SnowPro Advanced: Security Engineer Question 303
Single answerCompliance reportsA security engineer at a healthcare company must provide external auditors with evidence that Snowflake meets established security and compliance standards before allowing regulated workloads to be migrated. The auditors specifically ask for Snowflake-issued compliance documentation rather than internally generated account reports. Which action should the security engineer take to get the most appropriate documentation?
- A
Download the relevant compliance reports and certifications from Snowflake's Trust Center for auditor review
- B
Query ACCOUNT_USAGE views to produce a custom report showing current security settings and share that as Snowflake's compliance evidence
- C
Open a support case requesting Snowflake to generate a one-time account-specific HIPAA attestation report
- D
Use Snowsight to export login history and network policy settings because those exports are the official Snowflake compliance reports
Show answer and explanation
Correct answer: A
Explanation
For auditor requests about Snowflake's own compliance posture, the security engineer should use Snowflake's official compliance documentation, typically available through the Snowflake Trust Center. These materials include items such as certifications and assurance reports that are intended to demonstrate Snowflake's adherence to recognized standards. Internal account-level reports from ACCOUNT_USAGE, Snowsight exports, or other telemetry can help demonstrate how the customer uses Snowflake securely, but they are not substitutes for Snowflake-issued compliance artifacts. This aligns with Snowflake best practice: use official vendor compliance reports for platform assurance, and use account metadata separately for customer-specific control evidence.
- A. Correct.
Correct. Snowflake publishes compliance documentation, certifications, and related security assurance materials through its Trust Center. When an auditor requests Snowflake-issued compliance evidence, the right approach is to obtain the official reports and certifications from Snowflake's published compliance resources rather than creating internal reports from account metadata.
- B. Incorrect.
Incorrect. ACCOUNT_USAGE views are useful for internal governance, monitoring, and evidence gathering about how a specific Snowflake account is configured or used. However, they do not replace Snowflake-issued third-party compliance reports such as SOC reports or certifications. This option reflects the common misconception that account telemetry is equivalent to vendor compliance attestation.
- C. Incorrect.
Incorrect. Snowflake does not provide custom, one-off compliance attestation documents for each customer's account in the way this option suggests. Official compliance materials are made available through Snowflake's established compliance reporting channels. A support case may help with access questions, but it is not the primary mechanism for obtaining official compliance reports.
- D. Incorrect.
Incorrect. Login history and network policy exports can support an internal audit or security review of the customer's Snowflake environment, but they are not official Snowflake compliance reports. This distractor targets the misconception that operational security data from a tenant account can serve as vendor-level certification evidence.