SnowPro Advanced: Security Engineer Question 346
Single answerIsolate affected user accountsA Snowflake security engineer discovers that a contractor's Snowflake user credentials may have been exposed in a public code repository. The contractor uses Snowsight and programmatic access for automated data exports. The incident response priority is to immediately isolate the affected account to stop any further access while preserving the user object and audit history for investigation. Which action should the engineer take first?
- A
Execute ALTER USER
SET DISABLED = TRUE; - B
Execute DROP USER
; - C
Rotate the user's password and wait for the current sessions to expire naturally;
- D
Revoke all roles currently granted to the user;
Show answer and explanation
Correct answer: A
Explanation
For a potentially compromised Snowflake account, the most appropriate immediate containment step is to disable the user with ALTER USER ... SET DISABLED = TRUE. This isolates the affected account while preserving the user object, grants, and audit history for review. In contrast, DROP USER is unnecessarily destructive for initial containment, and revoking roles or rotating a password may be part of follow-up remediation but do not provide the same immediate, account-level isolation. Snowflake security administration guidance supports using user-level controls such as ALTER USER for account management and containment during security response.
- A. Correct.
Correct. Setting the user to DISABLED immediately prevents the user from authenticating, which is the appropriate first step to isolate a potentially compromised account while preserving the account for investigation and later remediation. This approach is aligned with incident response best practices because it contains access without deleting evidence or relying on slower remediation steps.
- B. Incorrect.
Incorrect. Dropping the user is destructive and not the best first action in an incident. It can interfere with investigation, remove the user object, and complicate restoration of legitimate access later. Isolation should preserve forensic and administrative context wherever possible.
- C. Incorrect.
Incorrect. Rotating the password may help if only the password was exposed, but it does not address all access paths consistently, especially if the user also uses other authentication methods or existing access mechanisms. It is also slower and less definitive than disabling the user as an immediate containment measure.
- D. Incorrect.
Incorrect. Revoking roles reduces privileges, but it is not the best first step for immediate isolation. The user account still exists and may still be able to authenticate. In an active compromise scenario, stopping access at the account level is the stronger and more direct containment action.