SnowPro Advanced: Security Engineer Question 339
Single answerIdentify, triage, and contain security incidents:A Snowflake security engineer is notified that a service user account used by an ETL tool appears to be compromised. Query history shows the account executed unexpected SELECT statements against sensitive tables from an unfamiliar client session during the last 20 minutes. The ETL pipelines that rely on this user are business-critical and should be restored after the incident is contained. Which action should the engineer take FIRST to contain the incident while preserving the ability to investigate and later re-enable the integration securely?
- A
Drop the user immediately so no further sessions can be established, then recreate the user after the investigation
- B
Alter the user to disable it and rotate any associated credentials or key material before restoring access
- C
Revoke all object privileges from the service role, but leave the user active so investigators can observe additional activity
- D
Suspend the virtual warehouse used by the ETL tool so the attacker cannot run more queries from that account
Show answer and explanation
Correct answer: B
Explanation
In Snowflake, the most effective first action for a suspected compromised user is to disable the user account to stop further authenticated use while preserving the account for forensic review and controlled recovery. For service users, remediation should also include rotating the relevant authentication secret, such as passwords or key-pair material, before re-enabling access. This approach supports the standard incident-response sequence of identification, triage, containment, eradication, and recovery. Snowflake best practices for security operations emphasize using account metadata such as QUERY_HISTORY, LOGIN_HISTORY, and ACCESS_HISTORY where available to investigate suspicious behavior, while using administrative controls on the user object to contain the incident quickly. Dropping the user is unnecessarily destructive, revoking privileges alone is incomplete containment, and suspending a warehouse targets compute rather than the compromised identity.
- A. Incorrect.
Incorrect. Dropping the user is a disruptive response that can complicate investigation, remove account-level configuration, and break dependencies tied to the principal. For containment, Snowflake supports disabling a user, which immediately prevents new activity without unnecessarily destroying the identity object. Recreating the user later also increases operational risk and can make restoring the integration slower and less controlled.
- B. Correct.
Correct. Disabling the compromised user is the most appropriate first containment step because it blocks the account from establishing new authenticated sessions while preserving the user object for investigation and recovery planning. After containment, the engineer should rotate the password, reset MFA or rotate key-pair authentication material, and validate the integration before re-enabling access. This aligns with incident-response best practices: contain first, preserve evidence, then remediate credentials and restore service securely.
- C. Incorrect.
Incorrect. Revoking privileges may reduce access scope, but it does not directly stop an already compromised identity from continuing to authenticate or use any remaining permissions. Leaving the user active to observe activity is not an appropriate first containment action in a live compromise, especially for a service account accessing sensitive data. Incident response should prioritize stopping unauthorized access quickly.
- D. Incorrect.
Incorrect. Suspending the warehouse can interrupt some compute activity, but it is not a reliable account-level containment control. The compromised user could potentially use another warehouse, perform actions not dependent on that specific warehouse configuration, or resume activity once compute is available again. Containment should target the identity or authentication mechanism, not only the compute resource.