SnowPro Advanced: Security Engineer Question 53
Single answerConfigure and monitor session policiesA security engineer at a financial services company must reduce the risk of unattended Snowflake sessions remaining active on shared analyst workstations. The requirement is to enforce a 15-minute inactivity timeout for a specific group of analysts without affecting service accounts or other users. The engineer also wants to verify which session policy is currently applied to those users after deployment. Which approach best meets these requirements?
- A
Create a session policy with SESSION_IDLE_TIMEOUT_MINS = 15, assign it directly to the analyst users with ALTER USER ... SET SESSION POLICY, and verify the effective policy with SHOW USERS or DESCRIBE USER.
- B
Create a network policy that restricts analyst IP addresses and assign it to the analyst role; then verify enforcement by querying LOGIN_HISTORY for blocked connections.
- C
Set SESSION_IDLE_TIMEOUT_MINS = 15 at the account level with ALTER ACCOUNT, and verify the analyst sessions by querying QUERY_HISTORY for session termination events.
- D
Create a session policy with SESSION_IDLE_TIMEOUT_MINS = 15, assign it to the analyst role, and verify the policy assignment with SHOW ROLES.
Show answer and explanation
Correct answer: A
Explanation
This scenario tests practical use of Snowflake session policies to control idle session duration for a targeted population. The correct solution is to create a session policy with the desired timeout and assign it to specific users rather than applying a broad account-level change. This follows least-impact security design by limiting the control to the intended analyst group while preserving behavior for service accounts and other users.
In Snowflake, session policies are used to define session-related limits, including idle timeout behavior. They can be applied at the account level or user level, with user-level assignment being the appropriate choice when only a subset of users should be affected. To monitor or verify configuration, administrators should inspect metadata using commands such as SHOW USERS or DESCRIBE USER to confirm the assigned session policy. By contrast, network policies address source network restrictions, and query history views do not provide authoritative evidence of policy assignment.
This aligns with Snowflake best practices for scoped security controls: use the policy type that matches the control objective, apply it at the narrowest level that meets the requirement, and validate assignment through metadata rather than inferring it from activity history.
- A. Correct.
Correct. A session policy is the Snowflake control designed to manage session behavior such as idle timeout. Assigning the session policy directly to the targeted analyst users satisfies the requirement to scope the change to a specific group without impacting unrelated users or service accounts. To confirm which policy is assigned, administrative metadata commands such as SHOW USERS or DESCRIBE USER can be used to inspect user-level properties, including session policy assignment.
- B. Incorrect.
Incorrect. Network policies control allowed client IP addresses, not session inactivity timeouts. They are used to restrict where users can connect from, not how long an idle authenticated session can remain open. Also, network policies are assigned at the account, user, or security integration level, not to roles for this purpose.
- C. Incorrect.
Incorrect. Changing the account-level session setting would affect all users in the account unless overridden, which violates the requirement to avoid affecting service accounts and other users. In addition, QUERY_HISTORY is not the right source to verify which session policy is assigned to a user; it tracks query execution, not policy assignment metadata.
- D. Incorrect.
Incorrect. Session policies are not assigned to roles. In Snowflake, session policies are associated with the account or with individual users. SHOW ROLES would not confirm session policy assignment because roles are not the attachment point for this policy type.