SnowPro Advanced: Security Engineer Question 360
Single answerRestore data from backups, Time Travel, or Fail-safeA security engineer discovers that a production table containing audit evidence was accidentally dropped 3 days ago by an administrator. The table was a permanent table in an Enterprise Edition account and had not been recreated with the same name. Company policy requires the fastest recovery method that preserves the original data as it existed immediately before the drop, while minimizing manual reconstruction effort. What is the BEST action to restore the table?
- A
Use UNDROP TABLE on the dropped table, because the table is still within the Time Travel retention period for permanent objects.
- B
Recover the table from Fail-safe by opening a support case, because dropped tables can only be restored by Snowflake after 24 hours.
- C
Use a clone of the parent schema at a point before the drop, because UNDROP works only for schemas and databases, not individual tables.
- D
Restore the table from Snowflake-managed backups stored in internal stages, then recreate grants manually.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use UNDROP TABLE because the dropped object is still within Time Travel. For permanent tables, Time Travel enables restoring data and objects to a historical state, including recovery of dropped tables with UNDROP. In Enterprise Edition and higher, permanent objects can be configured for longer retention than the default 1 day available in Standard Edition, up to 90 days depending on settings. Fail-safe is a last-resort recovery window that begins only after Time Travel ends and is intended primarily for disaster recovery assistance by Snowflake, not routine self-service object restoration. Point-in-time cloning is useful in many recovery workflows, but it is not preferable when the object can be directly restored. This aligns with Snowflake documentation on Time Travel, UNDROP, object retention periods, and Fail-safe behavior.
- A. Correct.
Correct. In Enterprise Edition, permanent objects can have up to 90 days of Time Travel retention, subject to account/object settings. A table dropped 3 days ago is typically still recoverable using UNDROP TABLE, which is the fastest and most direct method when the object has not yet aged out of Time Travel. This preserves the dropped object without requiring reconstruction from another container or Snowflake intervention.
- B. Incorrect.
Incorrect. Fail-safe is not the first or best recovery option here. Fail-safe applies only after the Time Travel retention period has ended. Also, customer self-service recovery is not performed directly from Fail-safe; Snowflake may assist in limited recovery scenarios after Time Travel expires. Since the table was dropped only 3 days ago and Enterprise Edition supports longer Time Travel for permanent objects, UNDROP is the appropriate action.
- C. Incorrect.
Incorrect. Point-in-time cloning can be used for recovery scenarios, but this option is wrong because UNDROP absolutely does support individual tables. Cloning a schema from a prior point could recover the data, but it is not the best answer when a simple UNDROP TABLE can restore the original object more directly and with less effort.
- D. Incorrect.
Incorrect. Snowflake does not expose customer-operated restores from internal backup files in stages. This reflects a common misconception based on traditional database platforms. Snowflake manages storage durability and recovery mechanisms through features such as Time Travel and Fail-safe, not through user-accessible backup files for object-level restore.