SnowPro Advanced: Security Engineer Question 244
Single answer3.1 Monitor data security.A financial services company stores sensitive customer data in Snowflake and must regularly verify whether access controls are being used as intended. The security team wants to identify which roles have actually queried a specific table containing PII during the last 30 days, including queries executed through role inheritance, so they can compare effective usage against granted privileges. Which approach should the security engineer use?
- A
Query ACCOUNT_USAGE.ACCESS_HISTORY for the target table and analyze the role_name associated with the queries that referenced that object.
- B
Run SHOW GRANTS ON TABLE for the target table and use the returned roles list to determine which roles accessed the data in the last 30 days.
- C
Query ACCOUNT_USAGE.GRANTS_TO_ROLES and filter for the target table to identify the roles that queried the table through inherited privileges.
- D
Review ACCOUNT_USAGE.LOGIN_HISTORY and map users' login events to their default roles to determine which roles accessed the table.
Show answer and explanation
Correct answer: A
Explanation
To monitor data security effectively, Snowflake security engineers need to distinguish between granted access and actual data usage. For a use case focused on identifying which roles really queried a sensitive table, ACCOUNT_USAGE.ACCESS_HISTORY is the most appropriate source because it provides object-level access details tied to executed queries. This helps validate whether PII is being accessed only through expected roles and supports least-privilege reviews. In contrast, SHOW GRANTS and ACCOUNT_USAGE.GRANTS_TO_ROLES help analyze permissions and inheritance, but not actual usage. LOGIN_HISTORY is valuable for authentication monitoring, but it does not provide evidence of table access. This aligns with Snowflake best practices for auditing and monitoring sensitive data access using access history and account usage views.
- A. Correct.
Correct. ACCESS_HISTORY is designed for monitoring object-level data access and can be used to determine which queries referenced a specific table. By analyzing access records for the target object and the role used to execute each query, the security team can identify actual usage rather than just granted permissions. This is the most appropriate source for validating whether sensitive data is being accessed as expected.
- B. Incorrect.
Incorrect. SHOW GRANTS ON TABLE shows which privileges have been granted on the table, but it does not indicate whether those privileges were actually used in the last 30 days. It is useful for entitlement review, not activity monitoring.
- C. Incorrect.
Incorrect. GRANTS_TO_ROLES provides metadata about privileges granted to roles, including inherited access paths, but it does not show query execution or actual table access. This option confuses effective privilege analysis with access monitoring.
- D. Incorrect.
Incorrect. LOGIN_HISTORY tracks authentication events, not object-level data access. A user's default role at login also does not prove which role was active when a query ran, nor whether the target table was accessed.