SnowPro Advanced: Security Engineer Question 355
Single answerManage eradication and recovery:A Snowflake Security Engineer discovers that a compromised role dropped a critical table in the PROD database 20 minutes ago. The table must be restored as quickly as possible while preserving the current state of the rest of the database for ongoing workloads. The engineer also needs to support post-incident investigation to identify the role and user involved. Which action should the engineer take first to meet the recovery objective with the least disruption?
- A
Use Time Travel to recreate the dropped table from a point before the drop, then review QUERY_HISTORY and ACCESS_HISTORY to investigate who performed the action.
- B
Fail over the entire database to a secondary region so the dropped table is restored from replication, then query LOGIN_HISTORY to identify the actor.
- C
Restore the full account from Fail-safe because Fail-safe is designed for rapid self-service recovery of accidentally dropped objects, then review QUERY_HISTORY.
- D
Undrop the entire database to return all objects to their previous state, then compare current privileges to determine who dropped the table.
Show answer and explanation
Correct answer: A
Explanation
In Snowflake, the preferred recovery approach for a recently dropped object is to use Time Travel to restore just the affected object, provided the retention period has not expired. This minimizes blast radius and preserves unrelated changes in production. Fail-safe is only a Snowflake-managed recovery option after Time Travel is no longer available and is not intended for immediate self-service incident response. For investigation, Snowflake's account usage and information schema views such as QUERY_HISTORY help identify the statement, user, role, and timing associated with the destructive action; ACCESS_HISTORY can provide additional auditing context depending on edition and feature availability. This reflects a practical eradication and recovery workflow: contain the issue, restore the minimal necessary object, and gather forensic evidence from Snowflake audit metadata.
- A. Correct.
Correct. For an accidentally dropped table within the table's retention period, Time Travel is the fastest and least disruptive recovery method. The engineer can restore only the affected object, avoiding broader impact to PROD workloads. For investigation, QUERY_HISTORY can show the DROP statement and executing role/session context, while ACCESS_HISTORY can provide additional object access lineage details where available. This aligns with Snowflake best practices for targeted eradication and recovery after destructive actions.
- B. Incorrect.
Incorrect. Database failover/failover groups are for business continuity and disaster recovery scenarios, not the first-choice mechanism for restoring a single recently dropped table in the same account/region with minimal disruption. Failing over the database would be more disruptive than necessary and may introduce operational complexity. LOGIN_HISTORY may help correlate sign-ins, but it does not directly provide the object-level action details needed to confirm the DROP operation.
- C. Incorrect.
Incorrect. Fail-safe is not intended for rapid, self-service operational recovery. It is a Snowflake-managed last-resort recovery mechanism after Time Travel retention has expired, and customers cannot directly self-restore objects from Fail-safe on demand. Since the drop occurred only 20 minutes ago, Time Travel is the appropriate feature, not Fail-safe.
- D. Incorrect.
Incorrect. Undropping the entire database would be unnecessarily broad and disruptive when only one table was dropped. It could also conflict with ongoing legitimate changes made after the incident. The scenario specifically requires preserving the current state of the rest of the database, so object-level restoration is preferable. Reviewing current privileges also does not prove who executed the DROP statement.