SnowPro Advanced: Security Engineer Question 276
Single answerCredit consumption considerationsA global financial services company uses Snowflake for regulated workloads. The security engineering team enabled Tri-Secret Secure for a Business Critical account and configured a customer-managed key in their cloud provider KMS. During a cost review, leadership asks why security-related configuration appears to add ongoing charges even when user query volume is stable. Which statement BEST explains the credit consumption impact of this design?
- A
Enabling Tri-Secret Secure adds Snowflake compute credit charges to every query because each statement performs dedicated key decryption in a virtual warehouse.
- B
Using a customer-managed key with Tri-Secret Secure can introduce additional cost from cloud provider key management operations, but it does not by itself create extra Snowflake virtual warehouse credit consumption for each query.
- C
Tri-Secret Secure reduces Snowflake credit usage because encryption work is offloaded entirely to the cloud provider KMS instead of Snowflake services.
- D
The main ongoing Snowflake credit impact comes from maintaining a larger result cache for encrypted data, which is required when Tri-Secret Secure is enabled.
Show answer and explanation
Correct answer: B
Explanation
This question tests whether the candidate can distinguish Snowflake credit consumption from external service charges in a security architecture. In Snowflake, virtual warehouse credits are tied to compute resources used for workloads such as queries, DML, and some data processing tasks. Security features like Tri-Secret Secure do not automatically mean each query consumes additional warehouse credits. However, using a customer-managed key with a cloud provider KMS can introduce separate charges from that provider for key storage and API usage. Candidates should also recognize that Business Critical and advanced security capabilities may affect overall platform cost and contract pricing, but the key point is that not all security-related cost shows up as Snowflake warehouse credits. This aligns with Snowflake documentation for Tri-Secret Secure and with cloud provider KMS pricing guidance, which identifies customer-managed key operations as an external cost consideration.
- A. Incorrect.
Incorrect. Tri-Secret Secure does not cause each query to consume dedicated virtual warehouse credits for key decryption as described here. Snowflake encryption and key hierarchy are platform services concerns, not something that results in a separate warehouse being spun up per statement. A common misconception is to assume all security processing directly increases query-compute billing.
- B. Correct.
Correct. Tri-Secret Secure in a Business Critical account uses a customer-managed key in addition to Snowflake-managed protections. This can lead to charges from the external cloud provider KMS based on key usage and key management operations. However, this does not mean every query inherently incurs additional Snowflake warehouse credits solely because Tri-Secret Secure is enabled. The cost consideration is primarily the external key management service charges and the higher edition/service level, not per-query warehouse credit inflation caused by the feature itself.
- C. Incorrect.
Incorrect. Tri-Secret Secure does not reduce Snowflake credit consumption. It is a security capability for stronger key control, not a cost-optimization feature. While some encryption-related operations involve the cloud provider KMS, that does not translate into lower Snowflake credits for compute workloads.
- D. Incorrect.
Incorrect. There is no documented requirement that Tri-Secret Secure maintains a larger result cache for encrypted data, nor is result cache size the main driver of ongoing Snowflake credits in this scenario. Result caching is not billed as warehouse compute in the way described, and this option confuses caching behavior with encryption controls.