SnowPro Advanced: Security Engineer Question 234
Single answerPerform a post-failover validation audit:A Snowflake security engineer is validating a business-critical account immediately after a cross-region account failover. Before the event, the team documented that all production access must continue through the same role hierarchy, row access policies must still protect sensitive customer data, and no unexpected grants should appear on replicated objects. Which action is the BEST post-failover validation audit to confirm that the security model is intact?
- A
Run SHOW GRANTS TO ROLE and SHOW GRANTS ON relevant databases, schemas, and tables in the promoted account, then compare the results to the documented baseline for role inheritance and object privileges, including policy-protected objects.
- B
Re-create all custom roles and reapply grants manually in the promoted account, because role grants are not included in failover and must be restored after promotion.
- C
Query ACCOUNT_USAGE.LOGIN_HISTORY to verify that users can authenticate, which confirms that all authorization grants and data protection policies were replicated correctly.
- D
Rotate all key-pair and password credentials for every user in the promoted account, because credential rotation is required to activate replicated security objects after failover.
Show answer and explanation
Correct answer: A
Explanation
After account failover, a security-focused validation audit should confirm that the promoted account preserves the intended authorization state and data protection controls. The most direct approach is to inspect grants and compare them with a known baseline. In practice, this means validating role hierarchy with commands such as SHOW GRANTS TO ROLE, checking object privileges with SHOW GRANTS ON
- A. Correct.
Correct. A post-failover validation audit should directly verify the effective authorization model in the promoted account. Reviewing grants to roles and grants on objects is the most appropriate way to confirm that role hierarchy and object privileges match the expected state. Because the scenario also mentions row access policies and protected data, the audit should include the affected objects and policy assignments as part of the comparison against a pre-failover baseline. This is aligned with practical failover validation: verify replicated security metadata and confirm no unexpected privilege drift occurred.
- B. Incorrect.
Incorrect. This reflects a common misconception. In Snowflake replication and failover scenarios, supported metadata such as many database objects and their grants can be replicated depending on the replication/failover configuration. A security engineer should not immediately re-create roles and regrant privileges as a first audit step. Doing so could introduce configuration drift and mask whether replication preserved the original security posture.
- C. Incorrect.
Incorrect. LOGIN_HISTORY helps validate authentication activity, but successful authentication does not prove that authorization is correct. A user may be able to log in while still missing required object privileges, inheriting incorrect roles, or being subject to incorrect policy behavior. This option checks only part of the security picture and does not satisfy the requirement to audit role hierarchy, grants, and protected objects after failover.
- D. Incorrect.
Incorrect. Credential rotation may be part of broader operational security practices, but it is not required to activate replicated security metadata after failover. Rotating every credential would also not verify whether role grants, inherited privileges, or row access policies were preserved correctly. This option confuses credential hygiene with failover validation.