SnowPro Advanced: Security Engineer Question 248
Single answerMonitor data access and data transfer history:A security engineer is investigating whether sensitive customer data was copied out of Snowflake during the last 24 hours. The team needs to determine both which users accessed the underlying table data and whether any query results were exported to an external location such as cloud storage. Which approach should the engineer take to get the most complete answer?
- A
Query ACCOUNT_USAGE.ACCESS_HISTORY to identify which principals accessed the sensitive objects, and query ACCOUNT_USAGE.COPY_HISTORY to find exports from query results to external stages.
- B
Query ACCOUNT_USAGE.ACCESS_HISTORY to identify object-level reads, and query ACCOUNT_USAGE.DATA_TRANSFER_HISTORY to review data movement events associated with unloading data to external locations.
- C
Query INFORMATION_SCHEMA.QUERY_HISTORY and look for SELECT statements against the table; this alone is sufficient to confirm both data access and whether data left Snowflake.
- D
Query ACCOUNT_USAGE.LOGIN_HISTORY to identify the user sessions involved, and query ACCOUNT_USAGE.STAGE_STORAGE_USAGE_HISTORY to determine whether exported files were written to cloud storage.
Show answer and explanation
Correct answer: B
Explanation
For security investigations in Snowflake, the most effective pattern is to combine auditing views based on the question being asked. To determine who accessed sensitive data, use SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY, which provides detailed visibility into accessed objects and query lineage. To determine whether data was moved out of Snowflake, use SNOWFLAKE.ACCOUNT_USAGE.DATA_TRANSFER_HISTORY, which is intended for monitoring transfer activity. While QUERY_HISTORY, LOGIN_HISTORY, and stage usage views can provide useful supplemental context, they are not the primary sources for answering both parts of this scenario completely. This aligns with Snowflake best practices for auditability and monitoring using the ACCOUNT_USAGE schema and security-focused usage views.
- A. Incorrect.
Incorrect. ACCOUNT_USAGE.ACCESS_HISTORY is the right source for tracing which users, roles, and objects were involved in data access at the object and column lineage level. However, COPY_HISTORY is primarily used for monitoring data loading activity and certain copy operations, not as the best source for broad monitoring of data transfer events related to unloading query results to external locations. For an investigation focused on whether data was transferred out of Snowflake, DATA_TRANSFER_HISTORY is the more appropriate account usage view.
- B. Correct.
Correct. ACCESS_HISTORY is the key view for auditing who accessed which data objects, including dependencies and lineage details useful in sensitive data investigations. DATA_TRANSFER_HISTORY is designed to help monitor data movement events, including transfers relevant to unloading/export scenarios. Together, these views provide a practical and comprehensive approach to determine both access to sensitive data and potential transfer of that data outside Snowflake.
- C. Incorrect.
Incorrect. QUERY_HISTORY can help identify SQL statements such as SELECT or COPY INTO commands, but it does not by itself provide the most complete or authoritative picture of downstream object access lineage or data transfer activity. Investigators often need ACCESS_HISTORY for detailed object/column access relationships and DATA_TRANSFER_HISTORY for transfer monitoring. Relying only on QUERY_HISTORY can miss important context and is not the best practice for security investigations.
- D. Incorrect.
Incorrect. LOGIN_HISTORY is useful for authentication and session investigations, such as identifying sign-ins, client IPs, and authentication methods, but it does not show which data objects were accessed. STAGE_STORAGE_USAGE_HISTORY tracks storage usage for stages over time, not specific export or transfer events tied to a suspicious query or user action. These views do not directly answer the investigation requirements.