SnowPro Advanced: Security Engineer Question 331
Single answerAnalyze vulnerabilities to determine the likelihood and potential impactA security engineer is reviewing a Snowflake environment after an internal assessment found that a role used by a third-party reporting tool has SELECT access to several tables containing PII. The role is also assigned to a service user that authenticates with a long-lived password and does not require network policy restrictions. Query History shows the account is used daily from a fixed corporate IP range, and the reporting tool only needs masked values for most analysts. The engineer must determine which issue represents the highest-likelihood, highest-impact vulnerability to prioritize first.
Which finding should the engineer prioritize?
- A
The service user is not restricted by a network policy, increasing the chance that stolen credentials could be used from untrusted locations to access raw PII.
- B
The reporting role uses a warehouse sized larger than necessary, which could allow analysts to run queries faster against sensitive tables.
- C
The service user relies on password authentication instead of key-pair authentication, so any use of passwords in Snowflake is automatically a critical vulnerability.
- D
The account has daily query activity from a fixed corporate IP range, indicating the current access pattern is predictable and therefore low risk.
Show answer and explanation
Correct answer: A
Explanation
The best answer is the missing network policy on a service user that already has access to raw PII. When analyzing vulnerabilities, a security engineer should weigh both likelihood and impact. Here, impact is high because the role can query sensitive personal data. Likelihood is also elevated because the account uses long-lived password authentication and lacks network restrictions, even though legitimate usage comes from a fixed IP range. That means an available preventive control is not being used.
In Snowflake, network policies can restrict allowed client IP addresses for authentication, which is a practical way to reduce exposure for service accounts with predictable source locations. Snowflake security best practices also emphasize least privilege and limiting access to sensitive data through controls such as masking policies and role design. The scenario notes that most analysts only need masked values, further reinforcing that broad raw SELECT access is excessive; however, among the listed choices, the missing network policy is the clearest vulnerability to prioritize first because it directly reduces the attack surface for a high-impact account.
Relevant Snowflake guidance includes documentation and best practices around network policies, authentication hardening for service users, and protecting sensitive data with masking and least-privilege access models.
- A. Correct.
Correct. This is the strongest combination of likelihood and impact in the scenario. The role already has direct SELECT access to raw PII, so the impact of compromise is high. Because the service user uses long-lived password authentication and has no network policy restriction, the likelihood of misuse is materially higher if credentials are exposed. Snowflake network policies are an important compensating control that restricts where authentication can originate. In this case, the tool normally connects from a fixed corporate IP range, so not enforcing that known boundary leaves an avoidable exposure.
- B. Incorrect.
Incorrect. Oversized warehouses are primarily a cost and performance governance issue, not a direct security vulnerability. Faster queries do not inherently increase the probability of unauthorized access. While excessive compute could indirectly make large-scale extraction faster after compromise, it is not the most likely or highest-impact issue compared with unrestricted authentication to a privileged service account.
- C. Incorrect.
Incorrect. Key-pair authentication is often preferred for service users because it reduces reliance on passwords, but password use by itself is not automatically a critical vulnerability in Snowflake. Risk depends on surrounding controls such as password policy, MFA applicability, credential handling, network restrictions, and privileges granted. The absolute wording reflects a common misconception.
- D. Incorrect.
Incorrect. A stable access pattern from known corporate IPs does not reduce risk unless Snowflake enforces that boundary with a network policy. Observed behavior in Query History is descriptive, not preventive. If an attacker obtains the credentials, they could still attempt to authenticate from other locations because no network restriction is in place.