SnowPro Advanced: Security Engineer Question 345
Single answerTriage incoming alertsA Snowflake Security Engineer receives an alert from the SOC that a service account used by a BI tool executed several DDL statements at 2:15 AM, outside its normal query pattern. The SOC needs a quick determination of whether this is likely malicious or a scheduled deployment. Which action should the engineer take FIRST to triage the alert using Snowflake-native telemetry?
- A
Query ACCOUNT_USAGE.QUERY_HISTORY for the service account and time window, then correlate the statements with LOGIN_HISTORY and role context to verify source, session details, and whether the activity aligns with expected automation
- B
Immediately rotate the BI tool service account password and revoke all privileges from the account before gathering any additional evidence
- C
Review WAREHOUSE_METERING_HISTORY to determine whether the warehouse consumed more credits than usual during the alert window
- D
Query TABLE_STORAGE_METRICS to identify which tables grew in size after the DDL statements completed
Show answer and explanation
Correct answer: A
Explanation
Effective alert triage in Snowflake starts with validating the alert against system telemetry, then building enough context to decide whether to close, escalate, or contain. For unusual SQL activity, the most relevant native sources are query history and authentication/session-related history. QUERY_HISTORY in SNOWFLAKE.ACCOUNT_USAGE is commonly used to inspect executed SQL text, timestamps, user, role, warehouse, and affected objects. LOGIN_HISTORY helps determine whether the account authenticated from an expected source and time. Together, these views support a fast determination of whether activity matches known automation or indicates suspicious behavior. Best practice is to gather evidence first, then move to containment if needed. Usage and storage views such as WAREHOUSE_METERING_HISTORY or TABLE_STORAGE_METRICS may help assess impact later, but they are not the primary tools for first-pass security triage.
- A. Correct.
Correct. The first step in triaging an alert is to validate the event with authoritative telemetry and establish context. QUERY_HISTORY helps confirm exactly which DDL statements ran, when they ran, which user and role executed them, and what objects were affected. Correlating this with LOGIN_HISTORY and session context helps determine whether the activity came from an expected source, such as a scheduled job, connector, or known IP/client, versus an anomalous sign-in pattern. This is the most appropriate first action because it supports evidence-based triage before containment or escalation.
- B. Incorrect.
Incorrect. Rotating credentials and revoking privileges may be valid containment steps if compromise is confirmed or strongly suspected, but they are not the best first step for triage. Acting before collecting basic evidence can disrupt legitimate scheduled processes and make investigation harder. The question asks for the initial triage action using Snowflake-native telemetry, so evidence collection and correlation should come first.
- C. Incorrect.
Incorrect. WAREHOUSE_METERING_HISTORY is useful for cost and usage analysis, but it does not directly answer whether the DDL statements were legitimate or malicious. Credit usage might help as a secondary signal, but it is not the most relevant telemetry for determining who executed the DDL, from where, and under what role or session context.
- D. Incorrect.
Incorrect. TABLE_STORAGE_METRICS can help assess downstream impact, such as growth in table storage over time, but it is not the right first step for triaging an incoming alert about unusual DDL execution. The urgent need is to validate the actor, session, timing, and statement details, which are better addressed through query and login history.