SnowPro Advanced: Security Engineer Question 305
Select 2Domain 4.0: Threats, Risk Assessment, Incident Response, and Forensics (18%)A Snowflake security engineer is investigating a suspected data exfiltration incident. An analyst reports that a privileged user may have queried sensitive tables and then exported the results outside Snowflake during the last 24 hours. The engineer must quickly determine what actions occurred, which objects were accessed, and whether data was unloaded. Which Snowflake sources should the engineer use first to perform this investigation? (Choose two.)
- A
Review ACCOUNT_USAGE.QUERY_HISTORY to identify the SQL statements executed by the user, including SELECT and COPY INTO commands.
- B
Review ACCOUNT_USAGE.ACCESS_HISTORY to determine which tables, views, and columns were accessed by the suspicious queries.
- C
Review SHOW USERS output to determine whether result sets were downloaded from Snowsight worksheets.
- D
Review ACCOUNT_USAGE.WAREHOUSE_METERING_HISTORY to confirm which rows were returned by the suspicious queries.
- E
Review ACCOUNT_USAGE.COPY_HISTORY to determine whether data was unloaded from tables to an external stage.
Show answer and explanation
Correct answers: A, B
Explanation
For Snowflake incident response and forensics, investigators typically start with QUERY_HISTORY and ACCESS_HISTORY. QUERY_HISTORY helps reconstruct what commands were executed, by whom, and when. ACCESS_HISTORY then provides object-level and, in many cases, column-level visibility into what data those queries touched. Together, they are the strongest initial sources for validating suspected unauthorized access and possible exfiltration patterns.
In contrast, WAREHOUSE_METERING_HISTORY is operational and billing-focused, not forensic. SHOW USERS is administrative metadata, not evidence of actions taken. COPY_HISTORY is often misunderstood: it is mainly used to track data loading operations and is not the best first source for broad exfiltration investigation. Snowflake best practices for security investigations emphasize correlating account usage views such as QUERY_HISTORY, LOGIN_HISTORY, SESSIONS where available, and ACCESS_HISTORY to build a timeline of user behavior. Relevant Snowflake documentation includes the Account Usage views for QUERY_HISTORY and ACCESS_HISTORY, which are specifically intended to support auditing, monitoring, and forensic analysis.
- A. Correct.
Correct. QUERY_HISTORY is one of the primary forensic sources for incident investigation in Snowflake. It captures executed SQL text, execution status, session details, timing, and other metadata. In this scenario, it helps identify whether the user ran sensitive SELECT statements or COPY INTO
commands that could indicate unloading data to a stage or cloud storage. This is a first-stop source for reconstructing user activity. - B. Correct.
Correct. ACCESS_HISTORY is designed to show which data objects were accessed by queries, including base objects and, where applicable, column-level lineage and access details. For a suspected exfiltration event, this is essential for determining exactly which sensitive tables or columns were touched by the suspicious queries identified in QUERY_HISTORY.
- C. Incorrect.
Incorrect. SHOW USERS provides metadata about users, such as names and properties, but it does not provide forensic evidence about worksheet result downloads or user query result handling. Investigators might choose this if they are thinking about user attribution, but it is not an appropriate first source for determining data access or exfiltration actions.
- D. Incorrect.
Incorrect. WAREHOUSE_METERING_HISTORY is used for warehouse credit consumption and metering analysis, not for query result contents or row-level forensic evidence. It can help with cost or activity correlation at a high level, but it cannot confirm which rows were returned or what data was accessed or exported.
- E. Incorrect.
Incorrect. COPY_HISTORY is useful for investigating data loading activity, especially COPY INTO
operations. However, it is not the primary source for identifying all unload behavior in this scenario. For unload investigations, QUERY_HISTORY is more reliable as a first source because it captures the actual SQL statements, including COPY INTO. A candidate might select this option because of the word 'COPY', but COPY_HISTORY is commonly associated with load history rather than comprehensive unload forensics.