SnowPro Advanced: Security Engineer Question 368
Single answerUse Time Travel and Fail-safe to access historical states of dataA security engineer discovers that a privileged user accidentally dropped a sensitive audit table 2 days ago in a permanent schema. The table had a 3-day Time Travel retention period before it was dropped. Management wants the fastest recovery method that preserves the table's historical state and minimizes operational effort. What should the engineer do?
- A
Use UNDROP TABLE on the dropped table, because it is still within the Time Travel retention period.
- B
Open a Snowflake support case to restore the table from Fail-safe, because dropped objects can only be recovered through Fail-safe.
- C
Query the table using AT(OFFSET => -172800) to reconstruct the data, because Time Travel queries work even after the table is dropped.
- D
Clone the parent schema at a point before the drop, because cloning is the only supported method to recover dropped objects within Time Travel.
Show answer and explanation
Correct answer: A
Explanation
Snowflake provides two relevant historical recovery capabilities for permanent objects: Time Travel and Fail-safe. Time Travel allows access to historical data and supports operations such as querying, cloning, and undropping objects during the defined retention period. Because the table was dropped only 2 days ago and had a 3-day retention period, it remains recoverable through Time Travel. In this case, UNDROP TABLE is the fastest and lowest-effort option. Fail-safe is a separate 7-day period after Time Travel expires and is intended only for disaster recovery by Snowflake, typically through a support case; it is slower and not self-service. Snowflake documentation on Time Travel and Fail-safe emphasizes using Time Travel-based recovery first and reserving Fail-safe for exceptional situations after retention has elapsed.
- A. Correct.
Correct. For a dropped permanent table that is still within its Time Travel retention period, UNDROP TABLE is the fastest and most direct recovery method. Time Travel supports restoring dropped objects during the retention window, and UNDROP preserves the object without requiring manual reconstruction. This is the preferred operational approach when the object is still recoverable through Time Travel.
- B. Incorrect.
Incorrect. Fail-safe is not the first or fastest recovery mechanism when the object is still within Time Travel. Fail-safe applies only after the Time Travel retention period has expired, and recovery from Fail-safe requires Snowflake Support. It is intended as a last-resort data recovery mechanism, not for routine self-service restoration.
- C. Incorrect.
Incorrect. Time Travel queries such as AT or BEFORE are useful for accessing historical data states for existing objects, but once a table has been dropped, direct querying is not the appropriate recovery method for restoring the object itself. Within the retention window, UNDROP TABLE is the supported and simplest way to recover the dropped table.
- D. Incorrect.
Incorrect. Cloning a schema or database from a point in time can sometimes help recover prior states, but it is not the only supported method and is unnecessarily complex in this scenario. Since the requirement is to recover a single dropped table quickly and it is still within the Time Travel period, UNDROP TABLE is the more efficient and appropriate choice.