SnowPro Advanced: Security Engineer Question 302
Single answerCompliance reportsA financial services company is preparing for a vendor security review. The reviewer asks the Snowflake security engineer to provide formal documentation showing which independent security and compliance assessments Snowflake has completed, including reports such as SOC attestations and certifications. The engineer needs the fastest supported way to obtain current Snowflake compliance documentation without opening a support case or manually compiling public web content. Which action should the engineer take?
- A
Retrieve the documents from Snowflake's Compliance Reports section in the Trust Center / customer-facing compliance documentation portal
- B
Query ACCOUNT_USAGE views to generate a compliance report package that includes Snowflake's SOC and ISO audit results
- C
Open Snowsight and export the Access History dashboard because it contains Snowflake's external compliance certifications
- D
Request the reports from the organization's cloud provider because Snowflake inherits all compliance reports from the underlying infrastructure
Show answer and explanation
Correct answer: A
Explanation
When an auditor or vendor reviewer requests formal Snowflake compliance documentation, the correct approach is to obtain the official reports from Snowflake's Trust Center or the Snowflake process used to share compliance reports with customers. This aligns with Snowflake best practices: use Snowflake-provided attestations and certifications for vendor assurance, and use account metadata views only for evidence about the customer's own environment. ACCOUNT_USAGE, ORGANIZATION_USAGE, Access History, and Snowsight are valuable for operational audit and monitoring, but they are not substitutes for third-party compliance reports. In Snowflake documentation, compliance materials such as SOC reports and certification information are made available through Snowflake's compliance resources rather than generated from SQL views.
- A. Correct.
Correct. Snowflake provides customer-accessible compliance documentation through its Trust Center and related compliance report access process. This is the supported way to obtain formal third-party assessment materials such as SOC reports and information about certifications. For a vendor review, this is the appropriate source because it provides official Snowflake-issued or Snowflake-authorized compliance documentation rather than internally generated evidence.
- B. Incorrect.
Incorrect. ACCOUNT_USAGE views expose metadata about activity in the customer's Snowflake environment, such as login, query, access, and governance-related information. They do not contain Snowflake's independent third-party compliance assessment reports like SOC attestations or ISO certification packages. This option reflects a common misconception that internal account telemetry can substitute for vendor compliance evidence.
- C. Incorrect.
Incorrect. Snowsight dashboards can help analyze security posture and user activity within the customer's account, but they do not provide Snowflake corporate compliance artifacts such as SOC reports or certification letters. Access History is useful for auditing data access, not for proving that Snowflake as a service has passed external assessments.
- D. Incorrect.
Incorrect. Although Snowflake runs on public cloud infrastructure, Snowflake maintains its own compliance program and provides its own service-level compliance documentation. Cloud provider reports do not replace Snowflake's reports because the reviewer is assessing Snowflake's controls and attestations, not just the infrastructure provider's controls.