SnowPro Advanced: Security Engineer Question 272
Select 3Compare and contrast the benefits and consequences of enabling or disabling Snowflake security services and features:A financial services company is reviewing Snowflake account hardening after an internal audit. The security team wants stronger protection against accidental data exposure and credential misuse, but the platform team is concerned about operational impact and cost. The account currently has object tagging in use for governance, but no additional security features have been explicitly enabled. Which TWO actions best improve security posture while correctly reflecting the trade-offs of enabling the features?
- A
Enable Tri-Secret Secure so that data remains protected with an additional customer-managed key, understanding that if the customer-controlled key becomes unavailable, access to encrypted data can be interrupted.
- B
Disable fail-safe to reduce the window in which deleted data might be recoverable, improving both security and storage cost efficiency without affecting data protection guarantees.
- C
Enable network policies to restrict which IP addresses can connect, recognizing that overly restrictive rules can block legitimate users or services if exceptions are not planned.
- D
Disable Time Travel because Snowflake recommends turning it off globally for all regulated workloads to improve compliance and eliminate recovery-related risk.
- E
Enable MFA for all users, knowing this reduces the risk of credential-based compromise but can require additional rollout planning for user enrollment and access recovery.
Show answer and explanation
Correct answers: A, C, E
Explanation
The best answers are 1, 3, and 5 because they identify legitimate Snowflake security controls and correctly describe both the benefit of enabling them and the operational consequences. Tri-Secret Secure improves encryption key control but introduces dependency on customer-managed key availability. Network policies reduce exposure by limiting where connections can originate, but poor design can block valid access. MFA reduces the risk of credential compromise, with manageable rollout and support considerations.
Options 2 and 4 are incorrect because they misstate Snowflake capabilities or best practices. Fail-safe is not customer-disableable. Time Travel is not something Snowflake broadly recommends disabling for regulated environments; instead, its retention should be aligned with business, recovery, and governance requirements. Relevant Snowflake documentation includes guidance on Tri-Secret Secure, network policies, MFA, Time Travel, and Fail-safe. These topics are commonly tested in scenarios where candidates must compare security benefit versus operational impact rather than simply identify feature names.
- A. Correct.
Correct. Tri-Secret Secure adds an extra layer of key control by combining Snowflake-managed encryption with a customer-managed key through the cloud provider's key management service. This strengthens security and can help meet stricter compliance requirements. The trade-off is operational: if the customer-managed key is disabled, revoked, or otherwise unavailable, data access can be disrupted. This is a real consequence security engineers must plan for with strong key lifecycle and break-glass procedures.
- B. Incorrect.
Incorrect. Customers cannot disable Fail-safe. Fail-safe is part of Snowflake's data protection architecture and exists after the Time Travel retention period for permanent objects. It is not a customer-tunable security control for reducing recoverability. This option reflects a common misconception that Fail-safe can be managed like a configurable feature.
- C. Correct.
Correct. Network policies are a practical preventive control that restrict login attempts based on allowed or blocked IP address ranges. They materially reduce attack surface for account access. The consequence is administrative: if policies are too narrow or do not account for changing corporate egress IPs, service users, VPNs, private connectivity, or administrator access paths, they can cause outages or lockouts.
- D. Incorrect.
Incorrect. Snowflake does not recommend disabling Time Travel globally for all regulated workloads. Time Travel is primarily a data protection and recovery capability, allowing restoration of dropped or changed data within the retention period. Reducing or minimizing retention may be appropriate in some environments, but disabling or minimizing it is a trade-off that reduces recoverability and is not a universal compliance best practice. Also, depending on object type and edition, retention behavior varies.
- E. Correct.
Correct. Enabling MFA is one of the most effective controls against stolen passwords and account takeover. It strengthens authentication security for interactive users. The consequence is not that it weakens usability beyond reason, but that deployment requires planning for enrollment, support, exception handling, and account recovery processes. This is an appropriate security-service trade-off.