SnowPro Advanced: Security Engineer Question 422
Single answerInterpret traces to debug and audit the flow of sensitive data through Gen AI applicationsA security engineering team is reviewing a Cortex AI application built in Snowflake that summarizes customer support cases. The app uses a prompt template that includes case text, account metadata, and recent order notes. During testing, an analyst suspects that personally identifiable information (PII) from the order notes is being sent to the model even when those fields should have been masked before inference. The team needs to determine exactly which prompt-construction step introduced the sensitive values and preserve an auditable record for investigation. Which approach is the MOST appropriate?
- A
Inspect the application's trace data to review the sequence of Gen AI operations, including prompt-building steps and inputs/outputs at each stage, and correlate the span where unmasked order-note data first appears.
- B
Query ACCESS_HISTORY to identify which columns were selected by the application, because ACCESS_HISTORY will show the exact prompt text and model payload that was sent during inference.
- C
Review QUERY_HISTORY only, because SQL text alone is sufficient to reconstruct the full prompt and determine whether masked values were exposed to the model.
- D
Enable a masking policy on the final model response table only, because if sensitive data is hidden in stored outputs there is no need to trace earlier prompt assembly steps.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use trace data to inspect the Gen AI application's execution flow and determine where sensitive data first entered the prompt. In Snowflake security practice, query-level and object-level audit sources such as QUERY_HISTORY and ACCESS_HISTORY are useful, but they answer different questions: what SQL ran, and what data objects were accessed. They are not the primary mechanism for understanding step-by-step Gen AI application behavior, especially when investigating prompt composition, tool calls, or intermediate transformations. Traces are intended for observability and debugging across application components, making them the most appropriate source when you need to interpret execution flow and audit the handling of sensitive data in AI workflows. Best practice is to combine traces with standard governance controls such as masking policies, role-based access control, and audit views, but use traces to pinpoint the runtime stage where a privacy control failed or was bypassed.
- A. Correct.
Correct. For debugging and auditing Gen AI application behavior, trace data is the most appropriate source because it is designed to show the flow across application steps. In a Gen AI pipeline, traces can capture spans for prompt assembly, tool execution, model invocation, and related operations. Reviewing those spans lets the team identify where sensitive values first appeared and preserve an auditable path of execution. This is exactly the type of investigation traces support: understanding runtime flow rather than only static SQL access.
- B. Incorrect.
Incorrect. ACCESS_HISTORY is valuable for auditing object and column access, and it can help identify whether sensitive columns were queried. However, it does not provide a full reconstruction of the prompt-building workflow or the exact intermediate Gen AI application steps. A candidate might choose this because it is a standard Snowflake audit source, but it is not the best tool for locating the specific prompt-construction stage where unmasked data was introduced.
- C. Incorrect.
Incorrect. QUERY_HISTORY can show executed SQL statements, which may help identify source queries or UDF/procedure invocations. But SQL text alone is typically not enough to reconstruct end-to-end Gen AI execution, especially when prompts are assembled across multiple steps or application layers. It also does not provide the same operation-by-operation observability as traces.
- D. Incorrect.
Incorrect. Masking only the final stored output addresses one exposure point but does not help determine whether sensitive data was already sent to the model during prompt construction. The scenario requires root-cause analysis and auditability of the data flow through the Gen AI application, which means earlier stages must be examined. This option reflects the misconception that downstream masking alone is sufficient for Gen AI security investigations.