SnowPro Advanced: Security Engineer Question 401
Single answerUse the SERVICE_USAGE_HISTORY and compute pool monitoring viewsA security engineering team is investigating a cost spike and possible unauthorized use of Snowpark Container Services in a production account. They need to determine which service consumed the most compute over the last 24 hours and whether the underlying compute pool experienced scaling or state changes during that same period. The team wants to use built-in account telemetry rather than application logs. Which approach best meets this requirement?
- A
Query SERVICE_USAGE_HISTORY to identify per-service resource consumption, and correlate the results with compute pool monitoring views that show pool state and scaling activity during the same time window.
- B
Query ACCESS_HISTORY to identify which service consumed the most compute, and use LOGIN_HISTORY to determine whether the compute pool auto-scaled during the period.
- C
Query QUERY_HISTORY to identify container service compute consumption, and use WAREHOUSE_METERING_HISTORY to determine compute pool resizing events.
- D
Query SERVICE_USAGE_HISTORY only, because it includes both per-service usage details and complete compute pool lifecycle and scaling history.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use SERVICE_USAGE_HISTORY together with compute pool monitoring views. In Snowflake, service usage telemetry and compute pool operational telemetry are related but distinct. SERVICE_USAGE_HISTORY helps determine how much compute or resource consumption is attributable to individual services. Compute pool monitoring views are then used to inspect the behavior of the underlying compute pool, including state and scaling-related activity during the same investigation window. This is the most practical and accurate approach for a security engineer investigating suspicious or unexpected Snowpark Container Services usage. Best practice is to correlate multiple account usage and monitoring sources rather than relying on application logs or warehouse-centric views. Snowflake documentation for Snowpark Container Services and Account Usage/monitoring views describes these as separate telemetry sources for service usage versus compute pool operations.
- A. Correct.
Correct. SERVICE_USAGE_HISTORY is intended to analyze usage for services, including resource consumption for Snowpark Container Services. To understand what happened at the compute pool layer, you would correlate that data with the compute pool monitoring views, which expose operational details such as pool status and scaling-related behavior. This combination directly addresses both parts of the requirement: identifying the highest-consuming service and validating pool activity in the same time range.
- B. Incorrect.
Incorrect. ACCESS_HISTORY tracks object access for governance and auditing, not container service compute consumption. LOGIN_HISTORY records authentication events, not compute pool scaling or lifecycle details. These views are useful for security investigations in other contexts, but they do not answer this operational usage question.
- C. Incorrect.
Incorrect. QUERY_HISTORY is focused on SQL statement execution and is not the authoritative source for Snowpark Container Services resource consumption. WAREHOUSE_METERING_HISTORY applies to virtual warehouses, not compute pools used by Snowpark Container Services. This option reflects a common misconception of treating compute pools like warehouses.
- D. Incorrect.
Incorrect. SERVICE_USAGE_HISTORY helps identify service-level usage, but it does not replace compute pool monitoring views for detailed pool operational telemetry such as state transitions or scaling activity. Relying on SERVICE_USAGE_HISTORY alone would leave the team without the pool-level evidence requested in the scenario.