SnowPro Advanced: Security Engineer Question 363
Single answer4.4 Conduct a post-security-incident forensic analysis.A security team discovers that a contractor account may have queried sensitive customer data from a Snowflake production environment over the weekend. The account has already been disabled, and leadership wants a post-incident forensic analysis to determine exactly what objects were accessed, what SQL statements were run, and whether any query results were likely downloaded by the user. Which approach should the security engineer take to obtain the most reliable evidence from Snowflake?
- A
Query ACCOUNT_USAGE views such as QUERY_HISTORY, ACCESS_HISTORY, and LOGIN_HISTORY to reconstruct the user's activity, correlate queries to objects accessed, and review data transfer indicators where available.
- B
Use Time Travel on the affected tables to identify the user who queried the data and confirm whether result sets were exported from Snowflake.
- C
Review only the INFORMATION_SCHEMA.QUERY_HISTORY table function in each database because it provides a permanent forensic record of all user activity in the account.
- D
Restore the contractor's role grants and re-enable the user temporarily so the security team can reproduce the session and inspect the user's query result cache.
Show answer and explanation
Correct answer: A
Explanation
The strongest Snowflake-native approach for post-security-incident forensic analysis is to correlate account usage telemetry rather than rely on data recovery features or attempt to reproduce the event. In practice, investigators should review QUERY_HISTORY for executed SQL, ACCESS_HISTORY to identify which underlying objects were touched by those queries, and LOGIN_HISTORY for authentication and connection context. This aligns with Snowflake best practices for monitoring and auditing activity through ACCOUNT_USAGE and related history views. Candidates should also remember the distinction between operational metadata sources and forensic/audit sources: Time Travel supports historical data access, not user attribution, and INFORMATION_SCHEMA history functions are not a substitute for broader account-level audit analysis. Documentation areas typically relevant here include Snowflake Account Usage views, Access History, Query History, and Login History.
- A. Correct.
Correct. For post-incident forensic analysis in Snowflake, the most appropriate approach is to use the account-level telemetry available in ACCOUNT_USAGE and related history sources. QUERY_HISTORY helps identify the SQL statements executed, LOGIN_HISTORY helps validate authentication and session timing details, and ACCESS_HISTORY is critical for understanding which base objects were directly or indirectly accessed by those queries. Together, these views provide the best supported evidence trail for reconstructing user behavior after an incident. Depending on account features and telemetry available, query and session metadata can also help infer whether data was likely transferred or retrieved.
- B. Incorrect.
Incorrect. Time Travel is designed to access historical table data versions, not to determine which user queried an object or whether results were downloaded. It can help inspect prior data states, but it is not the primary forensic source for user activity reconstruction. This option reflects the misconception that data recovery features also provide audit attribution.
- C. Incorrect.
Incorrect. INFORMATION_SCHEMA table functions can be useful for recent operational monitoring, but they are not the best source for comprehensive forensic analysis across the account. They are scoped more narrowly and are not a permanent, account-wide forensic record. ACCOUNT_USAGE views are generally the more appropriate source for account-level auditing and investigation over time, subject to their documented latency and retention characteristics.
- D. Incorrect.
Incorrect. Re-enabling the compromised or suspect identity to reproduce activity is not a sound forensic practice and can increase risk. Query result caches and sessions cannot be reliably reconstructed this way for evidentiary purposes. Best practice is to preserve and analyze existing audit metadata rather than recreate access under the same identity.