SnowPro Advanced: Security Engineer Question 245
Single answer3.1 Monitor data security.A security engineering team at a financial services company must monitor whether analysts are accessing sensitive customer data outside of approved controls. The company stores PII in several schemas and uses Snowflake roles extensively. The team wants to identify which users queried specific sensitive columns, when the access occurred, and the role used at execution time. Which Snowflake capability is the MOST appropriate to meet this requirement with the least custom effort?
- A
Use ACCESS_HISTORY to review column-level object access details, including the user, query, and role context for statements that touched sensitive columns.
- B
Use LOGIN_HISTORY to determine which users accessed sensitive columns, because it records every object and column referenced after authentication.
- C
Use QUERY_HISTORY only, because the SQL text always provides a complete and reliable column-level audit trail for sensitive data access.
- D
Use WAREHOUSE_METERING_HISTORY to identify which users accessed sensitive columns by correlating warehouse consumption spikes to query activity.
Show answer and explanation
Correct answer: A
Explanation
For monitoring data security in Snowflake, the key requirement is visibility into actual access to sensitive data, not just login events or general query execution. ACCESS_HISTORY is the most appropriate native capability because it provides detailed object access information and is commonly used for security auditing, impact analysis, and monitoring access to protected data. QUERY_HISTORY can complement this by providing broader query metadata, but it is not sufficient by itself for robust column-level auditing. LOGIN_HISTORY addresses authentication monitoring, and WAREHOUSE_METERING_HISTORY addresses resource usage, so neither directly satisfies the data security monitoring requirement. This aligns with Snowflake best practices for auditing data access using Account Usage views and related security telemetry.
- A. Correct.
Correct. ACCESS_HISTORY is designed for auditing object access at a granular level and is the best fit for monitoring sensitive data access. It can help identify which queries touched particular objects and columns, along with execution context such as the user and role involved. For a security engineer trying to monitor whether PII columns were accessed and by whom, this is the most direct Snowflake-native capability with minimal custom parsing.
- B. Incorrect.
Incorrect. LOGIN_HISTORY is useful for authentication monitoring, such as tracking successful and failed logins, client IPs, and connection patterns. However, it does not provide column-level data access details for queries executed after login. A candidate might choose this if they confuse authentication events with data access auditing.
- C. Incorrect.
Incorrect. QUERY_HISTORY contains useful metadata and the SQL text, but relying on SQL text alone is not a complete or reliable column-level audit mechanism. Queries may reference views, use SELECT *, or otherwise obscure direct column usage. Snowflake provides ACCESS_HISTORY specifically to address auditing needs beyond what QUERY_HISTORY alone can provide.
- D. Incorrect.
Incorrect. WAREHOUSE_METERING_HISTORY is for monitoring compute consumption and chargeback-style analysis, not for auditing which sensitive objects or columns were accessed. While it can be correlated to periods of activity, it cannot answer the security question of which users queried specific sensitive columns.