SnowPro Advanced: Security Engineer Question 364
Select 2Collect and preserve relevant logs and data:A Snowflake Security Engineer is responding to a suspected insider data exfiltration incident. The legal team requires the engineer to quickly collect evidence showing who accessed sensitive objects, what SQL was executed, and preserve the evidence in a way that minimizes loss from retention limits. Which TWO actions should the engineer take first?
- A
Query the ACCOUNT_USAGE views such as QUERY_HISTORY, ACCESS_HISTORY, LOGIN_HISTORY, and GRANTS_TO_USERS, then copy the relevant results into controlled incident-response tables for preservation.
- B
Rely only on the Snowsight History page and manually export screenshots because screenshots are sufficient forensic evidence and are not subject to retention constraints.
- C
Immediately create an unmanaged external stage and unload all database tables, because table data export is the primary source needed to prove access activity.
- D
Use INFORMATION_SCHEMA table functions for recent activity if needed for faster availability, and persist the results promptly because different metadata sources have different latency and retention characteristics.
- E
Rotate all user passwords first and skip evidence collection until containment is complete, because Snowflake metadata will remain indefinitely available in the account.
Show answer and explanation
Correct answers: A, D
Explanation
The best answer is to collect Snowflake audit and activity metadata from the appropriate system sources and preserve it immediately in a controlled repository. In Snowflake, incident responders commonly use ORGANIZATION/ACCOUNT-level metadata where available, especially ACCOUNT_USAGE views and INFORMATION_SCHEMA table functions, to reconstruct events such as logins, query execution, object access, and privilege assignments. A practical challenge is that these sources differ in latency and retention. INFORMATION_SCHEMA table functions can help with more recent activity, while ACCOUNT_USAGE provides broad historical metadata but may not be immediate. Because these logs are not kept forever and some have specific retention windows, responders should promptly copy relevant evidence into incident tables or another governed evidence store. This aligns with Snowflake best practices around using QUERY_HISTORY, LOGIN_HISTORY, ACCESS_HISTORY, and grant-related metadata for investigation, while avoiding overreliance on UI-only artifacts or unnecessary full data exports.
- A. Correct.
Correct. For an incident involving suspected misuse, the engineer should collect authoritative Snowflake metadata that shows authentication, object access, grants, and executed queries. ACCOUNT_USAGE provides key views such as QUERY_HISTORY, LOGIN_HISTORY, ACCESS_HISTORY, and privilege-related views including GRANTS_TO_USERS. Because Snowflake metadata has retention windows and some views can have latency, best practice is to extract and preserve relevant results in dedicated incident-response tables or another controlled repository as soon as possible.
- B. Incorrect.
Incorrect. Snowsight can be useful for investigation, but screenshots are not a complete or reliable preservation strategy. They are hard to search, incomplete for large result sets, and do not replace structured log collection. Snowflake forensic work should prioritize system metadata views/functions and preservation of queryable evidence rather than relying only on UI screenshots.
- C. Incorrect.
Incorrect. Unloading all database tables focuses on data content, not audit evidence. In this scenario, the immediate need is to prove who accessed what and what statements were run. Exporting entire tables may be unnecessary, expensive, and may even expand the scope of sensitive data handling. It does not replace collection of access, login, and query metadata.
- D. Correct.
Correct. INFORMATION_SCHEMA table functions such as QUERY_HISTORY and LOGIN_HISTORY can be useful for near-real-time investigation because some ACCOUNT_USAGE views have latency. Since Snowflake metadata sources differ in freshness and retention, a strong response pattern is to gather recent evidence from INFORMATION_SCHEMA when needed, then persist the results promptly into controlled storage for preservation and later analysis.
- E. Incorrect.
Incorrect. Containment actions may be necessary, but the statement is wrong because Snowflake metadata is not retained indefinitely. Delaying evidence collection risks losing relevant records due to retention limits. A disciplined incident response balances containment with prompt evidence preservation, especially for query, login, and access history.