SnowPro Advanced: Security Engineer Question 266
Single answerSet up automated alerts and notifications for security events:A Snowflake security engineer must notify the security operations team within minutes whenever a user is added to a highly privileged role such as SECURITYADMIN or ACCOUNTADMIN. The team wants the solution to be automated inside Snowflake, minimize custom polling code, and send a message to an external notification system. Which approach best meets these requirements?
- A
Create an ALERT that periodically queries ACCOUNT_USAGE.GRANTS_TO_USERS for new grants to privileged roles, and configure the ALERT action to call a notification integration-backed external endpoint when a match is found.
- B
Create a masking policy on the USERS view and attach an email notification to the policy so Snowflake sends a message whenever a role grant occurs.
- C
Enable Tri-Secret Secure so Snowflake automatically emits a security event notification whenever privileged roles are granted.
- D
Create a resource monitor on the account and configure it to notify the security operations team when role membership changes for privileged roles.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a Snowflake ALERT to evaluate metadata on a schedule and trigger a notification workflow when a privileged role grant is detected. In practice, security teams commonly monitor grant-related views such as those in ACCOUNT_USAGE or other grant metadata surfaces, then use an alert action to call an external endpoint or downstream process through a supported integration. This approach is preferable here because it is native to Snowflake, reduces custom polling infrastructure, and supports near-real-time operational monitoring.
The other options misuse unrelated Snowflake features: masking policies enforce data access rules, Tri-Secret Secure addresses encryption and key management, and resource monitors track compute spending. Snowflake best practices separate preventive controls like RBAC and masking from detective controls like alerts and event monitoring. Candidates should recognize which platform capabilities are intended for automated security event detection versus data protection or cost governance.
- A. Correct.
Correct. Snowflake ALERT objects are designed to run a condition query on a schedule and take an action when the condition returns results. For a security event such as a new grant of a highly privileged role, an alert can query account metadata such as grant history views and then invoke an action to notify an external system using a supported integration pattern. This aligns with the requirement to keep the workflow automated within Snowflake and avoid building a separate polling application.
- B. Incorrect.
Incorrect. Masking policies protect column-level data at query time; they do not monitor administrative events such as role grants, and they do not provide event-driven notification behavior for account security changes. This option confuses data protection controls with security monitoring and alerting capabilities.
- C. Incorrect.
Incorrect. Tri-Secret Secure is related to encryption key management and customer-controlled key material, not operational alerting on RBAC changes. It does not generate notifications for privileged role grants. This distractor reflects a common misconception that all advanced security features also provide monitoring or alerting functions.
- D. Incorrect.
Incorrect. Resource monitors are used to track and control credit consumption for warehouses and can trigger actions based on usage thresholds. They are not designed to detect RBAC or grant changes. This option is plausible because resource monitors do support notifications, but only for consumption-related events, not security administration events.