SnowPro Advanced: Security Engineer Question 319
Single answerCompromised service account credentialsA company discovers that credentials used by an unattended ETL service account in Snowflake were exposed in a public code repository. The account is used by a legacy loader application that authenticates with a Snowflake username and password and runs on a fixed schedule every 15 minutes. Security teams have confirmed suspicious sign-in attempts from an unfamiliar IP address, but the business needs the ETL process restored quickly with minimal long-term risk. Which action should the security engineer take FIRST to contain the incident while preserving the ability to recover the workload in a more secure way afterward?
- A
Immediately reset the service account password, disable the user if active misuse is suspected, and then re-establish the integration using a more secure non-password-based authentication method such as key-pair authentication
- B
Rotate the warehouse used by the ETL process so any active sessions tied to the compromised credentials are terminated automatically
- C
Create a network policy for the service account and leave the exposed password unchanged so the ETL process can continue from approved IP addresses
- D
Grant the service account the ACCOUNTADMIN role temporarily so investigators can review all account activity through the ETL connection
Show answer and explanation
Correct answer: A
Explanation
The best first action is to contain the compromise by invalidating the exposed credential: reset the password and, if active abuse is suspected, disable the user until a safe replacement access method is in place. For Snowflake service accounts, password-based authentication is generally a weaker pattern than key-pair authentication for automated workloads. After containment, the engineer should restore the ETL process using a more secure method and review monitoring data such as login history, query history, access history, and grants to determine impact. Additional hardening measures may include network policies, least-privilege role review, and secret-management improvements. Snowflake documentation and best practices support credential rotation, service-user hardening, network policies as supplemental controls, and use of stronger authentication approaches for non-interactive access.
- A. Correct.
Correct. When service account credentials are compromised, the immediate priority is containment: rotate or reset the exposed credential and disable the user if needed to stop abuse. After containment, the workload should be restored using a stronger authentication pattern suited for service accounts, such as key-pair authentication, instead of continuing to rely on passwords stored in code or configuration. This aligns with Snowflake security best practices for service users and credential rotation.
- B. Incorrect.
Incorrect. Warehouses control compute resources, not authentication security. Rotating or changing the warehouse does not remediate exposed user credentials and does not serve as the primary containment action for a compromised Snowflake user. Active sessions are better addressed through user/session management and credential rotation, not warehouse changes.
- C. Incorrect.
Incorrect. A network policy can reduce exposure by restricting allowed client IP addresses, and it may be part of a defense-in-depth recovery plan. However, leaving a known compromised password unchanged is not appropriate incident containment. If the password is exposed, it must be rotated or the account disabled. Network restrictions alone do not eliminate the credential compromise risk.
- D. Incorrect.
Incorrect. Elevating the service account to ACCOUNTADMIN increases blast radius and violates least-privilege principles. Investigation should be performed using appropriate administrative roles and audit views, not by granting excessive privileges to a compromised identity. This option reflects a dangerous misconception that more privilege helps incident response.