SnowPro Advanced: Security Engineer Question 425
Select 3Monitor AI application performance metrics related to security and data qualityA security engineering team is operating an AI-powered internal support assistant built on Snowflake data. The model uses curated tables that contain employee support history, but the team must continuously monitor for security and data quality issues such as unexpected exposure of sensitive values, prompt/output anomalies, and degraded response quality caused by bad source data. The team wants a Snowflake-native approach that provides measurable oversight and supports investigation over time. Which TWO actions should the team take?
- A
Create monitoring queries and dashboards over AI-related application logs and source-table quality indicators, using Snowflake event/log data where available and data profiling checks on the underlying tables.
- B
Rely only on model latency and token usage metrics, because those are the primary indicators of AI security and data quality problems in production.
- C
Track source data drift and null/outlier rates in the tables feeding the AI application, and correlate those signals with changes in AI output quality or policy violations.
- D
Disable role-based access controls for the application service account during troubleshooting so the team can determine whether security controls are causing poor model answers.
- E
Use queryable audit/governance information together with application-specific logging to investigate whether sensitive data access patterns or policy changes coincide with abnormal AI responses.
Show answer and explanation
Correct answers: A, C, E
Explanation
The best answer is to monitor both the AI application's behavior and the quality/security characteristics of the data feeding it. In Snowflake, strong practice includes combining application logging and operational metrics with governance/audit review and source-data quality checks. For AI use cases, security engineers should not focus only on infrastructure-style metrics such as latency; they should also track whether source data has drifted, whether sensitive data is being accessed or surfaced unexpectedly, and whether changes in policies or data pipelines align with abnormal outputs. This aligns with Snowflake best practices around least privilege, governance, auditing, and continuous monitoring of data health. Relevant Snowflake documentation areas include access control and RBAC, monitoring and observability for workloads, audit/governance capabilities such as access history where applicable, and data quality validation patterns implemented with SQL and tasks.
- A. Correct.
Correct. A practical Snowflake-native monitoring approach combines operational telemetry from the application with checks on the data used by the AI workflow. For security and data quality oversight, teams should analyze logs and measurable indicators such as missing values, schema anomalies, row-count shifts, or validation failures in source datasets. This supports both ongoing monitoring and historical investigation.
- B. Incorrect.
Incorrect. Latency and token usage are useful operational metrics, but they do not by themselves reveal whether sensitive data is being exposed, whether retrieval context is poor, or whether underlying data quality has degraded. A common misconception is that performance telemetry alone is enough to monitor AI risk; in practice, security and data quality require additional controls and evidence.
- C. Correct.
Correct. Data drift, null-rate changes, outliers, and other profiling metrics are directly relevant to AI application quality because poor or changing source data can degrade outputs or increase unsafe responses. Correlating these signals with output evaluations, incidents, or policy violations is a sound operational pattern for diagnosing root cause.
- D. Incorrect.
Incorrect. Disabling RBAC is not a valid monitoring strategy and introduces unnecessary security risk. Troubleshooting should preserve least privilege and use audit evidence, controlled testing, and role simulation where appropriate. Weakening access controls can mask the real issue and violates security best practices.
- E. Correct.
Correct. Snowflake security monitoring commonly involves reviewing governance and audit-related information, then correlating it with application events. If abnormal responses begin after a policy change, unusual access pattern, or broader data exposure, combining those records with app logs helps identify whether the issue is due to security posture, data access behavior, or application logic.