SnowPro Advanced: Security Engineer Question 243
Single answerDomain 3.0: Auditing, Monitoring, and Compliance (18%)A financial services company uses Snowflake Enterprise Edition and must demonstrate to auditors that privileged role changes and user login activity are being retained for long-term compliance analysis. The security team also wants to reduce the risk that historical audit records could be altered or lost due to retention limits in built-in views. Which approach best meets these requirements?
- A
Query ACCOUNT_USAGE.USERS and ACCOUNT_USAGE.ROLES only when auditors request evidence, because Snowflake stores account metadata permanently.
- B
Create a scheduled process that copies data from relevant ACCOUNT_USAGE views such as LOGIN_HISTORY and GRANTS_TO_USERS into dedicated audit tables for long-term retention and reporting.
- C
Rely on INFORMATION_SCHEMA table functions for compliance retention, because they provide the longest historical window for login and grant activity.
- D
Enable Tri-Secret Secure so that Snowflake automatically extends audit history retention for access and role changes.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to persist required audit data into customer-managed storage on a schedule. In Snowflake, built-in metadata sources such as SNOWFLAKE.ACCOUNT_USAGE views and certain INFORMATION_SCHEMA functions are essential for monitoring and auditing, but they have defined retention periods and may have latency before records appear. For regulated environments, organizations should not depend on these sources alone as a permanent evidence repository. Instead, they should implement a repeatable process to collect and store required audit records, such as LOGIN_HISTORY and grant-related ACCOUNT_USAGE views, in dedicated audit tables or an external archival platform. This aligns with Snowflake best practices for compliance reporting and long-term auditability.
- A. Incorrect.
Incorrect. ACCOUNT_USAGE provides valuable audit and metadata history, but it is not retained permanently for all objects and event types, and different views have specific retention periods and latency characteristics. Waiting until an audit request arrives risks losing older records that are no longer available in the source views. This is a common misconception because ACCOUNT_USAGE is often treated like a permanent audit archive, but it is not designed to replace customer-managed long-term retention.
- B. Correct.
Correct. For long-term compliance, a best practice is to regularly extract or copy relevant audit data from Snowflake-provided metadata sources, such as ACCOUNT_USAGE views and applicable table functions, into customer-controlled tables or downstream archival systems. This approach preserves evidence beyond built-in retention windows and supports reporting on events such as login activity and privilege or role-related changes. In practice, teams often use tasks, stored procedures, or external orchestration to persist this data on a schedule.
- C. Incorrect.
Incorrect. INFORMATION_SCHEMA functions and views are useful for operational visibility, but they generally do not provide the longest retention window and are not intended as a long-term compliance archive. They are often more limited in scope or history than ACCOUNT_USAGE for auditing use cases. Choosing INFORMATION_SCHEMA for retention is a misunderstanding of its purpose.
- D. Incorrect.
Incorrect. Tri-Secret Secure is related to key management and encryption control, not audit history retention. It can strengthen encryption governance requirements, but it does not extend the retention period of login history, grants history, or other audit metadata. This distractor reflects a confusion between encryption/compliance controls and monitoring/audit data retention.