SnowPro Advanced: Security Engineer Question 359
Select 2Remove any malicious access or persisting mechanismsA Snowflake security engineer is responding to an incident in which a compromised ACCOUNTADMIN session was used to create long-term access for an attacker. Initial review shows that, within the last hour, the attacker created a new user named ETL_SUPPORT, granted it powerful roles, generated an RSA public key for key-pair authentication on that user, and created a network policy that allows connections from the attacker's IP range. The engineer's immediate objective is to remove malicious access and persistence while minimizing impact on legitimate users. Which TWO actions should the engineer take first?
- A
Disable or lock the ETL_SUPPORT user, revoke the roles granted to it, and remove the user's configured public key
- B
Drop the suspicious network policy or remove the attacker-controlled IP range, and verify whether it is assigned at the account, user, or security integration level
- C
Rotate every user's password in the account before changing any roles or network policies
- D
Suspend all warehouses in the account so the attacker can no longer query data
- E
Transfer ownership of the ETL_SUPPORT user to SYSADMIN so the user can be reviewed later without breaking access
Show answer and explanation
Correct answers: A, B
Explanation
The question focuses on immediate remediation of malicious access and persistence in Snowflake after a privileged compromise. In this scenario, the attacker established persistence through three common mechanisms: a new user, privileged role grants, and key-pair authentication, plus a network policy that preserves allowed connectivity from attacker-controlled IP space. The most effective first actions are to contain the malicious identity and remove the malicious network path. In Snowflake, responders should quickly disable or lock suspicious users, revoke inappropriate grants, and remove authentication artifacts such as RSA public keys when key-pair authentication was configured for persistence. They should also inspect and correct network policies, including where those policies are applied. Actions like mass password resets or warehouse suspension may be considered later depending on scope, but they are not the most direct steps to remove the persistence mechanisms described. This aligns with Snowflake security administration best practices around user management, role grants, key-pair authentication, and network policy administration.
- A. Correct.
Correct. If a malicious user was created for persistence, the fastest containment step is to disable or lock that user and remove the privileges that make it useful. Because the attacker configured key-pair authentication, removing or unsetting the user's RSA public key is also important to eliminate that login path. This directly addresses both unauthorized access and persistence.
- B. Correct.
Correct. A malicious network policy can be used to preserve attacker connectivity or bypass intended source restrictions. The engineer should remove the suspicious policy or the attacker IP entries and confirm where the policy is attached, since Snowflake network policies can be associated in different contexts. This removes an additional persistence mechanism without broadly disrupting legitimate authentication methods.
- C. Incorrect.
Incorrect. Password rotation may be necessary later in the incident response process, especially for compromised credentials, but it is not the most immediate step for the scenario described. The persistence mechanisms identified are a newly created user, assigned roles, a configured public key, and a malicious network policy. Rotating every user's password first is overly broad and delays direct containment.
- D. Incorrect.
Incorrect. Suspending warehouses can reduce query execution, but it does not remove the attacker's ability to authenticate, maintain access, or continue administrative changes. The attacker could still log in and modify security objects if their access remains active. This is a disruptive containment measure that does not directly address the persistence mechanisms in the scenario.
- E. Incorrect.
Incorrect. Changing ownership of the suspicious user does not meaningfully remove access or persistence. The malicious user could still exist with valid authentication settings unless it is disabled and its privileges are revoked. This option reflects a governance or review action, not an immediate containment step.