- D
Use ACCESS_HISTORY to detect whether users authenticated with passwords or SSO, because it records the authentication mechanism for every object access event
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use ACCOUNT_USAGE.LOGIN_HISTORY for authentication monitoring during the transition from passwords to federated SSO. Snowflake's LOGIN_HISTORY views are intended for auditing login attempts and related metadata, making them the right source to detect anomalies such as unexpected continued use of legacy authentication, unusual source IP addresses, abnormal failure rates, or logins outside the expected rollout groups. In contrast, QUERY_HISTORY tracks SQL execution rather than login events, and ACCESS_HISTORY focuses on data access lineage and object usage, not authentication methods. A strong operational practice during phased authentication changes is to baseline expected login behavior by user or group, then alert on deviations using LOGIN_HISTORY and supporting views as needed. This aligns with Snowflake best practices around auditing sign-in activity through account usage views and using those audit records to support security monitoring and transition validation.
- A. Correct.
Correct. ACCOUNT_USAGE.LOGIN_HISTORY is the appropriate Snowflake audit source for monitoring login activity, including successful and failed authentication events and related metadata used to detect anomalies. During an authentication transition, comparing observed login behavior against the approved migration plan is a practical control. For example, the team can identify users still using legacy authentication unexpectedly, detect unusual client IPs, or spot spikes in failures that may indicate misconfiguration or abuse.
- B. Incorrect.
Incorrect. QUERY_HISTORY is for SQL statement execution, not authentication monitoring. A user may log in without immediately running a query, and QUERY_HISTORY does not serve as the authoritative audit source for authentication method analysis. This option reflects a common misconception that all security-relevant activity is best tracked through query logs.
- C. Incorrect.
Incorrect. Failed logins are important, but limiting monitoring to failed attempts would miss risky successful authentications, such as a user continuing to use password-based login after being moved to SSO or a successful login from an unusual network. In a transition period, successful events are often the most important signals for policy drift and unauthorized access.
- D. Incorrect.
Incorrect. ACCESS_HISTORY is designed to audit data access patterns at the object level, such as which columns or objects were accessed, and is not the primary source for login authentication details. It does not replace LOGIN_HISTORY for monitoring authentication anomalies.