SnowPro Advanced: Security Engineer Question 354
Single answerManage eradication and recovery:A security engineer confirms that a compromised role dropped several production tables in the SALES schema about 45 minutes ago. The incident has been contained by disabling the affected user and rotating credentials. Business users need the data restored as quickly as possible, but the engineer must avoid reintroducing any unauthorized changes that may have occurred after the attack began. Which action is the most appropriate recovery approach in Snowflake?
- A
Use Time Travel to restore only the affected tables in the SALES schema to a point just before the tables were dropped, after validating the recovery timestamp.
- B
Fail over the database to a replica in another region because replication is the primary mechanism for recovering dropped objects after a security incident.
- C
Undrop the entire database immediately, because undrop is the safest way to recover all objects without choosing a timestamp.
- D
Clone the current compromised schema and replace production with the clone, because zero-copy cloning automatically removes malicious changes made by the attacker.
Show answer and explanation
Correct answer: A
Explanation
For eradication and recovery in Snowflake, the first priority is containment, followed by restoring data from a known-good point with the least disruptive and most targeted method possible. Since the issue is dropped tables discovered within the retention window, Snowflake Time Travel is the best fit for recovering objects to an earlier state. In practice, a security engineer should identify the incident timeline, confirm the last known good timestamp, and then restore only the affected objects rather than taking a broad recovery action. UNDROP can also be useful for dropped objects, but the scenario emphasizes avoiding reintroducing unauthorized changes and restoring only what is necessary, which makes a validated point-in-time recovery approach more appropriate. Replication/failover addresses availability and disaster recovery, not selective object-level recovery from malicious changes. Zero-copy cloning is valuable for testing and investigation, but cloning a compromised object does not remove malicious modifications. These approaches align with Snowflake best practices around Time Travel, UNDROP, cloning, and replication/failover capabilities documented in Snowflake product documentation.
- A. Correct.
Correct. When specific objects were dropped and the organization wants targeted recovery without replaying all changes, Time Travel is the appropriate Snowflake capability. The engineer should identify a timestamp just before the malicious action and restore only the affected tables. This supports recovery while minimizing the risk of reintroducing unwanted changes from the broader environment. Validating the timestamp is important in an incident because recovery should be aligned to the last known good state.
- B. Incorrect.
Incorrect. Replication and failover are intended for business continuity and disaster recovery scenarios, such as region or account unavailability, not as the primary tool for selectively recovering dropped objects after a security incident. In addition, a replica may contain the same dropped-object state depending on replication timing, and failover is a much broader action than required here.
- C. Incorrect.
Incorrect. UNDROP can recover dropped objects within retention limits, but undropping the entire database is unnecessarily broad when only several tables in one schema were affected. It may also restore more than intended and complicate incident recovery if other changes occurred after the compromise began. Targeted object recovery is more appropriate.
- D. Incorrect.
Incorrect. Zero-copy cloning preserves the state of the source object at the time of cloning; it does not sanitize or remove malicious changes already present in the source. Cloning the currently compromised schema would likely copy the unwanted state, so it is not an eradication or recovery mechanism by itself.