SnowPro Advanced: Security Engineer Question 335
Single answer4.3 Identify and manage security incidents.A Snowflake Security Engineer is investigating a possible insider threat after an analyst reported seeing query results from a sensitive table that they should not have been able to access. The engineer needs to quickly determine whether unauthorized access occurred in the last 24 hours and identify the user, role, client, and SQL statement involved. Which approach would BEST support incident investigation in Snowflake?
- A
Query ACCOUNT_USAGE.ACCESS_HISTORY together with QUERY_HISTORY to trace which principal accessed the sensitive objects and correlate that access to the executed SQL and session details.
- B
Review only the grants on the sensitive table using SHOW GRANTS because current privilege state is sufficient to prove whether the table was accessed in the last 24 hours.
- C
Rotate the user's password and revoke all active roles immediately, then use TASK_HISTORY to determine which user queried the table.
- D
Use DATABASE_STORAGE_USAGE_HISTORY to identify which user read the table because storage history captures object-level access events.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake's account usage views designed for auditing and forensic review. ACCESS_HISTORY is intended to help identify data access to objects, including underlying base objects referenced by queries. QUERY_HISTORY complements this by showing the query text, execution context, user, role, warehouse, client-generated details, and timestamps. Together, these views support common incident response tasks such as confirming whether access occurred, identifying the actor and client used, scoping impacted data, and preserving evidence for follow-up actions. By contrast, SHOW GRANTS only shows permissions, not usage; TASK_HISTORY is limited to tasks; and DATABASE_STORAGE_USAGE_HISTORY is unrelated to object access. This aligns with Snowflake best practices for monitoring and investigating security events using ACCOUNT_USAGE views, especially ACCESS_HISTORY and QUERY_HISTORY.
- A. Correct.
Correct. For a Snowflake security incident, ACCOUNT_USAGE.ACCESS_HISTORY is the primary source for object-level data access investigation, including which base objects were accessed. Correlating ACCESS_HISTORY with QUERY_HISTORY provides the SQL text, user, role, client/application context, timing, and other execution details needed for incident response. This is the most appropriate method to determine whether unauthorized access occurred and to document the scope of the incident.
- B. Incorrect.
Incorrect. SHOW GRANTS can help determine who currently has privileges, but it does not prove whether a table was actually accessed, by whom, or when. It also reflects current state rather than necessarily the state at the time of the suspected incident. Investigations require audit evidence of actual activity, not just entitlement review.
- C. Incorrect.
Incorrect. Rotating credentials and revoking access may be reasonable containment actions after evidence is confirmed, but they do not answer the investigation question. TASK_HISTORY is for task executions and scheduling metadata, not for general user query investigation against a table. Using it here reflects a misunderstanding of Snowflake monitoring views.
- D. Incorrect.
Incorrect. DATABASE_STORAGE_USAGE_HISTORY reports storage consumption trends and billing-related usage, not read-access audit events. It cannot identify which user queried a table or what SQL was executed.