SnowPro Advanced: Security Engineer Question 330
Single answerAnalyze vulnerabilities to determine the likelihood and potential impactA security engineer is reviewing a Snowflake account after an internal audit found that a custom role named ANALYST_POWER has SELECT on several sensitive tables and has also been granted the global CREATE INTEGRATION privilege. The role is assigned to 120 analysts. Network policies are enforced for users, but the account still allows key pair authentication. The engineer must determine which finding represents the highest security risk based on likelihood and potential impact.
Which finding should be prioritized first?
- A
The ANALYST_POWER role has the global CREATE INTEGRATION privilege in addition to broad read access to sensitive data.
- B
Users authenticate with key pair authentication, which is less secure than password authentication when network policies are enabled.
- C
The ANALYST_POWER role is assigned to 120 analysts, increasing warehouse concurrency and query queueing risk.
- D
Sensitive tables are queried by a custom role instead of directly by SYSADMIN, making privilege review more complex.
Show answer and explanation
Correct answer: A
Explanation
The best answer is the excessive grant of a powerful global privilege to a widely assigned business role that already has access to sensitive data. In vulnerability analysis, the engineer should weigh both likelihood and impact. Here, likelihood is elevated because 120 analysts hold the role, increasing the chance of accidental misuse, credential compromise, or malicious activity. Impact is elevated because sensitive data is accessible and CREATE INTEGRATION can enable additional capabilities that may expand exfiltration or trust boundaries if not tightly governed.
Snowflake security guidance emphasizes least privilege, restricting global privileges, and using role hierarchy carefully. Privileges such as CREATE INTEGRATION should normally be limited to specialized administrative roles, not broadly assigned analyst roles. By contrast, key pair authentication is a valid supported authentication method and is often used securely when managed correctly. Custom roles are also standard best practice for RBAC. Therefore, the combination of broad sensitive-data access and unnecessary global privilege is the most critical finding to prioritize.
Relevant Snowflake documentation areas include access control and RBAC, least-privilege design, global privileges, integrations, and authentication methods including key pair authentication and network policies.
- A. Correct.
Correct. CREATE INTEGRATION is a powerful global privilege. If granted too broadly, it can allow creation of security, storage, notification, or external access-related integrations depending on governance and edition/features in use, which can materially expand attack paths. Combined with broad SELECT access to sensitive data and assignment to many users, this creates both high likelihood of misuse or compromise and high potential impact, including data exfiltration or unauthorized connections to external systems. Snowflake best practice is to restrict powerful global privileges to tightly controlled administrative roles under least privilege.
- B. Incorrect.
Incorrect. Key pair authentication is not inherently less secure than password authentication. In many environments it is preferred for service users and can be strongly secure when private keys are protected and rotated appropriately. Network policies can further reduce exposure, but the existence of key pair authentication alone is not the highest-risk finding in this scenario. The misconception is assuming passwords are automatically safer than asymmetric authentication.
- C. Incorrect.
Incorrect. Assigning a role to many users can increase blast radius if the role is over-privileged, but warehouse concurrency and query queueing are performance concerns, not the primary security vulnerability described. The security issue is excessive privilege, not the number of concurrent queries. Someone might choose this option by focusing on scale rather than the actual access and privilege risk.
- D. Incorrect.
Incorrect. Using custom roles instead of SYSADMIN is generally aligned with role-based access control best practices because it supports separation of duties and more granular privilege management. While privilege review may require diligence, this is not itself a high-risk vulnerability. The misconception is treating custom roles as a security weakness when they are usually the recommended approach.