SnowPro Advanced: Security Engineer Question 231
Single answerMonitor audit logs for anomalies during the transition processA security engineer is leading a staged migration from password-based authentication to federated SSO with MFA in Snowflake. During the transition, some users will temporarily keep both login methods so the team can roll back if needed. The engineer must monitor for suspicious activity that could indicate abuse of legacy access while minimizing operational overhead. Which approach best helps detect anomalies during the transition?
- A
Query the ACCOUNT_USAGE.LOGIN_HISTORY view for users who authenticate with unexpected client IPs, applications, or login methods during the transition window, and compare activity to an approved migration baseline.
- B
Rely on QUERY_HISTORY to identify compromised logins because every successful authentication attempt generates a corresponding SQL statement with the session authentication details.
- C
Disable access to ACCOUNT_USAGE views until the migration is complete so administrators do not misinterpret temporary dual-authentication activity as a security issue.
- D
Monitor only failed login attempts in LOGIN_HISTORY, because successful logins during a transition are expected and do not indicate meaningful risk.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY to monitor authentication activity during the migration and compare observed behavior against an approved transition baseline. In a phased move to SSO/MFA, some overlap between old and new methods may be temporarily allowed, so the goal is not to flag every legacy login, but to identify anomalous ones such as unexpected IP addresses, unusual client applications, odd timing, or continued use of the old method after a user should have been cut over. This aligns with Snowflake auditing best practices: use login-specific audit data for authentication monitoring, and correlate events with change windows and expected identity-state transitions. QUERY_HISTORY is valuable for post-login activity analysis, but it is not a substitute for authentication auditing. Relevant Snowflake documentation includes ACCOUNT_USAGE views, especially LOGIN_HISTORY, and general guidance on access history and security monitoring.
- A. Correct.
Correct. LOGIN_HISTORY in SNOWFLAKE.ACCOUNT_USAGE is the appropriate audit source for monitoring authentication events in Snowflake. During a transition from passwords to federated SSO, reviewing fields such as user, client IP, reported client/application, authentication method indicators, and timing allows the security engineer to detect unusual behavior such as a user continuing to use legacy credentials from an unfamiliar IP range after being moved to SSO. Comparing events to a known migration plan or baseline is a practical best practice because some dual-authentication activity is temporarily expected, but out-of-pattern usage can indicate abuse or a rollback issue.
- B. Incorrect.
Incorrect. QUERY_HISTORY tracks executed SQL statements, not all authentication attempts. A user can authenticate and establish a session without producing a query immediately, and failed logins would not appear there. This option reflects a common misconception that query auditing is sufficient for access monitoring. For login anomaly detection, LOGIN_HISTORY is the relevant audit dataset.
- C. Incorrect.
Incorrect. Restricting access to audit views during a sensitive authentication transition reduces visibility when it is most needed. Temporary dual-authentication patterns should be handled with baselines, filters, and alerting logic rather than by suppressing audit access. Security best practice is to increase monitoring during identity changes, not decrease it.
- D. Incorrect.
Incorrect. Failed logins are useful, but successful logins also matter because compromised credentials or legacy access abuse often appear as successful authentications from unusual networks, clients, or methods. Looking only at failures would miss one of the main risks of a phased migration: legitimate-looking but anomalous successful access via the old mechanism.