SnowPro Advanced: Security Engineer Question 242
Single answerDomain 3.0: Auditing, Monitoring, and Compliance (18%)A financial services company uses Snowflake Enterprise Edition and must prove to internal auditors that all changes to role grants and user privilege assignments can be reviewed for the past 12 months. The security team also wants to minimize operational overhead and avoid building custom log capture processes unless necessary. Which approach should the Security Engineer recommend?
- A
Query the ACCOUNT_USAGE.GRANTS_TO_USERS and ACCOUNT_USAGE.GRANTS_TO_ROLES views, because these views provide historical grant data that can be used for long-term audit reporting.
- B
Rely on the ACCESS_HISTORY view, because it records all role grant and privilege grant changes together with the SQL statements that caused them.
- C
Use SHOW GRANTS commands on a scheduled basis and persist the results externally, because Snowflake does not provide historical metadata views for grant changes.
- D
Use the LOGIN_HISTORY view together with QUERY_HISTORY to infer which users received grants based on successful object access over time.
Show answer and explanation
Correct answer: A
Explanation
For auditing, monitoring, and compliance requirements in Snowflake, ACCOUNT_USAGE is the preferred source for many historical metadata and security reporting needs. In this scenario, the organization needs evidence of changes to role grants and privilege assignments over the past 12 months with low operational overhead. The ACCOUNT_USAGE grant-related views are the best fit because they provide historical records of grants to users and roles without requiring the team to build custom snapshot processes.
This is more appropriate than ACCESS_HISTORY, which focuses on data access patterns rather than administrative grant state, and more reliable than inferring changes from LOGIN_HISTORY or QUERY_HISTORY. Snowflake documentation for SNOWFLAKE.ACCOUNT_USAGE describes these views as the standard source for historical account metadata, including grant relationships used in security audits and compliance reporting. Best practice is to use these built-in account usage views for periodic audit reports rather than reconstructing grant history indirectly or maintaining unnecessary external capture jobs.
- A. Correct.
Correct. ACCOUNT_USAGE includes grant-related views such as GRANTS_TO_USERS and GRANTS_TO_ROLES that provide historical metadata about grants, making them appropriate for auditing role assignments and privilege relationships over time. This aligns with the requirement to review grant changes over an extended period without building custom capture logic. These views are specifically intended for account-level auditing and reporting use cases.
- B. Incorrect.
Incorrect. ACCESS_HISTORY is designed to analyze data access lineage and object access, such as which columns were accessed by a query. It is not the primary source for auditing role grants or privilege assignment history. A common misconception is to treat ACCESS_HISTORY as a complete audit log for all security administration activity, but grant metadata is better obtained from the relevant ACCOUNT_USAGE views.
- C. Incorrect.
Incorrect. While scheduled SHOW GRANTS snapshots could work as a custom workaround, the scenario explicitly asks to minimize operational overhead and avoid custom log capture unless necessary. Snowflake already provides historical account usage views for grant auditing, so building an external persistence process is unnecessary in this case.
- D. Incorrect.
Incorrect. LOGIN_HISTORY records authentication events, and QUERY_HISTORY records executed SQL statements, but using them to infer grants is indirect, incomplete, and unreliable. Access behavior does not prove when a privilege was granted or revoked, and this method would not satisfy auditors looking for direct evidence of grant changes.