SnowPro Advanced: Security Engineer Question 362
Single answer4.4 Conduct a post-security-incident forensic analysis.A Snowflake security engineer is investigating a suspected data exfiltration incident. An analyst reports that a contractor account may have queried sensitive customer tables and then copied results out of Snowflake late last night. The account has already been disabled, but leadership wants a forensic timeline showing what the user actually did, including the SQL executed, whether any data was unloaded, and what client connection details were used. Which action would provide the most complete and reliable evidence for this post-incident analysis?
- A
Query the ACCOUNT_USAGE views such as QUERY_HISTORY, ACCESS_HISTORY, LOGIN_HISTORY, and COPY_HISTORY, and correlate them by user, time window, and query identifiers
- B
Review only the INFORMATION_SCHEMA.QUERY_HISTORY table function because it contains all historical login, access, and data unloading details needed for a forensic investigation
- C
Inspect the current grants on the contractor's role to determine which objects could have been accessed, and use that alone to reconstruct what data was actually queried and exported
- D
Use the Snowsight query profile for the last statement run by the user, because it is the authoritative source for all prior statements, login origins, and unload activity
Show answer and explanation
Correct answer: A
Explanation
In Snowflake, post-incident forensic analysis should focus on account telemetry that records actual events rather than inferred capability. Best practice is to correlate ACCOUNT_USAGE and related history sources: QUERY_HISTORY for executed SQL, ACCESS_HISTORY for data object access lineage, LOGIN_HISTORY for authentication and connection context, and COPY_HISTORY to investigate unload activity such as COPY INTO
- A. Correct.
Correct. For post-security-incident forensic analysis in Snowflake, the most complete evidence comes from correlating multiple account-level telemetry sources. QUERY_HISTORY helps identify the SQL statements executed and timing. ACCESS_HISTORY can show base objects accessed by queries, which is especially valuable when views were involved. LOGIN_HISTORY provides client IP and connection/login details. COPY_HISTORY can help determine whether data was unloaded using COPY INTO commands. Using these together is the best way to build a defensible forensic timeline.
- B. Incorrect.
Incorrect. INFORMATION_SCHEMA query history functions are useful for recent query activity, but they do not by themselves provide the full forensic picture. They do not replace LOGIN_HISTORY for authentication details, ACCESS_HISTORY for object-level lineage/access visibility, or COPY_HISTORY for unload tracking. Relying on only QUERY_HISTORY is a common mistake because executed SQL alone may not fully show what underlying objects were accessed or whether a data unload occurred.
- C. Incorrect.
Incorrect. Reviewing grants can show what the user was allowed to do, but permissions do not prove what the user actually did. Forensics requires evidence of actual activity, not just theoretical access. A role may have had broad privileges that were never exercised, and conversely inherited privileges may complicate interpretation. This option reflects the misconception that authorization state is sufficient to reconstruct actions.
- D. Incorrect.
Incorrect. Query Profile is useful for analyzing an individual query's execution characteristics, but it is not the authoritative source for comprehensive forensic reconstruction across prior sessions, login events, and unload operations. It does not replace account usage views for historical investigation and is too narrow for building an incident timeline.