SnowPro Advanced: Security Engineer Question 311
Select 3Identify and document data entry and exit pointsA security engineer is asked to document all Snowflake data entry and exit points for an audit. The company loads customer data from Amazon S3 into Snowflake every hour, allows analysts to export query results to a cloud stage for downstream processing, and uses external functions that send limited row data to an API hosted outside Snowflake. The engineer needs to identify which workflows must be documented as data entering or leaving Snowflake. Which workflows should be included?
- A
COPY INTO
from files in an external stage backed by Amazon S3 - B
Creating a secure view on top of a sensitive table for internal consumers
- C
COPY INTO
to unload query results from Snowflake to a stage - D
Calling an external function that sends row data from Snowflake to an external service
- E
Cloning a schema inside the same Snowflake account
Show answer and explanation
Correct answers: A, C, D
Explanation
To identify and document data entry and exit points in Snowflake, focus on workflows where data crosses the Snowflake boundary. In this scenario, ingestion from Amazon S3 through an external stage is an inbound flow, unloading with COPY INTO
- A. Correct.
Correct. Loading data with COPY INTO
from an external stage is a clear data entry point into Snowflake. For security documentation, this should be recorded because data originates outside Snowflake and enters Snowflake storage through a defined ingestion path. Auditors typically expect details such as the source location, stage type, storage integration or credentials used, and the roles permitted to run the load. - B. Incorrect.
Incorrect. A secure view changes how data is exposed within Snowflake, but it is not itself a data entry or exit point. It is an internal access-control and data-sharing abstraction inside the Snowflake environment. While it is important for data governance, it does not represent data crossing the Snowflake boundary.
- C. Correct.
Correct. COPY INTO
is a data exit point because it unloads data from Snowflake to files in an internal or external stage. From a security perspective, this is one of the most important outbound data flows to document because it can create extractable copies of sensitive data outside tables and may place data into cloud storage accessible by other systems. - D. Correct.
Correct. External functions are a data exit point because Snowflake sends portions of query data to a remote service through a proxy integration pattern. Even if only selected columns or filtered rows are sent, data is still leaving Snowflake for processing outside the platform. This should be documented along with the API integration, remote endpoint, and the type of data transmitted.
- E. Incorrect.
Incorrect. Cloning a schema is an internal metadata-based operation within Snowflake and does not move data into or out of the Snowflake boundary. It may have governance implications because it creates another logical copy accessible to users, but it is not a data ingress or egress path for audit documentation of entry and exit points.