SnowPro Advanced: Security Engineer Question 366
Single answerACCOUNT_USAGE viewsA security engineer must build a daily audit process to identify which roles were granted to which users across the entire Snowflake account, including grants made in databases managed by other teams. The process must use a centrally available source rather than querying each database separately. The engineer plans to use Snowsight and SQL only. Which approach best meets the requirement?
- A
Query SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS and join it to SNOWFLAKE.ACCOUNT_USAGE.USERS and ROLES as needed, understanding that ACCOUNT_USAGE data can have latency.
- B
Query INFORMATION_SCHEMA.APPLICABLE_ROLES in every database because INFORMATION_SCHEMA provides an account-wide view with no latency.
- C
Query SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY because it records all privilege grants and revokes in near real time.
- D
Query SHOW GRANTS TO USER for each user and store the results permanently, because SHOW commands are the only source that includes role grants across the account.
Show answer and explanation
Correct answer: A
Explanation
For centralized auditing across an account, Snowflake's SNOWFLAKE.ACCOUNT_USAGE schema is the preferred source because it exposes account-level metadata views for governance, access review, and security reporting. In this scenario, the requirement is specifically to identify which roles were granted to which users without querying each database individually. GRANTS_TO_USERS is designed for that purpose. The main caveat is latency: ACCOUNT_USAGE views are not guaranteed to reflect changes immediately, so they are well suited to scheduled reporting such as daily audits rather than real-time enforcement workflows. INFORMATION_SCHEMA views and SHOW commands can be useful in narrower contexts, but they are less suitable for a centralized, scalable audit design. ACCESS_HISTORY is valuable for understanding data access patterns and query behavior, but it is not the authoritative source for role-assignment metadata. This aligns with Snowflake documentation on ACCOUNT_USAGE, which emphasizes account-level metadata reporting and notes potential data latency for these views.
- A. Correct.
Correct. SNOWFLAKE.ACCOUNT_USAGE provides centralized account-level metadata views intended for reporting and auditing use cases. GRANTS_TO_USERS is the appropriate source for role grants to users, and it can be joined with other ACCOUNT_USAGE views such as USERS and ROLES for richer reporting. A key operational consideration is that ACCOUNT_USAGE views are not strictly real time and can have latency, so a daily audit process is an appropriate fit.
- B. Incorrect.
Incorrect. INFORMATION_SCHEMA is not a centralized account-wide replacement for ACCOUNT_USAGE. INFORMATION_SCHEMA views are scoped differently and often tied to a specific database or session context. APPLICABLE_ROLES is not the right source for building a centralized historical audit of all user-role grants across the account, especially when the requirement is to avoid querying each database separately.
- C. Incorrect.
Incorrect. ACCESS_HISTORY is used to analyze object access and query activity, not to serve as the authoritative source for role grants to users. A common misconception is to treat all security-relevant events as queryable through ACCESS_HISTORY, but grants and role assignments are better sourced from dedicated metadata views such as GRANTS_TO_USERS and related ACCOUNT_USAGE views.
- D. Incorrect.
Incorrect. SHOW GRANTS TO USER can return useful current-state information, but using SHOW commands for every user is operationally cumbersome and does not satisfy the requirement for a centralized metadata source as cleanly as ACCOUNT_USAGE. SHOW outputs are also less convenient for standardized auditing pipelines than querying stable ACCOUNT_USAGE views.