SnowPro Advanced: Security Engineer Question 318
Single answerCompromised service account credentialsA company discovers that credentials used by an ETL service account to connect to Snowflake were exposed in a public code repository. The account is a Snowflake user authenticated with a password and has a default role that can read sensitive tables and load data into production schemas. The ETL jobs run every 15 minutes and business leadership wants to minimize both security exposure and operational downtime. Which action should the security engineer take FIRST in Snowflake to most effectively contain the incident while preserving the ability to investigate what happened?
- A
Immediately reset the service account password, disable the user, and review LOGIN_HISTORY, QUERY_HISTORY, and ACCESS_HISTORY to determine whether the credentials were used maliciously before re-enabling with least-privilege adjustments
- B
Rotate the password only after collecting several days of login and query history so that no evidence is lost, because changing the password could remove historical records needed for the investigation
- C
Revoke all privileges from the service account's default role but leave the user active, because active sessions will automatically lose access and the ETL process can continue using secondary roles
- D
Drop and recreate the Snowflake user with the same name so any attacker sessions are invalidated immediately, then restore grants from memory after the incident is resolved
Show answer and explanation
Correct answer: A
Explanation
In Snowflake, handling compromised service account credentials should follow standard incident response principles: contain, investigate, remediate, and harden. The best first action is to stop further use of the exposed credentials by disabling the user and rotating the password. Snowflake provides audit and monitoring data through views and functions such as LOGIN_HISTORY and QUERY_HISTORY, and ACCESS_HISTORY can help assess object-level access patterns where enabled and available in the edition. These records remain available for investigation after credential rotation. After containment, security engineers should review role design, reduce privileges to least privilege, and consider stronger authentication patterns for service accounts, such as key-pair authentication, along with network policies and restricted role assignments where appropriate. This aligns with Snowflake security best practices around credential management, least privilege, and account activity monitoring.
- A. Correct.
Correct. The first priority in a compromised-credential scenario is containment. Resetting the password and disabling the user immediately reduces the chance of continued unauthorized access. Reviewing LOGIN_HISTORY helps identify authentication events, QUERY_HISTORY helps identify actions performed, and ACCESS_HISTORY helps assess access to governed objects and sensitive data where available. This approach also preserves evidence because Snowflake account usage and history views are retained independently of the current password. After containment, the service account should be re-enabled only after credential rotation and role hardening, such as limiting privileges and reviewing whether a password-based service account remains appropriate.
- B. Incorrect.
Incorrect. This delays containment and increases risk. Snowflake historical metadata is not erased simply because a password is changed or a user is disabled. Waiting to rotate compromised credentials gives an attacker additional time to authenticate and act. A common misconception is that credential rotation destroys audit evidence; in Snowflake, login and query history are retained in metadata views and functions for investigation.
- C. Incorrect.
Incorrect. Revoking privileges from a role may reduce future authorization, but it does not address the core issue that the credentials are compromised. Also, relying on role changes alone is weaker incident containment than disabling the user and rotating credentials. Existing sessions and exact effects can vary by timing and privilege usage, so this is not the most effective first step. Leaving the user active preserves the attack path.
- D. Incorrect.
Incorrect. Dropping and recreating the user is operationally disruptive and risks losing important configuration context, such as ownership relationships, grants, network policy settings, RSA key configuration, and audit continuity tied to the original user object. It is not the recommended first action when a faster and safer containment path exists: disable the user, rotate credentials, and investigate using Snowflake history.