SnowPro Advanced: Security Engineer Question 310
Select 2Identify and document data entry and exit pointsA security engineer is preparing a data-flow inventory for a Snowflake environment that stores regulated customer data. The inventory must identify and document all approved data entry and exit points so the team can review where data can enter Snowflake and where it can leave the platform. Which TWO items should be documented as valid data entry or exit points in Snowflake?
- A
Named internal stages and external stages used with COPY INTO
or COPY INTObecause they represent controlled file-based ingestion into Snowflake and unloading out of Snowflake - B
Snowflake shares and listings because they allow secure outbound data distribution from a provider account to consumers without copying data into the consumer account
- C
Virtual warehouses because they are the compute layer that processes queries and therefore are the primary entry and exit points for regulated data
- D
Network policies because they define which client IP addresses can connect and therefore are themselves data ingress and egress channels
- E
Resource monitors because they control credit consumption and can stop warehouses, which makes them a governance-based path for data leaving Snowflake
Show answer and explanation
Correct answers: A, B
Explanation
When identifying and documenting data entry and exit points in Snowflake, focus on actual data movement and exposure mechanisms rather than general administrative or compute features. Common entry points include staged file loads, Snowpipe/Snowpipe Streaming, connectors, and client/application writes. Common exit points include query result retrieval by clients, COPY INTO
- A. Correct.
Correct. Stages are a core file movement boundary in Snowflake and should be documented when identifying data entry and exit points. Internal stages, user stages, table stages, and external stages are commonly used with COPY INTO
for loading data into Snowflake and COPY INTOfor unloading query or table data out of Snowflake to cloud storage. From a security-engineering perspective, these are explicit ingress and egress paths that should be inventoried along with ownership, allowed integrations, and destination storage details. - B. Correct.
Correct. Secure data sharing and listings are valid outbound data distribution mechanisms that should be documented as data exit points. Even though secure sharing does not physically copy the provider's data into the consumer account, it is still a governed mechanism by which data leaves the provider's control boundary for external consumption. For regulated environments, documenting which databases, schemas, or objects are exposed through shares or listings is important for data-flow reviews.
- C. Incorrect.
Incorrect. Virtual warehouses provide compute resources for query execution, loading, and transformation, but they are not themselves data entry or exit points. A common misconception is to treat any component that touches data as an ingress or egress channel. In reality, warehouses execute workloads against data paths such as stages, connectors, applications, sharing, and client query results.
- D. Incorrect.
Incorrect. Network policies restrict which IP addresses can authenticate to Snowflake, making them an access-control mechanism rather than a data ingress or egress channel. They are important to document in a security architecture, but they do not represent where data enters or exits Snowflake.
- E. Incorrect.
Incorrect. Resource monitors govern credit usage and can trigger notifications or suspend warehouses when thresholds are reached. They are cost-control and governance features, not mechanisms for loading data into Snowflake or delivering data out of it. Someone might choose this option because it affects warehouse operation, but it does not describe a data-flow boundary.