CertSafari

    Free Snowflake SnowPro Advanced: Security Engineer (SEA-C01) Sample Questions

    35 free sample questions from our bank of 346+, covering every exam domain, with answers and detailed explanations. Updated August 2026.

    Practice all 346 questions in quiz mode

    Domain 1: Account and Security

    Subdomain 1.2: Configure and monitor user authentication and session management.

    1.An organization uses Ping Identity as their IdP and wants to enforce MFA exclusively at the IdP level. They want to prevent users from bypassing the IdP by using local Snowflake passwords, except for a specific BREAK_GLASS user. Which combination of steps should the security engineer take?(Select 2)

    1. A.Set the SAML2_FORCE_AUTHN property to TRUE on the SAML2 security integration.
    2. B.Create an Authentication Policy that sets AUTHENTICATION_METHODS = ('SAML') and apply it to the account.
    3. C.Create an Authentication Policy that sets AUTHENTICATION_METHODS = ('ALL') and apply it to the BREAK_GLASS user.
    4. D.Drop the passwords for all users except the BREAK_GLASS user.
    5. E.Set EXT_AUTHN_DUO = FALSE at the account level.
    Show answer & explanation

    Correct answers: B, C — Create an Authentication Policy that sets AUTHENTICATION_METHODS = ('SAML') and apply it to the account.; Create an Authentication Policy that sets AUTHENTICATION_METHODS = ('ALL') and apply it to the BREAK_GLASS user.

    • A. Incorrect. Setting SAML2_FORCE_AUTHN to TRUE ensures that the IdP forces the user to re-authenticate (ignoring existing IdP sessions), but it does not prevent a user from choosing to use a local Snowflake password instead of SAML.
    • B. Correct. Authentication policies allow administrators to restrict allowed login methods. Applying a policy with AUTHENTICATION_METHODS = ('SAML') at the account level effectively disables local password login for the entire account, forcing users to use the IdP where MFA is enforced.
    • C. Correct. In Snowflake's policy hierarchy, a policy applied directly to a user overrides a policy applied to the account. By applying a more permissive policy (allowing 'ALL' or 'PASSWORD') to the BREAK_GLASS user, you grant that specific user the exception to bypass the IdP in emergencies.
    • D. Incorrect. While dropping passwords would prevent local authentication, it is a legacy administrative practice. Authentication Policies are the modern, scalable, and recommended way to manage authentication method restrictions in Snowflake.
    • E. Incorrect. The EXT_AUTHN_DUO parameter controls Snowflake's native integration with Duo Security. Disabling it does not enforce the use of SAML or prevent the use of local Snowflake passwords.

    Subdomain 1.2: Configure and monitor user authentication and session management.

    2.A backend service needs to run automated daily reports in Snowflake. The security team mandates that authentication must rely on short-lived tokens issued by the corporate Identity Provider (Azure AD), and no Snowflake-specific credentials (passwords or RSA keys) should be stored in the service. Which authentication method should the security engineer implement?

    1. A.External OAuth using the Client Credentials flow.
    2. B.Snowflake OAuth using the Authorization Code flow.
    3. C.SAML 2.0 with IdP-initiated SSO.
    4. D.Key-Pair authentication with automated key rotation.
    Show answer & explanation

    Correct answer: A — External OAuth using the Client Credentials flow.

    • A. External OAuth using the Client Credentials flow is designed for machine-to-machine (M2M) authentication and fits the requirement for unattended backend services. The service authenticates with the external Identity Provider (Azure AD) to receive a short-lived access token, which is then presented to Snowflake. This method avoids the need to store any Snowflake-specific credentials like passwords or RSA keys locally within the service.
    • B. Snowflake OAuth using the Authorization Code flow is intended for user-centric interactive authentication. It requires a browser-based login and user consent, making it unsuitable for automated, non-interactive backend processes. Additionally, Snowflake OAuth is managed by Snowflake rather than relying entirely on tokens issued by the corporate IdP.
    • C. SAML 2.0 with IdP-initiated SSO is designed for browser-based human Single Sign-On (SSO). It involves XML-based assertions and web browser redirects, which are not compatible with automated API-driven service workloads or reporting scripts.
    • D. Key-pair authentication requires storing an RSA private key on the service host. The security mandate explicitly forbids storing Snowflake-specific credentials, including RSA keys. Furthermore, this method does not utilize tokens issued by the corporate IdP (Azure AD).

    Subdomain 1.4: Manage external access integrations.

    3.Snowflake Secrets can be used to securely store credentials for authenticating with external endpoints. Which of the following are valid credential types that can be natively configured when creating a Secret in Snowflake?(Select 3)

    1. A.OAUTH2
    2. B.PASSWORD
    3. C.GENERIC_STRING
    4. D.SSH_KEY
    5. E.X509_CERTIFICATE
    Show answer & explanation

    Correct answers: A, B, C — OAUTH2; PASSWORD; GENERIC_STRING

    • A. Correct. OAUTH2 is a native credential type used for storing OAuth2 details such as refresh tokens and client secrets, enabling Snowflake to manage authentication with external services that use OAuth 2.0.
    • B. Correct. PASSWORD is a native credential type used for basic authentication, allowing the secure storage of a username and password for external API or database access.
    • C. Correct. GENERIC_STRING is a native credential type used to store arbitrary secret values, such as simple API keys or shared secrets, that do not fall into the category of Password or OAuth2.
    • D. Incorrect. SSH_KEY is not a supported native credential type for Snowflake Secrets used in external access integrations. While Snowflake supports SSH keys for user authentication into the platform, it is not a type for the Secret object.
    • E. Incorrect. X509_CERTIFICATE is not a supported native credential type for Snowflake Secrets. The three natively supported types are PASSWORD, OAUTH2, and GENERIC_STRING.

    Subdomain 1.1: Design and implement access control strategies.

    4.A data provider wants to share a database named `MARKET_DATA` with a consumer account using Snowflake Secure Data Sharing. The provider wants to bundle specific privileges on schemas and tables within `MARKET_DATA` into a single role that the consumer can easily assign to their own users. How should the provider utilize Database Roles to achieve this? (Select TWO)(Select 2)

    1. A.Create a database role in the `MARKET_DATA` database and grant the required object privileges to it.
    2. B.Grant the database role directly to the consumer's `ACCOUNTADMIN` role before creating the share.
    3. C.Grant the database role to the share so that the consumer can grant it to their account roles.
    4. D.Create an account role, grant the database role to it, and share the account role.
    5. E.Instruct the consumer to grant the shared database role directly to their end users.
    Show answer & explanation

    Correct answers: A, C — Create a database role in the `MARKET_DATA` database and grant the required object privileges to it.; Grant the database role to the share so that the consumer can grant it to their account roles.

    • A. Correct. Database roles are created inside a database and are designed to group privileges on objects within that specific database. The provider begins by creating a database role in `MARKET_DATA` and granting it the necessary privileges on schemas, tables, or views.
    • B. Incorrect. A provider cannot grant roles directly to roles in a different account. Access is mediated through the Share object. Furthermore, the consumer's ACCOUNTADMIN should not be directly involved in the provider's internal role hierarchy.
    • C. Correct. In Snowflake Secure Data Sharing, the provider grants the database role to the share (GRANT DATABASE ROLE <name> TO SHARE <share_name>). This allows the consumer to see the role and grant it to their own account roles, effectively transferring the bundled privileges.
    • D. Incorrect. Account roles (standard Snowflake roles) cannot be added to a Share; only data objects and Database Roles can be shared. Database roles are specifically intended for this cross-account privilege bundling.
    • E. Incorrect. Snowflake does not allow database roles to be granted directly to users. Database roles must be granted to account roles, which are then assigned to users. Furthermore, shared database roles must be mapped to local account roles in the consumer account.

    Subdomain 1.1: Design and implement access control strategies.

    5.In a Snowflake role hierarchy, if Role A is granted to Role B, and Role B is granted to Role C, which of the following statements is true regarding privilege inheritance?

    1. A.Role A inherits the privileges of Role B and Role C.
    2. B.Role C inherits the privileges of Role A and Role B.
    3. C.Role B inherits the privileges of Role C, but not Role A.
    4. D.Privilege inheritance only works for one level; Role C does not inherit Role A's privileges.
    Show answer & explanation

    Correct answer: B — Role C inherits the privileges of Role A and Role B.

    • A. Incorrect. In Snowflake's Role-Based Access Control (RBAC) model, when a role is granted to another role, the receiving role (parent) inherits the privileges of the granted role (child). Role A is the lowest role in this hierarchy and does not inherit privileges from its parents B or C.
    • B. Correct. Snowflake role inheritance is transitive. If Role A is granted to Role B, and Role B is granted to Role C, then Role C effectively inherits the privileges of both Role B and Role A. Privileges flow 'upward' through the hierarchy to the role at the top of the chain.
    • C. Incorrect. This statement reverses the direction of inheritance. In this setup, Role B inherits from Role A (the role granted to it), not from Role C (the role it is granted to).
    • D. Incorrect. Snowflake role inheritance is not limited to a single level. It is transitive, meaning inheritance continues through multiple layers of grants, allowing for complex and deep role hierarchies.

    Subdomain 1.3: Implement network security controls.

    6.A Snowflake administrator accidentally applied an account-level network policy that blocks all IP addresses, including their own current IP address. As a result, no one can log into the Snowflake account. How can the administrator regain access?

    1. A.The administrator must contact Snowflake Support to temporarily disable or remove the network policy.
    2. B.The administrator can log in using the `SNOWFLAKE_BYPASS` parameter in their connection string.
    3. C.The administrator can log in using the `ACCOUNTADMIN` role, which inherently bypasses all network policies.
    4. D.The administrator can connect via the SnowSQL CLI using the `--bypass-network-policy` flag.
    Show answer & explanation

    Correct answer: A — The administrator must contact Snowflake Support to temporarily disable or remove the network policy.

    • A. Correct. If an active network policy blocks all IP addresses, including those of administrators, no user can log in through standard Snowflake interfaces or CLI tools. In this scenario, Snowflake Support must be contacted to intervene and manually disable or remove the restrictive policy from the backend to restore access.
    • B. Incorrect. Snowflake does not provide a `SNOWFLAKE_BYPASS` parameter or any other connection string attribute to circumvent network policy enforcement. Network security is enforced on the server-side and cannot be overridden by client-side settings.
    • C. Incorrect. The `ACCOUNTADMIN` role does not inherently bypass network policies. Network policies are evaluated during the connection phase, before the session is established and roles are activated. Even the highest privileged role is subject to account-level and user-level network restrictions.
    • D. Incorrect. There is no `--bypass-network-policy` flag in SnowSQL. Snowflake's network security architecture ensures that if a policy blocks a source IP, the connection is rejected regardless of the client application or command-line flags used.

    Domain 2: Data Protection, Data Privacy, and Data Governance

    Subdomain 2.2: Manage and audit Secure Data Sharing and collaborations.

    7.A financial institution wants to share premium market data with specific clients located across different cloud regions. They need to track usage metrics, ensure data is encrypted during replication, and minimize manual administrative overhead for cross-region sharing. What is the most secure and native way to configure this in Snowflake?

    1. A.Create a Direct Share and manually replicate the database to each region using Snowpipe.
    2. B.Publish a Private Data Listing with Cross-Region Auto-Fulfillment enabled for the specific consumer accounts.
    3. C.Export the data to an external stage and share the pre-signed URLs via a Secure View.
    4. D.Use Snowflake's Data Exchange to create a public listing with auto-fulfillment enabled for all accounts.
    Show answer & explanation

    Correct answer: B — Publish a Private Data Listing with Cross-Region Auto-Fulfillment enabled for the specific consumer accounts.

    • A. Incorrect. A direct share is a native sharing feature but it does not natively span cloud regions without a local replica. Manually replicating the database using Snowpipe is not a standard or supported pattern for data sharing and would result in excessive administrative overhead and complexity.
    • B. Correct. Private Data Listings with Cross-Region Auto-Fulfillment provide a native, automated solution for cross-region sharing. Snowflake automatically manages the replication of data to the consumer's region, ensuring it is encrypted in transit and at rest. This method allows providers to target specific accounts, minimizes manual overhead by automating synchronization, and provides built-in usage tracking through the Marketplace/Listing metrics.
    • C. Incorrect. Exporting data to an external stage and using pre-signed URLs is not the native Snowflake Secure Data Sharing model. This method bypasses Snowflake’s governed security controls, auditability, and the automated replication features required for seamless cross-region collaboration.
    • D. Incorrect. While a Data Exchange and auto-fulfillment can handle distribution, a 'public listing' contradicts the requirement to share data only with 'specific clients'. Public listings are discoverable by all Snowflake users, which is inappropriate for premium market data intended for specific, restricted clients.

    Subdomain 2.2: Manage and audit Secure Data Sharing and collaborations.

    8.A data provider is sharing a dataset containing a Secure UDF that calculates proprietary risk scores. The consumer reports that queries filtering on the results of this UDF are running significantly slower than expected. As a Security Engineer, you investigate the issue. What security characteristics of Secure UDFs explain this performance impact?(Select 2)

    1. A.Secure UDFs prevent the query optimizer from pushing filters down before the UDF evaluation to avoid data leakage.
    2. B.Secure UDFs require the data to be decrypted and re-encrypted in memory for every row processed.
    3. C.The query execution plan is obfuscated, which prevents certain micro-partition pruning optimizations.
    4. D.Secure UDFs automatically force the virtual warehouse to scale down to an X-Small size during execution.
    5. E.Secure UDFs execute in a separate, isolated container outside of the Snowflake virtual warehouse.
    Show answer & explanation

    Correct answers: A, C — Secure UDFs prevent the query optimizer from pushing filters down before the UDF evaluation to avoid data leakage.; The query execution plan is obfuscated, which prevents certain micro-partition pruning optimizations.

    • A. Correct. To prevent data leakage (such as users inferring underlying data via error messages or timing attacks), Snowflake does not allow the query optimizer to push filters across the boundary of a Secure UDF. This means optimizations like predicate pushdown are restricted, often resulting in more data being processed than in a standard UDF.
    • B. Incorrect. Secure UDFs do not change Snowflake's fundamental encryption architecture. Data is not decrypted and re-encrypted on a per-row basis due to the 'Secure' property; encryption is handled at the storage and buffer levels.
    • C. Correct. For secure objects, Snowflake limits the visibility of the internal logic in the Query Profile and to the query optimizer itself. Because the optimizer cannot 'see' inside the secure object to evaluate how it interacts with the data, it may be unable to perform specific micro-partition pruning or other plan-driven optimizations that would normally occur.
    • D. Incorrect. The use of a Secure UDF has no automated impact on warehouse sizing. Warehouse scale is managed by the user or account administrator.
    • E. Incorrect. While certain UDF languages (like Python or Java) run in a sandbox/container, the 'SECURE' keyword is a logical property applied to views and UDFs of any language (including SQL). The performance impact is a result of optimizer constraints, not a change in the physical compute location.

    Subdomain 2.7: Manage secure replication and failover operations.

    9.A security engineer is conducting a controlled test of the failover process. They need to ensure that the SAML2 security integration is properly promoted and functional on the secondary account. What must the engineer verify regarding the SAML integration before initiating the client redirect?

    1. A.The SAML integration must be manually recreated on the secondary account because security integrations cannot be replicated.
    2. B.The Assertion Consumer Service (ACS) URL in the Identity Provider (IdP) must be updated to point to the Snowflake Client Redirect connection URL.
    3. C.The SAML2_ENABLE_REPLICATION` parameter must be set to TRUE on the primary account's integration before failover.
    4. D.The secondary account must have a different Entity ID configured in the IdP than the primary account to prevent token collision.
    Show answer & explanation

    Correct answer: B — The Assertion Consumer Service (ACS) URL in the Identity Provider (IdP) must be updated to point to the Snowflake Client Redirect connection URL.

    • A. Incorrect. Security integrations, including SAML2 and SCIM, can be replicated and promoted as part of failover groups in Snowflake. They do not need to be manually recreated on the secondary account.
    • B. Correct. When using Snowflake Client Redirect for failover, the Identity Provider (IdP) must be configured to send SAML assertions to the Snowflake Client Redirect connection URL. Verifying the ACS URL/redirect endpoint ensures the SAML authentication flow remains valid and functional against the promoted secondary account when client traffic is redirected.
    • C. Incorrect. There is no `SAML2_ENABLE_REPLICATION` parameter in Snowflake. Replication of security integrations is managed by including them in a replication or failover group, not by a specific parameter on the integration itself.
    • D. Incorrect. The Entity ID is used to establish trust between the IdP and Snowflake. Using a different Entity ID on the secondary account would break the trust relationship and prevent successful authentication. For seamless failover using Client Redirect, the configuration should remain consistent or utilize the global connection endpoint.

    Subdomain 2.5: Configure object tagging and data classification frameworks.

    10.A security engineer applies a tag `cost_center='sales'` at the schema level, `cost_center='marketing'` at the table level, and `cost_center='finance'` at the column level for a specific column `REVENUE`. When the engineer executes the `SYSTEM$GET_TAG` function on the `REVENUE` column, what value is returned and why?

    1. A.'sales', because schema-level tags take precedence over table and column tags.
    2. B.'marketing', because table-level tags override both schema and column tags.
    3. C.'finance', because the tag applied to the closest object in the hierarchy overrides tags inherited from higher-level objects.
    4. D.An error is returned because conflicting tag values cannot exist in the same object hierarchy.
    Show answer & explanation

    Correct answer: C — 'finance', because the tag applied to the closest object in the hierarchy overrides tags inherited from higher-level objects.

    • A. Incorrect. Snowflake's tag inheritance follows a bottom-up precedence. Tags at higher levels like schemas are inherited by children but do not override tags applied directly to specific objects like columns.
    • B. Incorrect. While a table-level tag overrides a schema-level tag, it is in turn overridden by a tag applied directly to a column within that table. The hierarchy is: Database > Schema > Table > Column.
    • C. Correct. In Snowflake, tags are inherited through the object hierarchy. However, the tag value assigned to the object closest to the query (the column itself) takes precedence over values inherited from higher-level objects like tables or schemas. Since 'finance' is assigned directly to the column REVENUE, it is the value returned.
    • D. Incorrect. Snowflake allows the same tag name to exist at different levels in the object hierarchy. This is standard inheritance behavior, not a conflict that produces an error.

    Subdomain 2.5: Configure object tagging and data classification frameworks.

    11.In the Snowsight web interface, which feature provides a visual representation of data lineage, showing how data flows from source tables to target tables or views?

    1. A.The Query Profile visualizer
    2. B.The Lineage tab under the Table/View Details page
    3. C.The Access History dashboard
    4. D.The Tag References explorer
    Show answer & explanation

    Correct answer: B — The Lineage tab under the Table/View Details page

    • A. Incorrect. The Query Profile visualizer in Snowsight is used to analyze the execution details, performance metrics, and operator-level breakdown of a specific query. It does not provide a persistent, object-level visual representation of how data flows between tables and views.
    • B. Correct. The Lineage tab under the Table/View Details page in Snowsight provides a visual lineage graph. This feature allows users to see upstream and downstream dependencies, illustrating exactly how data flows from source tables to target objects like tables or views.
    • C. Incorrect. While the underlying ACCESS_HISTORY view provides the data necessary for lineage, the Access History dashboard is primarily designed for auditing who accessed which data and when. It does not provide the visual flow diagram of data movement between objects.
    • D. Incorrect. The Tag References explorer is a governance tool used to track and manage the application of tags across Snowflake objects. It is used for classification and policy enforcement rather than visualizing data lineage.

    Subdomain 2.6: Configure and maintain data replication policies and procedures.

    12.A security engineer needs to transfer ownership of an existing failover group named `FG_PROD` from `ACCOUNTADMIN` to a custom role named `REPLICATION_ADMIN`. Which SQL command successfully achieves this while preserving existing privileges on the failover group?

    1. A.GRANT OWNERSHIP ON FAILOVER GROUP FG_PROD TO ROLE REPLICATION_ADMIN COPY CURRENT GRANTS;
    2. B.ALTER FAILOVER GROUP FG_PROD SET OWNER TO REPLICATION_ADMIN;
    3. C.GRANT MANAGE REPLICATION ON ACCOUNT TO ROLE REPLICATION_ADMIN;
    4. D.GRANT OWNERSHIP ON FAILOVER GROUP FG_PROD TO ROLE REPLICATION_ADMIN REVOKE CURRENT GRANTS;
    Show answer & explanation

    Correct answer: A — GRANT OWNERSHIP ON FAILOVER GROUP FG_PROD TO ROLE REPLICATION_ADMIN COPY CURRENT GRANTS;

    • A. Correct. In Snowflake, the `GRANT OWNERSHIP` command is used to transfer ownership of account-level and database-level objects. The `COPY CURRENT GRANTS` clause is essential here as it preserves existing outbound privileges granted on the failover group to other roles, ensuring a seamless transition without needing to re-grant access.
    • B. Incorrect. Snowflake does not use the `ALTER ... SET OWNER` syntax to transfer object ownership. The standard command for changing owners is `GRANT OWNERSHIP`.
    • C. Incorrect. This command grants the `MANAGE REPLICATION` account-level privilege, which allows a role to create and manage replication groups, but it does not transfer ownership of an existing failover group.
    • D. Incorrect. While `REVOKE CURRENT GRANTS` is valid syntax, it explicitly removes all existing privileges on the object during the ownership transfer. The requirement is to preserve existing privileges, which requires `COPY CURRENT GRANTS`.

    Subdomain 2.6: Configure and maintain data replication policies and procedures.

    13.A company wants to ensure that only a highly restricted custom role, `DR_ADMIN`, can initiate a failover to the secondary account. The `ACCOUNTADMIN` role currently owns the failover group `PROD_FAILOVER`. How should the security engineer configure this to adhere to the principle of least privilege?

    1. A.Grant OWNERSHIP on the failover group PROD_FAILOVER to DR_ADMIN in the primary account, and ensure the DR_ADMIN role is replicated to the secondary account.
    2. B.Grant the FAILOVER privilege on the account to the DR_ADMIN role.
    3. C.Alter the failover group to set the property FAILOVER_ROLE = DR_ADMIN.
    4. D.Grant OPERATE on the failover group PROD_FAILOVER to DR_ADMIN in the secondary account.
    Show answer & explanation

    Correct answer: A — Grant OWNERSHIP on the failover group PROD_FAILOVER to DR_ADMIN in the primary account, and ensure the DR_ADMIN role is replicated to the secondary account.

    • A. To initiate a failover (ALTER FAILOVER GROUP ... FAILOVER), the executing role must have the OWNERSHIP privilege on the failover group object. Because the failover must be initiated from the secondary account, the DR_ADMIN role must also exist in that account with the same permissions. This is achieved by transferring ownership in the primary account and ensuring the role is included in the replication group. This follows the principle of least privilege by restricting administrative control to a specific object (PROD_FAILOVER) rather than the entire account.
    • B. Snowflake does have a FAILOVER privilege that can be granted at the account level; however, this is a broad privilege that allows the role to initiate failover for any and all failover groups within the account. The principle of least privilege favors object-level ownership when control is needed for a specific failover group only.
    • C. There is no FAILOVER_ROLE property for failover groups in Snowflake. Security and authorization for failover operations are managed strictly through Snowflake's standard Role-Based Access Control (RBAC) and object-level privileges.
    • D. The OPERATE privilege does not exist for failover group objects. Furthermore, failover groups in the secondary account are read-only replicas of the primary; privileges cannot be granted locally in the secondary account. They must be defined in the primary and replicated.

    Subdomain 2.4: Establish and manage data retention and data lifecycle management.

    14.A data governance team wants to apply retention settings using tags. They create a tag `RETENTION_TIER` with allowed values 'BRONZE' (30 days), 'SILVER' (90 days), and 'GOLD' (365 days). They want to automate the purging of old data based on these tags. Which steps are required to build this custom governance tool in Snowflake?(Select 3)

    1. A.Apply the `RETENTION_TIER` tag to the relevant tables.
    2. B.Create a Snowflake Task that queries `ACCOUNT_USAGE.TAG_REFERENCES` to find tables and their assigned retention tiers.
    3. C.Use a system-defined Snowflake Retention Policy object and attach the tag to it.
    4. D.Write a Stored Procedure that dynamically generates and executes `DELETE` statements based on the tag value and a timestamp column.
    5. E.Alter the tag to enforce `DATA_RETENTION_TIME_IN_DAYS` automatically at the row level.
    6. F.Create a Row Access Policy that automatically deletes rows when the tag expires.
    Show answer & explanation

    Correct answers: A, B, D — Apply the `RETENTION_TIER` tag to the relevant tables.; Create a Snowflake Task that queries `ACCOUNT_USAGE.TAG_REFERENCES` to find tables and their assigned retention tiers.; Write a Stored Procedure that dynamically generates and executes `DELETE` statements based on the tag value and a timestamp column.

    • A. Applying the `RETENTION_TIER` tag to the relevant tables is a necessary prerequisite. This assigns metadata to the objects, enabling the governance tool to identify which retention requirements apply to which specific datasets.
    • B. Automation requires a discovery phase. A Snowflake Task can be scheduled to periodically query views like `ACCOUNT_USAGE.TAG_REFERENCES` to programmatically identify tables and their associated tag values ('GOLD', 'SILVER', 'BRONZE'), providing the context for the purge logic.
    • C. Snowflake does not provide a native 'Retention Policy' object that can be attached to tags. Retention based on tags must be implemented through custom metadata-driven logic.
    • D. To perform the actual purging, a Stored Procedure is required to interpret the tag values (e.g., mapping 'GOLD' to 365 days), construct dynamic SQL based on a business timestamp column, and execute the `DELETE` operations.
    • E. Tags are metadata objects and cannot natively enforce parameters like `DATA_RETENTION_TIME_IN_DAYS`. Furthermore, that parameter controls Time Travel duration (data protection) rather than the logical purging of business data (data lifecycle).
    • F. Row Access Policies are security objects used to restrict row visibility based on user roles or attributes. They are used for access control, not for executing physical DML operations like data deletion.

    Subdomain 2.4: Establish and manage data retention and data lifecycle management.

    15.A data engineer accidentally drops a critical permanent table. The table had a Time Travel retention period of 1 day. The engineer discovers the mistake 3 days later. The data is now in the Fail-safe state. What action must the security engineer take to recover the data?

    1. A.Use the UNDROP TABLE command.
    2. B.Query the table using the AT (OFFSET => -86400 * 3) clause and insert the results into a new table.
    3. C.Contact Snowflake Support to request data recovery from Fail-safe.
    4. D.Restore the table from the SNOWFLAKE.RECOVERY schema.
    Show answer & explanation

    Correct answer: C — Contact Snowflake Support to request data recovery from Fail-safe.

    • A. Incorrect. The UNDROP TABLE command can only be used to restore an object while it is still within its Time Travel retention period. Since the table has moved into the Fail-safe state (3 days later with only a 1-day retention period), this command will no longer work.
    • B. Incorrect. The AT (OFFSET => ...) clause allows users to query historical data within the Time Travel window. Once the data has transitioned to Fail-safe, it is no longer queryable by users, and historical queries will fail.
    • C. Correct. Fail-safe provides a non-configurable 7-day period (for permanent tables) after the Time Travel retention period ends. Data in Fail-safe is not user-accessible and can only be recovered by contacting Snowflake Support. This is intended as a last-resort recovery mechanism.
    • D. Incorrect. There is no SNOWFLAKE.RECOVERY schema or similar system-defined schema for data restoration from Fail-safe. Recovery from the Fail-safe state requires direct intervention by Snowflake Support.

    Subdomain 2.1: Implement data security features.

    16.Which of the following statements are true regarding the requirements and capabilities of Snowflake Tri-Secret Secure?(Select 2)

    1. A.It requires the Snowflake Business Critical edition or higher.
    2. B.It supports customer-managed keys hosted in AWS KMS, Azure Key Vault, and Google Cloud KMS.
    3. C.It completely disables and replaces the Snowflake-managed key with the customer-managed key.
    4. D.It allows customers to manage the cryptographic keys used to encrypt data in transit between the client and Snowflake.
    5. E.It enables automatic key rotation of the customer-managed key by Snowflake without any customer intervention.
    Show answer & explanation

    Correct answers: A, B — It requires the Snowflake Business Critical edition or higher.; It supports customer-managed keys hosted in AWS KMS, Azure Key Vault, and Google Cloud KMS.

    • A. Correct. Tri-Secret Secure is an advanced security feature available exclusively for Snowflake accounts on the Business Critical edition or higher (including Virtual Private Snowflake).
    • B. Correct. Tri-Secret Secure supports customer-managed keys (CMK) hosted in the major cloud KMS services: AWS KMS, Azure Key Vault, and Google Cloud KMS, depending on the cloud platform where the Snowflake account is hosted.
    • C. Incorrect. Tri-Secret Secure does not replace the Snowflake-managed key. Instead, it uses a hierarchical key model where a customer-managed key and a Snowflake-managed key are combined to form a composite master key.
    • D. Incorrect. Tri-Secret Secure is designed for protecting data at rest. Encryption in transit between the client and Snowflake is handled separately by TLS (Transport Layer Security) protocols.
    • E. Incorrect. Snowflake does not manage or rotate the customer-managed key. The customer is responsible for configuring and managing key rotation policies within their own cloud provider's KMS.

    Subdomain 2.3: Restrict data exfiltration.

    17.A user is attempting to exfiltrate data by running a `COPY INTO` command specifying an external S3 bucket and providing AWS credentials directly in the query string. The security team wants to block this behavior across the entire account without breaking existing automated pipelines that use governed storage integrations. Which action should the Security Engineer take?

    1. A.Set REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION to TRUE.
    2. B.Set PREVENT_UNLOAD_TO_INLINE_URL to TRUE.
    3. C.Create an egress network policy blocking the S3 IP ranges.
    4. D.Revoke the UNLOAD privilege from all roles.
    Show answer & explanation

    Correct answer: B — Set PREVENT_UNLOAD_TO_INLINE_URL to TRUE.

    • A. Setting REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION to TRUE ensures storage integrations are used when creating stages, but it does not prevent users from bypassing stage objects entirely by using ad-hoc inline credentials directly in a COPY INTO query string.
    • B. The account-level parameter PREVENT_UNLOAD_TO_INLINE_URL is specifically designed to block the export of data to external locations when the COPY INTO command uses an inline URL and credentials. This forces users to use governed objects (like storage integrations), closing the exfiltration loophole without impacting legitimate, authorized pipelines.
    • C. Network policies are used to control access based on IP addresses, but S3 uses a massive range of IPs shared by many customers. Blocking S3 IP ranges would not only be difficult to maintain but would also break internal Snowflake processes and authorized external data transfers.
    • D. Snowflake does not have a single 'UNLOAD' privilege; data export is governed by a combination of usage permissions on stages and select permissions on tables. Removing these permissions globally would break all legitimate data movement and automated pipelines.

    Subdomain 2.3: Restrict data exfiltration.

    18.A data analyst submits a support ticket stating they cannot see the download button for their query results in Snowsight. The Security Engineer investigates the issue. Which two configurations could be causing the download button to be hidden?(Select 2)

    1. A.UI_QUERY_RESULT_DOWNLOAD_ENABLED is set to FALSE at the user level for the analyst.
    2. B.The analyst's active role lacks the DOWNLOAD_RESULTS privilege.
    3. C.The query result exceeds the 100 MB download limit.
    4. D.UI_QUERY_RESULT_DOWNLOAD_ENABLED is set to FALSE at the account level, and not overridden at the user level.
    5. E.The analyst is accessing Snowflake via a PrivateLink connection, which automatically disables UI downloads.
    Show answer & explanation

    Correct answers: A, D — UI_QUERY_RESULT_DOWNLOAD_ENABLED is set to FALSE at the user level for the analyst.; UI_QUERY_RESULT_DOWNLOAD_ENABLED is set to FALSE at the account level, and not overridden at the user level.

    • A. The UI_QUERY_RESULT_DOWNLOAD_ENABLED parameter determines whether a user can download query results from the Snowflake UI (Snowsight or Classic). Since this parameter can be configured at the user level, setting it to FALSE specifically for the analyst would hide the download button.
    • B. Snowflake does not have a privilege named DOWNLOAD_RESULTS. Access to UI features like downloading is controlled by session/object parameters, not by standard RBAC privileges.
    • C. While Snowsight has a 100 MB limit for downloading results as CSV, exceeding this limit generally leads to a notification or result truncation rather than hiding the download button. Furthermore, a result size is a property of the data, not a 'configuration' an engineer would typically check.
    • D. The UI_QUERY_RESULT_DOWNLOAD_ENABLED parameter can be set at the account level. If it is set to FALSE globally, all users will be unable to see the download button unless the parameter is explicitly overridden to TRUE at their individual user level.
    • E. Using PrivateLink ensures secure, private network traffic between the client and Snowflake but does not have a native mechanism that automatically modifies UI visibility or disables result downloads.

    Domain 3: Auditing, Monitoring, and Compliance

    Subdomain 3.1: Monitor data security.

    19.A data science team is running AI/ML workloads using Snowpark Container Services (SPCS). The security team needs to trace data access and application logs generated by these containers. How should the security engineer configure this tracing?

    1. A.Query the CONTAINER_HISTORY view in the ACCOUNT_USAGE schema.
    2. B.Set up an Event Table and configure the compute pool to emit logs and traces to it.
    3. C.Use the SYSTEM$GET_CONTAINER_LOGS function exclusively for historical auditing.
    4. D.Enable the SPCS_AUDIT_LOGGING parameter at the account level.
    Show answer & explanation

    Correct answer: B — Set up an Event Table and configure the compute pool to emit logs and traces to it.

    • A. The CONTAINER_HISTORY (and SERVICE_HISTORY) view in the ACCOUNT_USAGE schema provides historical metadata about container operations and lifecycle, but it does not capture the actual application-level logs or traces emitted by the software running within the container.
    • B. An Event Table is the Snowflake-native destination for observability data such as logs and traces. SPCS workloads are configured to emit telemetry to a centralized Event Table, allowing the security team to query and audit application activity and data access using standard SQL.
    • C. The SYSTEM$GET_CONTAINER_LOGS function is primarily used for real-time troubleshooting by retrieving the standard output (stdout) and error (stderr) of a container. It is not designed for continuous, durable, or centralized historical auditing of traces across multiple containers.
    • D. There is no account-level parameter named SPCS_AUDIT_LOGGING. Snowflake observability for SPCS relies on the standard telemetry framework involving Event Tables.

    Subdomain 3.1: Monitor data security.

    20.A security team uses Slack for incident response. They want Snowflake to send an alert directly to a Slack webhook whenever a brute-force login attempt is detected. What is the most secure and native way to implement this?

    1. A.Create an External Function that calls an AWS Lambda function to forward the message to Slack.
    2. B.Use External Network Access to create a secure integration and a UDF/Procedure that sends an HTTP POST request to the Slack webhook.
    3. C.Configure a Notification Integration with TYPE = SLACK and use SYSTEM$SEND_SLACK_MESSAGE.
    4. D.Export the LOGIN_HISTORY to an external stage and use Snowpipe to trigger a Slack notification.
    Show answer & explanation

    Correct answer: B — Use External Network Access to create a secure integration and a UDF/Procedure that sends an HTTP POST request to the Slack webhook.

    • A. External Functions require additional cloud infrastructure (e.g., AWS Lambda, API Gateway), which increases operational complexity and the security attack surface. This approach is less direct and native compared to platform-specific features like External Network Access.
    • B. External Network Access (ENA) is the modern, secure, and native Snowflake feature for outbound communication. It is specifically tested in the Security Engineer exam because it utilizes Network Rules to restrict destinations and Snowflake Secrets to securely manage and mask sensitive credentials like Slack Webhook URLs/tokens, ensuring they are not exposed in plaintext.
    • C. This option is technically incorrect because the 'TYPE' property for a Snowflake Notification Integration used for Slack is 'WEBHOOK', not 'SLACK'. While 'SYSTEM$SEND_SLACK_MESSAGE' is a valid function for alerts, it requires a correctly configured 'WEBHOOK' type integration.
    • D. Exporting LOGIN_HISTORY via Snowpipe is a batch-oriented process that introduces significant latency. It is unsuitable for real-time security incident response, which requires immediate notification when a brute-force attack is detected.

    Subdomain 3.3: Design and manage data compliance policies.

    21.A financial institution processing credit cards must comply with PCI DSS. A key requirement is that the institution must maintain control over the encryption keys protecting the cardholder data, and be able to revoke access to the data immediately by disabling their key. How should the security engineer configure Snowflake to meet this requirement?

    1. A.Implement Snowflake Tri-Secret Secure using a Customer Managed Key (CMK) in their cloud provider.
    2. B.Use Snowflake's default transparent data encryption with periodic key rotation.
    3. C.Encrypt the data using a Snowflake Session Policy before loading it into the warehouse.
    4. D.Store the data in a Secure View and grant access only to the ACCOUNTADMIN role.
    Show answer & explanation

    Correct answer: A — Implement Snowflake Tri-Secret Secure using a Customer Managed Key (CMK) in their cloud provider.

    • A. Correct. Snowflake Tri-Secret Secure adds a customer-managed key (CMK) to Snowflake's encryption hierarchy. By managing this key in their own cloud provider (AWS KMS, Azure Key Vault, or Google Cloud KMS), the institution maintains control. If the customer disables or revokes that key, Snowflake can no longer decrypt the protected data, providing the immediate revocation capability required by PCI DSS.
    • B. Incorrect. Snowflake's default transparent data encryption is managed by Snowflake, meaning the customer does not have direct control over the master keys. While it provides security and periodic rotation, it does not allow the customer to immediately revoke access by disabling a key they own.
    • C. Incorrect. A Snowflake Session Policy manages session behavior (such as timeouts and authentication), not the encryption of data at rest. It does not provide a mechanism for customer-managed encryption key control.
    • D. Incorrect. Secure Views and Role-Based Access Control (RBAC) manage query access and data visibility at the logical level. They do not address the cryptographic requirement of maintaining control over encryption keys or the ability to revoke data access via key management.

    Subdomain 3.3: Design and manage data compliance policies.

    22.A Snowflake customer needs to provide Snowflake's latest SOC 2 Type II and PCI DSS compliance reports to their external auditors. How can the customer obtain these documents?

    1. A.By querying the SNOWFLAKE.ACCOUNT_USAGE.COMPLIANCE_REPORTS view.
    2. B.By downloading them directly from the Snowflake Support portal under the Compliance Reports section, provided an NDA is in place.
    3. C.By requesting them through the Snowflake Trust Center interface in Snowsight without any prerequisites.
    4. D.By running the GET_COMPLIANCE_REPORT('SOC2') system function.
    Show answer & explanation

    Correct answer: B — By downloading them directly from the Snowflake Support portal under the Compliance Reports section, provided an NDA is in place.

    • A. Incorrect. The SNOWFLAKE.ACCOUNT_USAGE schema provides metadata and usage information about the Snowflake account (such as query history or storage usage); it does not contain external audit reports or a view for compliance documents.
    • B. Correct. Snowflake provides compliance reports, including SOC 2 Type II and PCI DSS, through the Snowflake Support portal or a linked self-service compliance portal. Because these reports contain sensitive security information, they are typically gated and require a Non-Disclosure Agreement (NDA) to be in place.
    • C. Incorrect. While the Snowflake Trust Center in Snowsight helps customers monitor their own security posture and risk, it does not serve as a repository for downloading Snowflake's own third-party audit reports without prerequisites. These documents are strictly controlled.
    • D. Incorrect. Snowflake does not offer a system function to retrieve audit reports via SQL. Compliance reports are administrative documents obtained through the official Snowflake support or trust channels, not through the database engine.

    Subdomain 3.2: Implement a strategic security architecture to balance data protection and credit efficiency.

    23.A retail company recently enabled Snowflake Cortex AI functions to allow analysts to perform sentiment analysis on customer reviews. A security alert triggers, showing a massive spike in serverless credit consumption attributed to the SNOWFLAKE.CORTEX.COMPLETE function by a single analyst's user account over the weekend. What is the most critical security implication of this anomaly?

    1. A.The analyst's account may be compromised and is being used to bulk-process unauthorized external data or perform prompt injection attacks using Snowflake's LLM compute.
    2. B.The Cortex AI function is automatically retraining its underlying LLM using the company's customer reviews, consuming excessive credits.
    3. C.The analyst accidentally triggered a Search Optimization Service build on the customer reviews table, which uses Cortex AI under the hood.
    4. D.The Snowflake account has exceeded its storage quota, forcing Cortex AI to use expensive serverless compute to compress the data.
    Show answer & explanation

    Correct answer: A — The analyst's account may be compromised and is being used to bulk-process unauthorized external data or perform prompt injection attacks using Snowflake's LLM compute.

    • A. Correct. A sudden spike in serverless credit consumption (specifically for LLM functions like COMPLETE) by a single user account outside of normal business hours is a primary indicator of account compromise. Unauthorized users may utilize the company's Snowflake compute to process their own large datasets or conduct prompt injection attacks, leading to significant financial loss and potential data exfiltration.
    • B. Incorrect. Snowflake Cortex AI functions use pre-trained foundation models for inference. They do not automatically retrain these models using customer data during function calls. Training or fine-tuning models is a separate, highly controlled process.
    • C. Incorrect. The Search Optimization Service and Snowflake Cortex AI are distinct features. Search Optimization creates search access paths to improve query performance and does not use the CORTEX.COMPLETE LLM function to build its metadata.
    • D. Incorrect. In Snowflake, storage management (including compression) and compute resources (like Cortex AI serverless credits) are handled independently. Exceeding a storage quota would not trigger LLM-based serverless compute usage.

    Subdomain 3.2: Implement a strategic security architecture to balance data protection and credit efficiency.

    24.A security engineer is designing a Row-Level Security (RLS) architecture for a multi-tenant SaaS application. They can either hardcode the role checks in the policy definition or use a mapping table, as shown below: CREATE ROW ACCESS POLICY rap_tenant AS (tenant_id VARCHAR) RETURNS BOOLEAN -> CURRENT_ROLE() = 'ADMIN' OR EXISTS (SELECT 1 FROM tenant_mapping WHERE role_name = CURRENT_ROLE() AND tenant_id = tenant_id); To balance data protection with credit efficiency, why might the engineer choose the mapping table approach despite a potential performance hit?

    1. A.Mapping tables completely eliminate the need for virtual warehouse compute, as they are evaluated entirely within the Cloud Services layer.
    2. B.Mapping tables allow security administrators to update access rules by simply updating rows in a table, significantly reducing the operational overhead of altering the policy definition every time a tenant is added.
    3. C.Hardcoded role checks bypass Snowflake's result cache, whereas mapping tables guarantee that queries will always be served from the cache.
    4. D.Mapping tables automatically encrypt the protected rows using a different KMS key per tenant, providing stronger data isolation.
    Show answer & explanation

    Correct answer: B — Mapping tables allow security administrators to update access rules by simply updating rows in a table, significantly reducing the operational overhead of altering the policy definition every time a tenant is added.

    • A. Incorrect. Evaluating a row access policy, particularly one involving a subquery against a mapping table, still requires virtual warehouse compute. The logic is not executed solely within the Cloud Services layer in a manner that eliminates warehouse usage.
    • B. Correct. Using a mapping table makes access control data-driven, providing flexibility and scalability. In a multi-tenant environment, tenant lists change frequently; updating a table (DML) is much more operationally efficient than altering a security policy (DDL) every time a tenant is added or modified. This reduces management complexity and prevents the need for constant policy redeployment.
    • C. Incorrect. The choice between hardcoded checks and a mapping table does not inherently determine result cache behavior. Result caching depends on query patterns, session state, and whether the underlying data has changed, not the method of RLS implementation.
    • D. Incorrect. Mapping tables and Row Access Policies are authorization and filtering mechanisms, not encryption controls. Snowflake's encryption hierarchy and KMS key management are separate from the logic used in RLS policies.

    Domain 4: Threats, Risk Assessment, Incident Response, and Forensics

    Subdomain 4.1: Perform threat modeling, identification, and analyses.

    25.During a threat analysis of data entry points, an engineer suspects that an outdated, vulnerable version of the Snowflake JDBC driver is being used by a legacy application to connect to the database. Which view should the engineer query to identify the specific driver version being used by active connections?

    1. A.SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY
    2. B.SNOWFLAKE.ACCOUNT_USAGE.SESSIONS
    3. C.SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
    4. D.SNOWFLAKE.ACCOUNT_USAGE.CLIENT_HISTORY
    Show answer & explanation

    Correct answer: B — SNOWFLAKE.ACCOUNT_USAGE.SESSIONS

    • A. Incorrect. The LOGIN_HISTORY view provides details regarding authentication events, such as login status, IP addresses, and authentication methods, but it does not capture the specific client driver version details.
    • B. Correct. The SESSIONS view in the SNOWFLAKE.ACCOUNT_USAGE schema contains metadata for established sessions. Specifically, the CLIENT_APPLICATION_ID column identifies the driver type and version (e.g., 'JDBC 3.13.29') used for the connection.
    • C. Incorrect. The QUERY_HISTORY view is designed for auditing executed SQL statements and performance metrics. It does not provide the specific driver version metadata associated with the session.
    • D. Incorrect. CLIENT_HISTORY is not a standard Snowflake Account Usage view. Metadata regarding client drivers and application versions for connections is stored within the SESSIONS view.

    Subdomain 4.1: Perform threat modeling, identification, and analyses.

    26.A threat model identifies that users often leave their Snowflake web interface sessions open on shared workstations, leading to a risk of unauthorized access. The security engineer wants to mitigate this by enforcing strict timeout controls. Which parameters can be configured within a Snowflake Session Policy to address this threat?(Select 2)

    1. A.SESSION_IDLE_TIMEOUT_MINS
    2. B.SESSION_UI_IDLE_TIMEOUT_MINS
    3. C.CLIENT_SESSION_KEEP_ALIVE
    4. D.MAX_CONCURRENCY_LEVEL
    5. E.LOCK_TIMEOUT
    Show answer & explanation

    Correct answers: A, B — SESSION_IDLE_TIMEOUT_MINS; SESSION_UI_IDLE_TIMEOUT_MINS

    • A. SESSION_IDLE_TIMEOUT_MINS is one of the two parameters configurable within a Snowflake Session Policy. It determines the number of minutes of inactivity after which a session (across all clients) is terminated, directly helping to secure unattended workstations.
    • B. SESSION_UI_IDLE_TIMEOUT_MINS is a parameter specifically for Snowflake Session Policies that controls the idle timeout for the Snowflake web interface (Snowsight and Classic Console). This is the most direct mitigation for the scenario described, where users leave browser sessions open.
    • C. CLIENT_SESSION_KEEP_ALIVE is a session parameter used to prevent timeouts by sending heartbeat signals. It is not part of a Session Policy object and would actually worsen the risk described by keeping sessions active.
    • D. MAX_CONCURRENCY_LEVEL is a parameter for virtual warehouses that controls how many statements can run concurrently; it has no role in session timeout or Session Policies.
    • E. LOCK_TIMEOUT is a session parameter that specifies the amount of time a statement waits for a resource lock before being canceled. It cannot be configured within a Session Policy object.

    Subdomain 4.2: Perform risk assessment and manage risk.

    27.A company is sharing aggregated sales data with an external partner via a Direct Share. During a risk assessment, the security engineer notices the shared object is a standard view, not a secure view. What is the primary security risk associated with this configuration?

    1. A.The external partner can view the view's DDL and potentially infer sensitive underlying data or business logic.
    2. B.The external partner can execute DML operations (INSERT/UPDATE) on the underlying tables.
    3. C.The standard view will bypass any network policies configured on the provider account.
    4. D.The standard view automatically grants the partner access to all other tables in the same schema.
    Show answer & explanation

    Correct answer: A — The external partner can view the view's DDL and potentially infer sensitive underlying data or business logic.

    • A. Correct. Standard views allow users with the necessary privileges (or in the case of sharing, the consumer) to see the view's definition (DDL) using GET_DDL or metadata commands. This can expose sensitive business logic, table names, or join conditions. Secure views are specifically designed to hide this definition from unauthorized users and consumers, and they also prevent certain query optimizations that could inadvertently leak data through error messages.
    • B. Incorrect. All data sharing in Snowflake (Direct Share or Snowflake Marketplace) is strictly read-only for the consumer. External partners cannot execute DML operations like INSERT, UPDATE, or DELETE on the provider's underlying tables.
    • C. Incorrect. Network policies control access to the Snowflake account and session restrictions based on IP addresses. These policies apply regardless of whether the shared object is a standard view, a secure view, or a table.
    • D. Incorrect. Snowflake follows a strict explicit permission model. Sharing a specific view only grants access to that specific object; it does not automatically grant access to other tables or objects within the same schema.

    Subdomain 4.3: Identify and manage security incidents.

    28.During a security incident, a malicious actor gained access to a service account and executed a massive unauthorized `UPDATE` statement on the `CUST_DATA` table exactly 2 hours ago. The table has a Time Travel retention period of 1 day. Which command is the most efficient way to recover the data to its state just before the malicious update?

    1. A.UNDROP TABLE CUST_DATA;
    2. B.CREATE TABLE CUST_DATA_RESTORE AS SELECT * FROM CUST_DATA AT(OFFSET => -7200);
    3. C.ALTER TABLE CUST_DATA RESTORE TO (TIMESTAMP => CURRENT_TIMESTAMP - INTERVAL '2 HOURS');
    4. D.CALL SYSTEM$RESTORE_TABLE('CUST_DATA', -7200);
    Show answer & explanation

    Correct answer: B — CREATE TABLE CUST_DATA_RESTORE AS SELECT * FROM CUST_DATA AT(OFFSET => -7200);

    • A. Incorrect. The `UNDROP TABLE` command is specifically used to restore a table that has been dropped using the `DROP` command. It cannot be used to revert row-level data modifications or updates within an existing table.
    • B. Correct. Using Time Travel with the `AT(OFFSET => -7200)` clause (where 7200 seconds equals 2 hours) allows you to query the state of the table as it existed before the unauthorized update. Creating a new table from this snapshot is a standard and effective way to recover data within the retention window.
    • C. Incorrect. This syntax is invalid in Snowflake. Snowflake does not support an `ALTER TABLE ... RESTORE TO` command for point-in-time recovery of data. Table recovery is performed using Time Travel query syntax (`AT` or `BEFORE`) often combined with `CLONE` or `CREATE TABLE AS SELECT`.
    • D. Incorrect. `SYSTEM$RESTORE_TABLE` is not a valid Snowflake system function. Time Travel recovery is handled through standard SQL syntax using the `AT` or `BEFORE` clauses.

    Subdomain 4.4: Conduct a post-security-incident forensic analysis.

    29.A user queried a view named `V_CUST_SUMMARY` which aggregates and masks underlying PII from the `CUSTOMERS` table. During a forensic investigation, the security engineer needs to determine if the underlying PII columns in the `CUSTOMERS` table were ultimately accessed during this specific query. Which field in `SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY` must the engineer review?

    1. A.DIRECT_OBJECTS_ACCESSED
    2. B.BASE_OBJECTS_ACCESSED
    3. C.OBJECTS_MODIFIED
    4. D.POLICIES_REFERENCED
    Show answer & explanation

    Correct answer: B — BASE_OBJECTS_ACCESSED

    • A. Incorrect. DIRECT_OBJECTS_ACCESSED shows only the objects directly referenced in the SQL text of the query. In this scenario, it would identify the view `V_CUST_SUMMARY`, but not the underlying tables or columns that the view definition uses.
    • B. Correct. BASE_OBJECTS_ACCESSED identifies the underlying base tables and columns that were ultimately accessed to resolve the query, even if the query targeted a view or a multi-layered hierarchy of objects. This is essential for forensic investigations to determine if specific PII data was read.
    • C. Incorrect. OBJECTS_MODIFIED is used to track data changes via DML operations (INSERT, UPDATE, DELETE, MERGE). Since the query against the view is a read operation (SELECT), this field is not used for determining column access.
    • D. Incorrect. POLICIES_REFERENCED tracks which row access policies or masking policies were applied during the execution of the query. While useful for auditing policy enforcement, it does not provide the lineage of the physical data objects accessed like the base columns.

    Subdomain 4.4: Conduct a post-security-incident forensic analysis.

    30.An attacker dropped a critical schema named `PROD_DB.FINANCE_SCHEMA`. The incident was discovered 12 hours later. The security engineer needs to identify the exact user and role that executed the `DROP SCHEMA` command. Which approach is the most efficient way to find this information?

    1. A.Query SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY filtering by QUERY_TYPE = 'DROP' and QUERY_TEXT ILIKE '%FINANCE_SCHEMA%'
    2. B.Query SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY and look for the schema name in the OBJECTS_MODIFIED column
    3. C.Use the UNDROP SCHEMA PROD_DB.FINANCE_SCHEMA command, then check the OWNER property in INFORMATION_SCHEMA.SCHEMATA
    4. D.Query SNOWFLAKE.ACCOUNT_USAGE.SCHEMATA and filter by DELETED IS NOT NULL
    Show answer & explanation

    Correct answer: A — Query SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY filtering by QUERY_TYPE = 'DROP' and QUERY_TEXT ILIKE '%FINANCE_SCHEMA%'

    • A. Correct. The SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY view is the primary audit log for all SQL statements executed in an account (retained for 365 days). It records the USER_NAME, ROLE_NAME, and the full QUERY_TEXT, which is the most direct and efficient way to attribute a specific command like DROP SCHEMA to an individual user.
    • B. Incorrect. ACCESS_HISTORY is used for tracking data access (reads) and object lineage (writes). While it does track some DDL operations for tables and views, it currently does not comprehensively track schema-level DDL like DROP SCHEMA. Furthermore, parsing the OBJECTS_MODIFIED JSON column is less efficient for this purpose than searching QUERY_HISTORY.
    • C. Incorrect. While UNDROP SCHEMA can recover the deleted object within the Time Travel retention period, the current OWNER of the schema (found in INFORMATION_SCHEMA) only indicates which role holds the ownership privilege. It does not provide historical forensic data on which user or role performed the deletion.
    • D. Incorrect. The ACCOUNT_USAGE.SCHEMATA view provides metadata about schemas and includes a DELETED column which confirms when a schema was dropped. However, this view does not record the user or role responsible for the drop, making it insufficient for identifying the attacker.

    Domain 5: Securing Snowflake Services and Features for AI/ML and Applications

    Subdomain 5.2: Leverage Snowflake Cortex AI to enhance data security.

    31.An organization has ingested millions of raw customer support chat transcripts into a Snowflake table. The security team needs to identify which transcripts contain sensitive information (like credit card numbers or health data) so they can apply appropriate object tagging and masking policies. Which Snowflake Cortex approach is the most efficient and native way to achieve this?

    1. A.Export the data to an external AWS Macie bucket using an external stage, then import the tags back into Snowflake.
    2. B.Create a Python UDF that uses regular expressions to search for known sensitive data patterns.
    3. C.Apply the SNOWFLAKE.CORTEX.CLASSIFY_TEXT() function to the transcript column to automatically identify and tag sensitive data categories.
    4. D.Use SNOWFLAKE.CORTEX.SUMMARIZE() to reduce the text size, then manually review the summaries for sensitive data.
    Show answer & explanation

    Correct answer: C — Apply the SNOWFLAKE.CORTEX.CLASSIFY_TEXT() function to the transcript column to automatically identify and tag sensitive data categories.

    • A. Exporting data to an external service like AWS Macie introduces unnecessary complexity, data movement risks, and egress costs. It is not a native Snowflake solution and requires manual overhead to synchronize tags back into the platform.
    • B. While Python UDFs using regular expressions can detect simple patterns, they are brittle, difficult to maintain for varied sensitive data types, and lack the advanced semantic understanding of native AI functions. This method is also less efficient for processing millions of free-form text records compared to Cortex models.
    • C. SNOWFLAKE.CORTEX.CLASSIFY_TEXT() is the native Snowflake Cortex AI function specifically designed to categorize unstructured text. It is highly scalable and integrated directly into the Snowflake environment, making it the most efficient way to identify PII or sensitive categories in transcripts to drive object tagging and masking workflows.
    • D. SNOWFLAKE.CORTEX.SUMMARIZE() is intended to condense long text into shorter versions. It is not designed to identify sensitive data categories. Relying on manual review of summaries for millions of records is not scalable, cost-effective, or reliable for security compliance.

    Subdomain 5.2: Leverage Snowflake Cortex AI to enhance data security.

    32.A company is deploying Cortex Analyst to allow business users to ask natural language questions about their sales data. The underlying tables have strict Row Access Policies applied based on the user's region. The semantic model for Cortex Analyst is defined in a YAML file. How does Snowflake ensure that users only see data they are authorized to view when using Cortex Analyst?

    1. A.The semantic model YAML file must explicitly map each user role to their allowed regions using the security_filters property.
    2. B.Cortex Analyst executes the generated SQL using the active role of the user making the request, automatically enforcing all underlying Row Access Policies.
    3. C.A dedicated secure view must be created specifically for Cortex Analyst, as it bypasses standard Row Access Policies to optimize query generation.
    4. D.The security engineer must grant the CORTEX_ANALYST_ROLE explicit SELECT access to the Row Access Policies.
    Show answer & explanation

    Correct answer: B — Cortex Analyst executes the generated SQL using the active role of the user making the request, automatically enforcing all underlying Row Access Policies.

    • A. Incorrect. The semantic model YAML file is used to define metadata and semantics (logical layer) for query generation, not for row-level security mapping. Snowflake relies on its native security model, so duplicating role-to-region mappings in the YAML would be redundant and error-prone.
    • B. Correct. Cortex Analyst operates within the security context of the user making the request. When it generates SQL based on a natural language query, that SQL is executed using the active role of the session. Therefore, any Row Access Policies (RAPs) or Masking Policies applied to the underlying tables are automatically enforced by the Snowflake query engine.
    • C. Incorrect. Cortex Analyst does not bypass Snowflake's standard security controls. There is no requirement to create secure views specifically for Cortex Analyst to ensure security enforcement, as the engine applies RAPs during the execution of the generated query.
    • D. Incorrect. Row Access Policies are not objects to which you grant 'SELECT' access. Furthermore, there is no requirement for a specific CORTEX_ANALYST_ROLE to have access to the policy definition itself; the policy is automatically applied based on the table's configuration and the user's role context at query time.

    Subdomain 5.1: Secure and govern applications with Snowpark Container Services.

    33.Snowpark Container Services allows administrators to control network traffic using Network Rules and Integrations. Which of the following statements accurately describe the network security model for SPCS?(Select 3)

    1. A.By default, services have no outbound internet access unless an External Access Integration is configured.
    2. B.Inbound access to a service from the public internet is enabled by default for all ports.
    3. C.Inbound access to a public service endpoint is governed by the account's Snowflake Network Policies.
    4. D.Outbound network rules must specify `TYPE = HOST_PORT` to allow traffic to specific external domains.
    5. E.Compute pools automatically share a single VPC peering connection with external AWS accounts.
    6. F.Network rules for SPCS can only be applied at the account level, not the service level.
    Show answer & explanation

    Correct answers: A, C, D — By default, services have no outbound internet access unless an External Access Integration is configured.; Inbound access to a public service endpoint is governed by the account's Snowflake Network Policies.; Outbound network rules must specify `TYPE = HOST_PORT` to allow traffic to specific external domains.

    • A. Correct. Snowpark Container Services (SPCS) are isolated by default. To enable egress to the internet or external services, an External Access Integration (which references a Network Rule) must be explicitly configured and associated with the service.
    • B. Incorrect. Public inbound access is not enabled by default. A service must define an endpoint in its specification file and be configured to expose that endpoint to the internet.
    • C. Correct. Access to SPCS public service endpoints is controlled by Snowflake Network Policies. If a client's IP address is blocked by the account-level network policy, they will be unable to access the service endpoint.
    • D. Correct. In Snowflake, to allow traffic to specific external domains or hostnames in a Network Rule, the `TYPE` attribute must be set to `HOST_PORT`. This rule is then used within an External Access Integration for SPCS egress.
    • E. Incorrect. SPCS networking is managed via Snowflake-controlled mechanisms (integrations and network rules). It does not rely on customers managing automatic VPC peering connections with external AWS accounts for standard service operation.
    • F. Incorrect. While Network Rules are schema-level objects, they are applied to specific services via External Access Integrations (for outbound) or Network Integrations (for inbound), providing granular control rather than just account-wide application.

    Subdomain 5.3: Manage security in Snowflake Native Apps.

    34.A provider is packaging a Native App that runs a machine learning model inside Snowpark Container Services (SPCS). The container needs to download model weights from an external AWS S3 bucket at runtime. What is the most secure way to allow this egress traffic while preventing the container from accessing any other external endpoints?

    1. A.Open port 443 in the container's Dockerfile to allow all outbound HTTPS traffic.
    2. B.Request the consumer to disable the EGRESS_RESTRICT parameter on the compute pool.
    3. C.Define a Network Rule specifying the S3 bucket URL, create an External Access Integration using this rule, and bind it to the SPCS service in the Native App.
    4. D.Use a Snowflake Secret to store the S3 URL and pass it as an environment variable to the container.
    Show answer & explanation

    Correct answer: C — Define a Network Rule specifying the S3 bucket URL, create an External Access Integration using this rule, and bind it to the SPCS service in the Native App.

    • A. Opening ports in a Dockerfile does not control Snowflake's network security policy. Furthermore, allowing 'all' outbound HTTPS traffic is not secure as it fails to restrict access to the specific, required S3 bucket, violating the principle of least privilege.
    • B. Disabling egress restrictions (even if such a parameter were available on the pool) would broaden network access rather than limit it. This approach increases the attack surface and would allow the container to communicate with any external endpoint, directly contradicting the requirement.
    • C. The most secure and recommended pattern for Snowpark Container Services is to define a Network Rule specifying the allowed hostname and port, then create an External Access Integration (EAI) based on that rule. Binding this EAI to the SPCS service ensures that the container can only reach the specified S3 bucket and is blocked from all other external traffic.
    • D. Snowflake Secrets and environment variables are tools for managing credentials and configuration data. They do not provide network-level egress control or firewall capabilities, so they cannot prevent the container from accessing unauthorized endpoints.

    Subdomain 5.3: Manage security in Snowflake Native Apps.

    35.How do Application Roles function within the context of a Snowflake Native App to enforce User-Based Access Control (UBAC)?(Select 3)

    1. A.Application roles are defined by the provider in the setup script.
    2. B.Application roles can be granted to account roles in the consumer account by the consumer administrator.
    3. C.Application roles automatically inherit all privileges of the consumer's ACCOUNTADMIN role.
    4. D.The provider can grant application roles directly to specific Snowflake users in the consumer account during installation.
    5. E.Application roles allow the provider to bundle specific privileges on the app's internal objects (like views or UDFs) for different types of users.
    6. F.Application roles are global and can be shared across multiple different Native Apps installed in the same account.
    Show answer & explanation

    Correct answers: A, B, E — Application roles are defined by the provider in the setup script.; Application roles can be granted to account roles in the consumer account by the consumer administrator.; Application roles allow the provider to bundle specific privileges on the app's internal objects (like views or UDFs) for different types of users.

    • A. Correct. Application roles are declared by the provider within the setup script using the CREATE APPLICATION ROLE command. This allows the provider to define the internal access control structure of the application.
    • B. Correct. This is the primary mechanism for UBAC in Native Apps. Consumer administrators grant these application-specific roles to their own account roles (e.g., ANALYST, FINANCE_MGR), effectively delegating access to their users.
    • C. Incorrect. Application roles are granular and scoped to the application. They do not inherit the highly privileged ACCOUNTADMIN role. In Snowflake's RBAC model, roles inherit privileges through explicit grants in a hierarchy.
    • D. Incorrect. To maintain a secure boundary, Snowflake does not allow providers to see or manage individual users or roles within a consumer's account. The consumer administrator must manage the assignment of application roles.
    • E. Correct. Application roles are designed to group together various privileges on internal objects (like hidden views, stored procedures, or UDFs) into a single functional package that the provider can then expose to the consumer's users.
    • F. Incorrect. Application roles are strictly scoped to the specific application instance where they were created. They are not global objects and cannot be shared across different Native App installations.

    Want the full experience?

    These are just samples. Practice the full Snowflake SnowPro Advanced: Security Engineer (SEA-C01) question bank in quiz mode — free, no signup, with domain practice and exam simulation.

    Practice all 346 questions in quiz mode