SnowPro Advanced: Security Engineer Question 312
Select 3Apply threat modeling methodologies to identify potential threats specific to Snowflake:A security engineer is leading a threat-modeling workshop for a company migrating sensitive analytics workloads to Snowflake. The company will ingest data from cloud storage, expose curated data to BI users, and allow a small DevOps team to automate deployments with service accounts. During the workshop, the team uses a STRIDE-style approach and wants to identify the most relevant Snowflake-specific threats that should be prioritized first. Which TWO threats are the most directly aligned to Snowflake's security model and shared-responsibility boundaries in this scenario?
- A
A compromised CI/CD service user with broad role grants could create or alter objects and exfiltrate sensitive query results unless least-privilege roles, key rotation, and monitoring are enforced.
- B
An attacker could physically remove disks from Snowflake-managed storage and recover plaintext table data because customers are responsible for disk-level encryption in Snowflake.
- C
Misconfigured network policies, federated authentication settings, or overly permissive user/role assignments could allow unauthorized access to Snowflake accounts and data.
- D
Because Snowflake separates compute from storage, SQL injection against an upstream application is not a meaningful threat to Snowflake and can be excluded from the model.
- E
Failure to review data-sharing relationships and object privileges could expose sensitive data to unintended internal roles or external consumers, even without copying the data.
Show answer and explanation
Correct answers: A, C, E
Explanation
The best answers are A, C, and E because they represent realistic, high-priority threats that arise directly from how Snowflake is administered and used: identity compromise, access-control misconfiguration, and unintended disclosure through privileges or sharing. In Snowflake threat modeling, the most valuable first steps are usually to map identities, roles, trust boundaries, entry points, and data flows such as ingestion from stages/cloud storage, user access through BI tools, and automation through service principals or service users. Using a methodology such as STRIDE helps surface relevant threats: spoofing through compromised credentials or weak federation, tampering through overprivileged automation identities, elevation of privilege through poor role design, and information disclosure through misconfigured grants or shares. By contrast, option B is inaccurate because Snowflake handles core platform encryption responsibilities, and option D is incorrect because upstream application threats like SQL injection can still affect Snowflake when applications submit SQL with excessive privileges. Relevant best practices from Snowflake documentation include applying least privilege with RBAC, securing network access with network policies and private connectivity where appropriate, enforcing strong authentication and federation controls, auditing activity with account usage and access history views, and carefully governing data sharing and object privileges.
- A. Correct.
Correct. In Snowflake, service users used by automation pipelines are a high-value target. If such an identity has excessive privileges, an attacker could create users, grant roles, modify objects, unload data, or query sensitive datasets. This maps well to STRIDE categories such as spoofing, elevation of privilege, and information disclosure. Mitigations include least-privilege role design, strong authentication controls for programmatic access, credential/key rotation, and audit/monitoring through Snowflake access history and query history.
- B. Incorrect.
Incorrect. This reflects a misunderstanding of Snowflake's shared-responsibility model. Snowflake manages encryption of data at rest and in transit, including key management architecture within the platform. Customers are not responsible for implementing disk-level encryption on Snowflake-managed storage. While physical infrastructure threats exist in cloud environments, this option is not the most directly actionable Snowflake-specific threat for the customer to prioritize in a threat model.
- C. Correct.
Correct. Unauthorized access caused by weak identity and access controls is one of the most relevant Snowflake threats. Misconfigured network policies, insecure federation/SAML integrations, weak MFA posture, or excessive grants can lead to account compromise or inappropriate data access. This aligns to spoofing, tampering, and elevation-of-privilege concerns in threat modeling and is directly within the customer's area of responsibility.
- D. Incorrect.
Incorrect. Separation of compute and storage does not eliminate application-layer threats. If an upstream application builds unsafe SQL and submits it to Snowflake, injection can still be a valid threat path leading to unauthorized reads or changes, depending on the privileges of the application's Snowflake role. The misconception is assuming Snowflake's architecture removes the need to model application-originated attacks.
- E. Correct.
Correct. Snowflake's secure data sharing and role-based access model are powerful, but misconfiguration can cause unintended disclosure. Sharing data without careful governance, or granting privileges too broadly on databases, schemas, views, or shares, can expose data internally or externally. This is a Snowflake-specific information-disclosure threat that should be prioritized, especially in environments serving BI users and cross-team consumers.