SnowPro Advanced: Security Engineer Question 308
Single answerIdentify and catalog critical assets within SnowflakeA security engineer has been asked to create an inventory of the organization's most sensitive Snowflake assets before a governance review. The company stores regulated customer data in several databases, shares selected datasets with external partners, and allows multiple engineering teams to create objects in their own schemas. The engineer needs an approach that identifies which Snowflake objects are critical, shows where sensitive columns exist, and helps determine exposure through direct sharing. Which action would BEST meet these requirements with the least manual effort?
- A
Use Snowsight Governance features to classify sensitive data and query ACCOUNT_USAGE views such as TAG_REFERENCES and OBJECT_DEPENDENCIES, then review shares to identify exposed critical objects.
- B
Grant ACCOUNTADMIN to each engineering lead and ask them to manually document all sensitive tables, columns, and shares in a spreadsheet for the governance review.
- C
Query only INFORMATION_SCHEMA.TABLES in each database to list tables, because table names are sufficient to determine which assets are critical and whether they are externally exposed.
- D
Rotate all encryption keys and enable Tri-Secret Secure so that any database containing regulated data is automatically cataloged as a critical asset.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake-native metadata and governance capabilities to build the asset inventory. In practice, identifying critical assets in Snowflake often involves discovering sensitive data at the column level, applying and reviewing tags, understanding object relationships, and checking data-sharing exposure. Snowflake provides governance-oriented capabilities in Snowsight for data classification and metadata visibility, and ACCOUNT_USAGE views support centralized reporting across the account. Reviewing shares is especially important because sensitive assets may be exposed to external consumers through direct sharing. By contrast, relying only on table names, broad administrative grants, or encryption features does not satisfy the core requirement of identifying and cataloging critical assets. Relevant Snowflake documentation areas include Data Classification, Object Tagging, Snowsight governance features, Shares/Secure Data Sharing, and Account Usage views.
- A. Correct.
Correct. This approach aligns with Snowflake-native governance and discovery capabilities. Sensitive data classification in Snowsight can help identify columns containing regulated or sensitive information. ACCOUNT_USAGE views such as TAG_REFERENCES help inventory tagged objects, and dependency metadata can help understand relationships among critical assets. Reviewing shares is also essential because direct sharing can expose objects to external consumers. This combination provides a scalable way to identify and catalog critical assets with less manual effort than ad hoc documentation.
- B. Incorrect.
Incorrect. Although engineering leads may know their environments, granting ACCOUNTADMIN broadly violates least-privilege principles and introduces significant security risk. Manual spreadsheets are also error-prone and difficult to maintain in dynamic Snowflake environments. This option does not provide a reliable or governance-friendly asset catalog process.
- C. Incorrect.
Incorrect. INFORMATION_SCHEMA.TABLES can help enumerate tables, but table listings alone are not enough to determine criticality, identify sensitive columns, or understand whether data is exposed through shares. Critical asset cataloging typically requires richer metadata, such as tags, classification results, and sharing visibility.
- D. Incorrect.
Incorrect. Key rotation and Tri-Secret Secure are security controls related to encryption and key management, not asset discovery or cataloging. They do not identify which objects contain sensitive data, do not map dependencies, and do not show which specific assets are being shared externally.