SnowPro Advanced: Security Engineer Question 365
Single answerCollect and preserve relevant logs and data:A Snowflake Security Engineer is responding to a suspected data exfiltration incident involving a privileged user account. The incident response team needs evidence that can be retained for longer than the standard metadata retention period and reviewed by investigators who should not require broad ACCOUNTADMIN access. Which approach BEST supports collecting and preserving the relevant Snowflake logs and activity data for this investigation?
- A
Create a dedicated forensic schema and regularly copy relevant records from ACCOUNT_USAGE views such as QUERY_HISTORY, LOGIN_HISTORY, ACCESS_HISTORY, and GRANTS_TO_USERS into permanent tables with restricted access for investigators.
- B
Rely on the Snowsight History pages because they display recent query and login activity and can be accessed interactively during the investigation.
- C
Increase Time Travel retention on the affected databases so account-level login and query metadata will be preserved indefinitely for the incident response team.
- D
Clone the production database immediately because the clone will include all historical ACCOUNT_USAGE and login metadata needed for the investigation.
- E
Export only the current user definitions and role grants, because these objects are sufficient to reconstruct what queries were run and what data was accessed.
Show answer and explanation
Correct answer: A
Explanation
The best practice is to preserve relevant telemetry by extracting needed records from Snowflake metadata sources into controlled permanent tables for forensic retention and least-privilege review. For security investigations, Snowflake's ACCOUNT_USAGE schema and related usage/history views are key sources for evidence, including login events, executed queries, grants, and object access details where available. This approach addresses two core requirements in the scenario: retaining evidence longer than standard metadata availability and allowing investigators to review evidence without broad administrative privileges. By contrast, Snowsight is useful for viewing but not preserving evidence, Time Travel does not apply to account usage logs, and cloning data objects does not capture account-level telemetry. This aligns with Snowflake documentation and operational best practices around using ACCOUNT_USAGE/usage views for auditing and building internal retention processes for security logs.
- A. Correct.
Correct. A defensible investigation typically requires preserving evidence beyond the default retention window of Snowflake metadata views. ACCOUNT_USAGE provides account-level telemetry such as query, login, grant, and in many editions/access configurations, object access activity through views like QUERY_HISTORY, LOGIN_HISTORY, GRANTS_TO_USERS, and ACCESS_HISTORY. Copying the relevant rows into permanent tables in a locked-down forensic area preserves evidence for longer-term analysis and allows least-privilege access for investigators without giving them broad administrative rights.
- B. Incorrect.
Incorrect. Snowsight History is useful for interactive review, but it is not a preservation strategy. It does not create a durable forensic copy under the organization's control, and relying on UI pages alone is weak for incident response, chain-of-custody, and extended retention needs.
- C. Incorrect.
Incorrect. Time Travel applies to Snowflake data objects such as tables, schemas, and databases, not to account usage metadata like login history or query history. Increasing Time Travel retention will not preserve account-level activity logs indefinitely.
- D. Incorrect.
Incorrect. Cloning a database preserves the state of database objects at a point in time, but ACCOUNT_USAGE, LOGIN_HISTORY, and similar account-level metadata are not captured by cloning a user database. This is a common misconception because cloning is powerful for data recovery, but it is not a substitute for preserving security telemetry.
- E. Incorrect.
Incorrect. User definitions and role grants can help investigators understand permissions and privilege posture, but they are not enough to reconstruct actual activity. Incident response requires evidence of what happened, such as successful logins, executed statements, and accessed objects, not just the current security configuration.