A security team wants to be alerted when a user with the ACCOUNTADMIN role executes a `DROP TABLE` statement. Which approach would be most efficient?

Create a task that runs every minute and checks QUERY_HISTORY for DROP TABLE statements.

Create an alert that queries QUERY_HISTORY for DROP TABLE statements by ACCOUNTADMIN users and sends a notification.

Use a stream on QUERY_HISTORY to capture new DROP TABLE statements.

Set up a resource monitor to alert on DROP TABLE statements.

Snowflake SnowPro Advanced:Security Engineer

Domain 3Objective 1

Audit and Monitor Security Policies and Controls SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 3)

Part of the Security Auditing and Compliance domain, which makes up ~22% of our current practice bank.

21questions here

5free pages

5concepts

Questions 11–15

11application · medium
A company must provide a report to a regulator showing all users who have been granted the ACCOUNTADMIN role in the last quarter. Which view would provide the historical grant information?
Select an answer first
12foundation · easy
A security engineer wants to receive an email notification when a user fails to log in multiple times. Which Snowflake feature can be used to set up this alert?
Select an answer first
13foundation · easy
Which Snowflake feature records all attempts to access data, including successful and failed attempts, and can be used to detect unauthorized access attempts?
Select an answer first
14application · medium
A security engineer is investigating a potential data exfiltration incident. They suspect that a user with a low-privilege role was able to access sensitive data by using a role hierarchy. Which view would best help them trace the effective privileges of the user?
Select an answer first
15application · medium
A security team wants to be alerted when a user with the ACCOUNTADMIN role executes a `DROP TABLE` statement. Which approach would be most efficient?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SNOWPRO-ADVANCED-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Snowflake. “SNOWPRO-ADVANCED-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.

Audit and Monitor Security Policies and Controls SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

A company must provide a report to a regulator showing all users who have been granted the ACCOUNTADMIN role in the last quarter. Which view would provide the historical grant information?

A security engineer wants to receive an email notification when a user fails to log in multiple times. Which Snowflake feature can be used to set up this alert?

Which Snowflake feature records all attempts to access data, including successful and failed attempts, and can be used to detect unauthorized access attempts?

A security engineer is investigating a potential data exfiltration incident. They suspect that a user with a low-privilege role was able to access sensitive data by using a role hierarchy. Which view would best help them trace the effective privileges of the user?

A security team wants to be alerted when a user with the ACCOUNTADMIN role executes a `DROP TABLE` statement. Which approach would be most efficient?

Keep studying — Security Auditing and Compliance