SnowPro Advanced: Security Engineer Question 267
Single answerSet up automated alerts and notifications for security events:A financial services company wants Snowflake to automatically notify its security operations mailbox whenever a user is added to a highly privileged role such as SECURITYADMIN or ACCOUNTADMIN. The company wants a solution that runs continuously inside Snowflake with minimal operational overhead and without requiring analysts to manually query account usage views. Which approach best meets this requirement?
- A
Create an ALERT object that periodically queries the account role grant history for new grants to privileged roles, and configure the alert action to call SYSTEM$SEND_EMAIL using a notification integration.
- B
Create a masking policy on the GRANTS_TO_USERS view so that when a privileged role grant appears, Snowflake automatically emails the security team.
- C
Create a network policy that blocks role grants to privileged roles unless the request comes from an approved IP range, and rely on the blocked event as the notification.
- D
Create a resource monitor on the warehouse used by administrators so that when privileged role usage increases, Snowflake sends an email to the security mailbox.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a Snowflake ALERT combined with email notification capabilities. In Snowflake, alerts can run on a schedule, evaluate a SQL condition, and execute an action when the condition is met. For automated security notifications, a common pattern is: (1) create a NOTIFICATION INTEGRATION for email, (2) define an ALERT that queries metadata or usage views for the security condition of interest, and (3) invoke SYSTEM$SEND_EMAIL in the alert action. This keeps the workflow inside Snowflake and avoids manual review of ACCOUNT_USAGE data. By contrast, masking policies protect data values, network policies restrict connection sources, and resource monitors watch compute consumption rather than RBAC changes. Relevant Snowflake documentation includes Alerts, Notification Integrations, SYSTEM$SEND_EMAIL, and Account Usage / access history metadata for monitoring administrative and security-relevant events.
- A. Correct.
Correct. Snowflake Alerts are designed to run scheduled SQL conditions and trigger an action when the condition evaluates to TRUE. For this scenario, an alert can query a suitable source of grant history or account usage metadata to detect newly granted privileged roles, and then call SYSTEM$SEND_EMAIL to notify the security team through a configured notification integration. This is an automated, in-platform approach with low operational overhead and aligns with Snowflake best practices for event-driven monitoring inside Snowflake.
- B. Incorrect.
Incorrect. Masking policies are used to dynamically protect sensitive data at query time based on context such as role or user. They do not monitor metadata changes or trigger notifications when grants occur. This option reflects a common misconception that governance objects can be repurposed as event detectors.
- C. Incorrect.
Incorrect. Network policies control allowed client network locations for authentication and access. They are not used to monitor or alert on role grant events. Even if an access attempt were blocked, that would not satisfy the requirement to detect when a user is added to a privileged role.
- D. Incorrect.
Incorrect. Resource monitors are for controlling and notifying about warehouse credit consumption thresholds. They do not inspect RBAC changes or security metadata. Increased warehouse usage is not a reliable or direct indicator that a privileged role was granted.