SnowPro Advanced: Security Engineer Question 52
Single answerConfigure and monitor session policiesA security engineer needs to reduce the risk of unattended Snowflake sessions in a shared operations environment. Analysts connect through Snowsight and JDBC tools, and the requirement is to automatically terminate idle sessions after 20 minutes for a specific group of users without affecting service accounts used by ETL jobs. The engineer also wants to verify afterward that the policy is being enforced for those users. Which approach best meets these requirements?
- A
Create a session policy with SESSION_IDLE_TIMEOUT_MINS = 20, assign it directly to the analyst users (or to a role if that role is supported in the environment), and verify enforcement by checking active session details and user-level policy assignments through Snowflake metadata views/SHOW commands.
- B
Create a network policy that disconnects inactive clients after 20 minutes, attach it to the analyst users, and verify enforcement by reviewing LOGIN_HISTORY for timed-out sessions.
- C
Set AUTOCOMMIT = FALSE for the analyst users and reduce STATEMENT_TIMEOUT_IN_SECONDS to 1200, then review QUERY_HISTORY to confirm idle sessions are terminated after 20 minutes.
- D
Create a password policy with a 20-minute timeout, assign it to the analyst users, and monitor USERS view output to confirm sessions are closed when inactive.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use a session policy, because Snowflake session policies are designed to control session-specific security settings, including idle session timeout. In this scenario, the engineer should create a policy with SESSION_IDLE_TIMEOUT_MINS = 20 and assign it only to the intended human users so service accounts remain unaffected. After deployment, the engineer should verify both assignment and runtime behavior using Snowflake metadata commands and monitoring views appropriate to session and login activity. By contrast, network policies restrict where users can connect from, password policies govern password behavior, and statement timeout parameters control query runtime rather than idle session termination. This aligns with Snowflake security best practices of applying the least disruptive control at the most precise scope and validating enforcement through platform metadata.
- A. Correct.
Correct. Session policies are the Snowflake feature used to control session behavior such as idle session timeout. Setting SESSION_IDLE_TIMEOUT_MINS to 20 is the appropriate control for terminating idle sessions. Applying the policy only to the targeted analyst users avoids impacting ETL service accounts. To validate enforcement, administrators can inspect policy assignments using SHOW/describe metadata and monitor session-related metadata views or account usage views to confirm sessions for those users are operating under the expected controls.
- B. Incorrect.
Incorrect. Network policies control allowed network locations, such as IP allowlists and blocklists, not idle timeout behavior. LOGIN_HISTORY can help review login events, but it does not make a network policy enforce inactivity-based session termination. This option confuses connection-origin controls with session lifecycle controls.
- C. Incorrect.
Incorrect. AUTOCOMMIT affects transaction handling, not idle session duration. STATEMENT_TIMEOUT_IN_SECONDS limits how long an individual statement may run before cancellation; it does not terminate a session that is merely inactive. QUERY_HISTORY would show statement execution details, not proof that idle sessions are being closed because of a session policy.
- D. Incorrect.
Incorrect. Password policies govern authentication attributes such as password length, complexity, reuse, and lockout-related settings, not active session timeout. Monitoring user metadata also would not demonstrate session termination caused by inactivity. This option reflects a common misunderstanding between authentication policies and session policies.