SnowPro Advanced: Security Engineer Question 307
Select 34.1 Perform threat modeling, identification, and analyses.A financial services company is designing a new Snowflake-based analytics platform that will ingest customer PII from on-premises systems and expose curated datasets to internal analysts, data scientists, and a third-party risk-modeling partner through Secure Data Sharing. During a threat-modeling workshop, the security engineer must identify the most significant risks introduced by this design and recommend controls that reduce the attack surface without disrupting business requirements. Which TWO threats should be prioritized as the most relevant to this Snowflake architecture?
- A
Unauthorized disclosure of sensitive data caused by overly broad role grants, insecure shared objects, or inadequate masking/row access controls across internal users and shared datasets
- B
Interception of customer data in transit between Snowflake virtual warehouses and internal microservices running inside the customer’s own VPC because warehouse compute runs inside the customer network boundary
- C
Exposure of staged files or unloaded data through misconfigured cloud storage integrations, external stages, or insufficient governance over data movement paths outside Snowflake-managed storage
- D
Privilege escalation or excessive administrative access resulting from weak separation of duties, such as combining SECURITYADMIN-style responsibilities with routine data engineering roles
- E
Compromise of the Snowflake service caused by patching delays on operating systems managed directly by the customer for each Snowflake warehouse node
Show answer and explanation
Correct answers: A, C, D
Explanation
The best answers are options 1, 3, and 4 because they reflect realistic, high-value threats in Snowflake threat modeling: unauthorized data disclosure, insecure data movement through stages/integrations, and privilege escalation due to weak role design. These align with Snowflake security best practices around RBAC, least privilege, separation of duties, secure data sharing, and governance of external stages and storage integrations. In contrast, options 2 and 5 are based on incorrect assumptions about Snowflake’s managed architecture and shared responsibility model. When performing threat modeling for Snowflake, security engineers should focus on identity and access design, sensitive data protection policies, sharing boundaries, and external data ingress/egress points rather than infrastructure controls that Snowflake manages as part of the service.
- A. Correct.
Correct. In Snowflake threat modeling, one of the highest-priority risks is unauthorized exposure of sensitive data due to misconfigured RBAC, broad grants, or insufficient use of policy-based protections such as masking policies and row access policies. This risk is especially relevant when the same platform serves multiple personas and includes Secure Data Sharing to a third party. A candidate should recognize that identity, authorization boundaries, and object-sharing scope are central attack surfaces in Snowflake.
- B. Incorrect.
Incorrect. This option reflects a common misconception about Snowflake’s architecture. Snowflake virtual warehouses are not customer-managed compute instances running inside the customer’s VPC in the standard service model. While network security is important, the specific threat described is based on an inaccurate assumption about warehouse placement and control boundaries. Threat modeling should be grounded in the actual shared responsibility model and Snowflake service architecture.
- C. Correct.
Correct. Data movement outside Snowflake-managed storage is a major threat area. External stages, storage integrations, unload operations, and file-based exchange paths can create exposure if access to cloud storage locations is too broad or poorly monitored. In a realistic threat model for PII, these egress and staging paths should be examined carefully because they can bypass otherwise strong in-platform controls.
- D. Correct.
Correct. Excessive privilege and poor separation of duties are key threats in Snowflake environments. If administrative and operational duties are combined, a single compromised user or insider can grant broad access, disable protections, or exfiltrate sensitive data. Snowflake best practices emphasize least privilege and role design, making this a high-priority risk during threat identification.
- E. Incorrect.
Incorrect. Customers do not patch operating systems for Snowflake warehouse nodes. This distractor confuses customer-managed infrastructure responsibilities with Snowflake’s managed service model. Although platform security is important, OS patching for Snowflake-managed infrastructure is not a customer threat-control area to prioritize in this scenario.