SnowPro Advanced: Security Engineer Question 334
Single answer4.3 Identify and manage security incidents.A Snowflake security engineer is notified that a service account used by a third-party ETL tool may have been compromised. The account has broad read access to several sensitive schemas and is actively used by production jobs every hour. The security team must immediately reduce the risk of further unauthorized access while preserving evidence for investigation and minimizing disruption to other users. Which action should the engineer take FIRST in Snowflake?
- A
Drop the user account so no additional queries can be executed with that identity
- B
Disable the suspected user account by setting DISABLED = TRUE, then review login and query history to assess activity
- C
Revoke all privileges from every role granted to the user, then wait for existing sessions to expire naturally
- D
Rotate the password and immediately delete all historical session and access records related to the user
Show answer and explanation
Correct answer: B
Explanation
For a suspected compromised Snowflake user, the first priority is containment with minimal destruction of evidence. Disabling the user account is the most appropriate immediate step because it blocks future logins without removing the account object or its audit context. After containment, the security engineer should investigate using Snowflake's audit and monitoring capabilities, including views such as LOGIN_HISTORY and QUERY_HISTORY in ACCOUNT_USAGE, and ACCESS_HISTORY where available, to determine whether unauthorized access occurred and what objects were affected. Dropping the user too early can hinder investigation and recovery. Revoking privileges role by role is less efficient and may not fully contain the threat as quickly as disabling the user. Deleting logs or historical records is contrary to incident response best practices. This aligns with Snowflake security operations guidance emphasizing rapid containment, auditability, and evidence preservation during incident management.
- A. Incorrect.
Incorrect. Dropping the user is a destructive action and is not the best first step in an incident response scenario. It can complicate investigation, auditing, and restoration of service. Best practice is to contain the threat quickly while preserving evidence. Disabling the user account is typically preferable to deleting it outright.
- B. Correct.
Correct. Setting the user to DISABLED = TRUE is an appropriate immediate containment step for a suspected compromised identity. It prevents further authentication by that user while preserving the account and its metadata for investigation. After containment, the engineer can use Snowflake monitoring sources such as LOGIN_HISTORY, QUERY_HISTORY, and ACCESS_HISTORY (if enabled in the account) to identify suspicious activity, scope impact, and support incident response. This approach balances containment, evidence preservation, and operational recovery.
- C. Incorrect.
Incorrect. Revoking privileges may reduce access, but it is slower and more error-prone during an active incident, especially when multiple roles and inherited grants are involved. It also does not directly address authentication by the compromised identity and may leave active sessions or partial access paths in place. A direct account disable is the cleaner first containment action.
- D. Incorrect.
Incorrect. Rotating credentials can be part of remediation, but deleting historical records is the opposite of good incident response practice. Security incidents require preserving logs and audit trails for forensic analysis, compliance review, and root-cause investigation. Snowflake account usage and access history should be retained and reviewed, not removed.