SnowPro Advanced: Security Engineer Question 253
Single answerUse Snowflake Trail observability featuresA security engineering team uses Snowflake Trail to investigate reports that a privileged role may have been used to access sensitive data outside normal business hours. The team wants a near-real-time, account-level view that helps analysts quickly identify suspicious user activity, such as unusual login patterns, role usage, and query behavior, without first building complex custom queries against raw event logs. Which Snowflake Trail observability feature should they use?
- A
Use the Activity view in Snowflake Trail to review account-level user activity and drill into events related to logins, queries, and role usage
- B
Use only the ACCESS_HISTORY view because it provides a complete visual investigation interface for suspicious sign-in and role activity
- C
Use Snowsight dashboards for warehouse utilization because compute trends are the primary source for detecting privileged access misuse
- D
Use replication and failover groups so analysts can compare account state across regions to identify suspicious user sessions
Show answer and explanation
Correct answer: A
Explanation
The key requirement is to use a Snowflake Trail observability feature that gives security analysts an account-level, near-real-time investigative view of user behavior without forcing them to begin with low-level event data and custom SQL. In this scenario, the Activity view in Snowflake Trail is the most appropriate choice because it is intended to help analysts review and investigate user activity such as authentication, query execution, and related account events.
By contrast, ACCOUNT_USAGE views such as ACCESS_HISTORY remain valuable for deeper forensic analysis and custom reporting, especially when validating what data was accessed. However, they are not the best answer when the question specifically asks for a Snowflake Trail observability feature that supports quick investigation workflows. Best practice is to use Snowflake Trail observability to identify suspicious patterns quickly, then pivot to lower-level telemetry such as ACCOUNT_USAGE or event data if deeper forensic detail is required.
This aligns with Snowflake guidance to use purpose-built observability and governance interfaces for rapid investigation, while using historical account views and logs for detailed evidence collection and correlation.
- A. Correct.
Correct. Snowflake Trail includes observability capabilities intended to help security and governance teams investigate account activity through a more accessible interface than starting from raw telemetry alone. The Activity view is designed to surface and explore user activity patterns such as authentication events, query activity, and other behaviors that can be used to investigate suspicious access. This is the best fit when analysts need a near-real-time, account-level investigative workflow.
- B. Incorrect.
Incorrect. ACCESS_HISTORY is useful for understanding data access lineage and which objects were touched by queries, but it is not itself a complete visual observability interface for investigating sign-ins, session behavior, or role usage. A candidate might choose this because it is strongly associated with auditing data access, but it does not replace Snowflake Trail's observability experience for broader suspicious activity review.
- C. Incorrect.
Incorrect. Warehouse utilization dashboards can help with performance and cost monitoring, but they are not the primary observability feature for investigating possible misuse of privileged roles. Someone might pick this option because unusual compute usage can sometimes correlate with suspicious activity, but it is indirect and does not directly address login patterns, user activity, or role-based investigation.
- D. Incorrect.
Incorrect. Replication and failover groups are business continuity features, not observability features for user activity investigation. This distractor reflects a misconception that comparing environments or regions is an appropriate method for security event analysis. It does not provide the near-real-time, analyst-friendly visibility needed for this scenario.