SnowPro Advanced: Security Engineer Question 235
Single answerPerform a post-failover validation audit:A company uses Snowflake account replication and failover groups for disaster recovery. After a planned failover to the secondary account, the security engineering team must perform a post-failover validation audit before allowing analysts to resume work. The team needs to verify that security controls and access behavior in the promoted account match expectations from the primary environment. Which action provides the MOST effective audit evidence for confirming that role-based access and policy enforcement are functioning correctly after failover?
- A
Run representative validation queries while using key functional roles, and confirm that object access and masking/row access policy behavior produce the expected results in the promoted account
- B
Compare warehouse sizes and auto-suspend settings between the original primary and promoted account to ensure compute behavior is identical after failover
- C
Review only the replication status and failover completion messages, because successful promotion guarantees that all security controls are enforced correctly
- D
Recreate all grants and governance policies manually in the promoted account to eliminate any replication drift before testing access
Show answer and explanation
Correct answer: A
Explanation
The best post-failover validation audit for a Snowflake security engineer is to verify effective access behavior in the promoted account by using representative roles and testing real query outcomes. In Snowflake, disaster recovery with replication and failover groups is intended to preserve supported securable objects and related metadata, but a security audit should still confirm that users operating through expected roles can access only the intended data and that governance controls such as masking and row access policies are enforced correctly. Merely checking failover status is insufficient because it validates process completion, not security effectiveness. Likewise, warehouse settings are operational rather than security validation evidence, and manual recreation of grants or policies should not precede verification because it can create unnecessary drift. This approach aligns with Snowflake best practices around least privilege, access validation, and governance verification after failover events.
- A. Correct.
Correct. A post-failover validation audit should focus on effective access, not just object presence. Executing representative queries under the relevant roles validates that grants, role hierarchy, and replicated protections such as masking policies and row access policies are actually enforcing the intended behavior in the promoted account. This is the strongest evidence because it tests the real security outcome users will experience after failover.
- B. Incorrect.
Incorrect. Warehouse configuration can matter operationally, but it does not directly validate security posture after failover. A post-failover security audit should prioritize role-based access, privileges, and policy enforcement rather than compute sizing or suspend behavior.
- C. Incorrect.
Incorrect. Replication and failover status confirm that the failover process completed, but they do not prove that access paths behave as expected for users and roles. This option reflects the common misconception that successful failover automatically equals validated security controls. Security engineers should still test effective permissions and policy outcomes.
- D. Incorrect.
Incorrect. Manually recreating grants and policies is not the appropriate first step in a validation audit and may introduce configuration drift or unnecessary risk. In Snowflake DR designs using replication/failover groups, the correct practice is to validate the replicated state and observed access behavior, then remediate only if a discrepancy is found.