SnowPro Advanced: Security Engineer Question 342
Single answerInvestigate alerts from security toolsA Snowflake security engineer receives an alert from the organization’s SIEM indicating that a service account executed a large number of failed login attempts, followed by a successful connection from an unfamiliar IP address. The engineer needs to quickly determine whether the alert indicates credential abuse and identify the SQL activity performed after the successful login. Which Snowflake-native approach is the MOST appropriate to investigate this incident?
- A
Query ACCOUNT_USAGE.LOGIN_HISTORY to review failed and successful authentication events for the user, then correlate the session with ACCOUNT_USAGE.QUERY_HISTORY to inspect the SQL statements executed after the login
- B
Query ACCOUNT_USAGE.ACCESS_HISTORY only, because it contains both authentication events and every login failure needed to confirm credential abuse
- C
Use DESCRIBE USER on the service account to identify the last login IP address and the statements executed during the session
- D
Query INFORMATION_SCHEMA.TABLE_PRIVILEGES to determine whether the unfamiliar IP address had permission to connect, then use SHOW GRANTS TO USER to identify the executed SQL statements
Show answer and explanation
Correct answer: A
Explanation
For a suspicious-login alert, the investigator should first validate the authentication pattern using Snowflake login telemetry, then pivot to workload telemetry to understand impact. In Snowflake, ACCOUNT_USAGE.LOGIN_HISTORY is the appropriate source for reviewing login attempts and successful authentications. After identifying the relevant successful login, ACCOUNT_USAGE.QUERY_HISTORY is the best source to inspect SQL statements executed during or after that session. ACCESS_HISTORY can be useful later for deeper analysis of which objects were accessed by specific queries, but it is not the primary source for authentication events. This aligns with Snowflake best practices of using account usage views for auditing and investigation, especially LOGIN_HISTORY for sign-in activity and QUERY_HISTORY for statement execution analysis.
- A. Correct.
Correct. LOGIN_HISTORY in Snowflake account usage is the appropriate source to investigate authentication activity such as failed and successful logins, including details useful for incident review. To determine what happened after the successful authentication, correlating to QUERY_HISTORY is the right next step because it captures SQL statements executed in sessions. This is the most direct Snowflake-native workflow for validating a SIEM alert about suspicious logins followed by activity.
- B. Incorrect.
Incorrect. ACCESS_HISTORY is used to analyze data access lineage and object-level access for queries, not to review authentication events such as login failures and successes. A candidate might choose this because it is a security-focused view, but it does not replace LOGIN_HISTORY for authentication investigation.
- C. Incorrect.
Incorrect. DESCRIBE USER returns metadata about the user object, such as properties and configuration, but it does not provide session-by-session login history or executed statements. This option reflects a common misconception that user metadata includes operational audit details.
- D. Incorrect.
Incorrect. TABLE_PRIVILEGES and SHOW GRANTS TO USER help review authorization and object privileges, not whether an IP address was permitted to authenticate or what SQL was executed in a session. This distractor targets confusion between access control configuration and security event investigation.