SnowPro Advanced: Security Engineer Question 294
Single answerDefine, enable, and automate audit policies to support compliance reportingA financial services company uses Snowflake to store regulated customer data and must produce monthly compliance reports showing when privileged users accessed sensitive objects and whether security-related configuration changes occurred. The security team wants a solution that is centralized, repeatable, and easy to automate for auditors. Which approach BEST meets these requirements?
- A
Create and enable an account-level audit policy for the required event classes, then use a scheduled task to query the event table and persist monthly report results in a reporting schema.
- B
Enable object tagging on sensitive tables and use tag references to generate monthly audit reports because tags automatically capture access events and configuration changes.
- C
Grant auditors IMPORTED PRIVILEGES on the SNOWFLAKE database and have them manually query ACCOUNT_USAGE views each month, since this is the only supported source for compliance-grade audit reporting.
- D
Create a masking policy on regulated columns and schedule a task to query QUERY_HISTORY, because masking policies record all privileged access and all security configuration changes needed for compliance.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake audit policies with the event table and automate reporting with tasks. This aligns with Snowflake best practices for capturing auditable security events in a structured, policy-based way rather than relying on ad hoc SQL history analysis or manual review. Tags and masking policies are important governance and protection features, but they are not audit mechanisms. ACCOUNT_USAGE remains valuable for supplementary reporting and cross-checking, but compliance programs that require clear, repeatable capture of security-relevant events are better served by defining the relevant audit coverage up front, enabling the audit policy, and scheduling downstream report generation. Candidates should know the distinction between governance controls such as tags and masking policies, operational history sources such as QUERY_HISTORY and ACCOUNT_USAGE, and formal auditing mechanisms such as audit policies and event tables.
- A. Correct.
Correct. Snowflake supports audit policies that can be defined and enabled to capture selected event classes into the event table. This is the most direct way to implement centralized, policy-driven auditing aligned to compliance requirements. Automating extraction with a task to populate a reporting schema provides repeatable monthly reporting and reduces manual effort. This approach matches the requirement to define, enable, and automate audit policies for compliance reporting.
- B. Incorrect.
Incorrect. Tags are useful for classification, governance, and discovery, but they do not themselves function as audit controls that capture user access events or security configuration changes. A candidate might choose this because tags are often associated with sensitive data governance, but they are not a substitute for Snowflake audit logging.
- C. Incorrect.
Incorrect. ACCOUNT_USAGE views are useful for historical monitoring and reporting, but the statement that they are the only supported source for compliance-grade audit reporting is wrong. Snowflake audit policies and the event table are specifically designed for event collection. In addition, a fully manual monthly process does not meet the requirement for centralized, repeatable automation.
- D. Incorrect.
Incorrect. Masking policies protect data presentation at query time, but they do not provide comprehensive auditing of privileged access or security configuration changes. QUERY_HISTORY can help analyze executed SQL, but it is not a complete replacement for audit policy-driven event collection. Someone might choose this because query history is commonly used for investigations, but it does not satisfy the broader compliance auditing requirement by itself.