SnowPro Advanced: Security Engineer Question 404
Single answerMonitor container logsA security engineering team deployed a Snowpark Container Services service that processes sensitive files. During a suspected incident, the team needs to review recent container output to determine whether the application logged authentication failures or unexpected access attempts. The team wants to use Snowflake-native capabilities and maintain least-privilege access for the responder. Which action should the responder take to monitor the container logs for this service?
- A
Query the event table that is collecting Snowpark Container Services logs and filter for the target service and time range.
- B
Use QUERY_HISTORY to retrieve stdout and stderr emitted by the running containers.
- C
Run SHOW SERVICES and inspect the returned rows for the full application log output.
- D
Query ACCOUNT_USAGE.ACCESS_HISTORY to read the container log lines generated by the service.
Show answer and explanation
Correct answer: A
Explanation
For Snowpark Container Services, Snowflake-native monitoring of container logs is performed through event tables. When telemetry collection is configured, logs generated by containers are written to the event table, where responders can query them using SQL for investigations, troubleshooting, and security monitoring. This is the appropriate mechanism when a team needs to review recent application output such as authentication failures, errors, or suspicious access attempts. By contrast, QUERY_HISTORY is for SQL execution metadata, SHOW SERVICES is for object and runtime metadata, and ACCESS_HISTORY is for data access auditing rather than application log content. Best practice is to grant incident responders only the privileges needed to query the relevant event table and investigate the affected service.
- A. Correct.
Correct. Snowpark Container Services can emit logs and telemetry to an event table, which is the Snowflake-native mechanism for monitoring container logs. A responder with appropriate privileges can query the event table and filter on attributes such as service, container, severity, and timestamp to investigate recent activity. This aligns with operational monitoring and forensic review practices in Snowflake.
- B. Incorrect.
Incorrect. QUERY_HISTORY contains metadata about SQL statements executed in Snowflake, not the stdout or stderr log stream from containers running in Snowpark Container Services. Someone might choose this because QUERY_HISTORY is commonly used for troubleshooting SQL activity, but it is not the source for container application logs.
- C. Incorrect.
Incorrect. SHOW SERVICES returns service metadata and status information, such as definitions and runtime state, but it does not provide the full application log stream. This is a plausible distractor because administrators often use SHOW commands to inspect deployed objects, yet log monitoring requires the event table rather than object metadata output.
- D. Incorrect.
Incorrect. ACCESS_HISTORY is designed for auditing data access patterns, including how objects were accessed, but it does not store arbitrary application log lines from containers. A candidate might confuse security auditing with operational logging, but container logs are monitored through event tables, not ACCESS_HISTORY.