SnowPro Advanced: Security Engineer Question 304
Single answerDomain 4.0: Threats, Risk Assessment, Incident Response, and Forensics (18%)A security engineer at a financial services company is investigating a potential data exposure in Snowflake. An analyst reports that a contractor account may have queried a table containing regulated customer data outside its normal working hours. Management wants an immediate response that both preserves evidence for investigation and reduces the risk of further unauthorized activity. The contractor is authenticated directly in Snowflake with a username and password. Which action should the security engineer take FIRST?
- A
Set the contractor user's DISABLED property to TRUE, then review QUERY_HISTORY and ACCESS_HISTORY to reconstruct activity
- B
Drop the contractor user immediately, then rely on LOGIN_HISTORY to determine whether the account accessed sensitive objects
- C
Revoke the contractor's current role grants, then assume that any active sessions are terminated automatically
- D
Rotate the password for the contractor account, then wait to see whether future failed logins confirm misuse
Show answer and explanation
Correct answer: A
Explanation
In a suspected Snowflake account compromise or misuse scenario, the first priority is containment with minimal evidence destruction. For a directly authenticated Snowflake user, setting the user to DISABLED = TRUE is an appropriate first step because it blocks new authentication attempts while preserving the identity and audit trail. After containment, investigators should use Snowflake telemetry such as LOGIN_HISTORY for authentication events, QUERY_HISTORY for executed SQL, and ACCESS_HISTORY for object-level access analysis, especially when determining whether sensitive data was queried. Dropping the user too early is poor forensic practice because it is more destructive than necessary. Similarly, relying only on role revocation or password rotation can leave gaps in containment or investigation. This approach is consistent with common incident response principles and Snowflake best practices around auditing and monitoring through Account Usage views and related history functions.
- A. Correct.
Correct. Disabling the user is the best first response because it immediately prevents further authentication while preserving the account, metadata, and historical evidence needed for forensics. After containment, reviewing QUERY_HISTORY and ACCESS_HISTORY is appropriate to determine what statements were run and what data objects were accessed. This aligns with incident response best practice in Snowflake: contain first, preserve evidence, then investigate using account usage and organization/account-level history views where available.
- B. Incorrect.
Incorrect. Dropping the user is too destructive as an initial response because it can complicate investigation and disrupt evidence preservation or attribution workflows. Also, LOGIN_HISTORY alone is insufficient to determine whether sensitive tables were queried; it shows authentication events, not full object access details. Investigators typically need QUERY_HISTORY and ACCESS_HISTORY for deeper analysis.
- C. Incorrect.
Incorrect. Revoking role grants may reduce future privilege use, but it is not the best first step for containment. It also does not guarantee that active sessions are terminated automatically in the way many candidates assume. The core misconception is treating privilege revocation as equivalent to account containment. Disabling the user is more direct and reliable for stopping additional logins while preserving the principal for investigation.
- D. Incorrect.
Incorrect. Rotating the password is weaker than disabling the account during an active incident. It may prevent future logins if the attacker only knows the old password, but it does not address the need for immediate containment as clearly as disabling the user. Waiting for failed logins is also not an appropriate first response when suspicious access to regulated data may already have occurred.