SnowPro Advanced: Security Engineer Question 371
Single answerEstablish a chain of custody for evidenceA security engineer is investigating suspected misuse of a privileged Snowflake role. Legal counsel requires the team to preserve evidence and maintain a defensible chain of custody in case the incident leads to litigation. The engineer needs to collect query history and access-related evidence from Snowflake while minimizing the risk that the evidence is altered or challenged later. Which action should the engineer take FIRST to best establish a chain of custody for the evidence?
- A
Immediately export the relevant ACCOUNT_USAGE and INFORMATION_SCHEMA results to a controlled location, record who collected them and when, and generate integrity hashes for the exported files
- B
Grant additional administrators access to the Snowflake account so multiple team members can independently verify the evidence at the same time
- C
Update the retention settings for all Snowflake objects involved so the original rows cannot be changed during the investigation
- D
Rely on Snowsight history pages as the primary evidence source because they display query and login activity in the Snowflake UI
Show answer and explanation
Correct answer: A
Explanation
The best first step is to preserve relevant Snowflake evidence in a controlled repository and begin documenting custody immediately. In practice, this means querying authoritative sources such as SNOWFLAKE.ACCOUNT_USAGE views and other available history views, exporting the results, storing them with restricted access, and documenting who collected the data, when it was collected, the exact query or method used, and each subsequent transfer or access event. Applying file hashes supports integrity validation over time. Snowflake provides valuable metadata for investigations, but chain of custody is primarily a procedural and evidentiary discipline: preserve, document, restrict access, and verify integrity. Best practice is to use least privilege during incident response, avoid unnecessary access expansion, and treat UI-based views as supplemental rather than the sole preserved record. Relevant Snowflake documentation includes ACCOUNT_USAGE and organization/account history documentation, along with general security best practices for auditing and monitoring.
- A. Correct.
Correct. To establish a defensible chain of custody, the first priority is to preserve evidence in a controlled manner and document custody from the moment of collection. Exporting relevant evidence such as ACCOUNT_USAGE views, access history, query history, and related metadata to a controlled location creates a fixed snapshot for the investigation. Recording the collector, collection time, source query, and storage location supports traceability. Generating cryptographic hashes for the exported files helps demonstrate integrity by showing whether files changed after collection. This aligns with standard forensic practice even though Snowflake itself is not a dedicated evidence-management system.
- B. Incorrect.
Incorrect. Expanding administrative access weakens evidentiary control rather than strengthening it. A core principle of chain of custody is limiting access to only authorized personnel and documenting every transfer or handling event. Granting more administrators access increases the number of people who can potentially alter, delete, or mishandle evidence and makes the custody record harder to defend.
- C. Incorrect.
Incorrect. This may sound protective, but it does not address the immediate need to preserve and document evidence already present in system views or logs. Also, retention settings apply to data protection features such as Time Travel and Fail-safe for table data, not as a comprehensive evidence-preservation mechanism for all security-related metadata. Chain of custody requires documented collection, controlled storage, and integrity verification, not just changing retention settings.
- D. Incorrect.
Incorrect. Snowsight can be useful for investigation, but UI pages are not the strongest primary evidence source for a formal chain of custody. They are designed for operational visibility, not forensic preservation. A defensible process requires collecting underlying data in a controlled, reproducible manner, preserving it externally, and documenting handling. Screens viewed in the UI alone are harder to validate and reproduce than exported results with documented queries and integrity checks.