Your organization has a policy that all data sharing must be through secure shares and not through public exposure. You need to monitor for any shares that are created with the PUBLIC role. Which approach would be most effective?

Query the SHARES view in ACCOUNT_USAGE for shares where the consumer account is PUBLIC.

Check the GRANTS_TO_USERS view for PUBLIC role grants.

Review the QUERY_HISTORY for any CREATE SHARE statements.

Create an alert that queries the SHARES view for any share with the PUBLIC consumer and sends a notification.

A security engineer notices that a user with the ACCOUNTADMIN role has been executing `CREATE USER` statements at unusual hours. The engineer suspects the user's credentials may be compromised. Which approach would provide the most direct evidence to confirm or refute this suspicion?

Query the QUERY_HISTORY view for the user's recent SQL statements and correlate with LOGIN_HISTORY for successful authentications.

Enable the ACCOUNTADMIN role's MFA and require re-authentication for the user.

Review the ACCESS_HISTORY view to see which tables the user has accessed recently.

Check the SESSIONS view to see if the user has multiple active sessions.

A security auditor wants to verify that no user has been granted the ACCOUNTADMIN role without proper approval. Which query would provide the most complete list of users with this role?

SELECT USER_NAME FROM SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY WHERE USER_NAME IN (SELECT GRANTEE_NAME FROM SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS WHERE ROLE = 'ACCOUNTADMIN')

SELECT NAME FROM SNOWFLAKE.ACCOUNT_USAGE.USERS WHERE DEFAULT_ROLE = 'ACCOUNTADMIN'

SELECT GRANTEE_NAME FROM SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS WHERE ROLE = 'ACCOUNTADMIN'

SELECT DISTINCT ROLE FROM SNOWFLAKE.ACCOUNT_USAGE.ROLES WHERE NAME = 'ACCOUNTADMIN'

A security engineer is investigating a potential unauthorized access attempt. They see in the LOGIN_HISTORY that a user had multiple failed login attempts from an unfamiliar IP address. What is the most appropriate next step?

Correlate the failed attempts with any successful logins from the same IP and review subsequent query activity.

Change the user's password immediately.

Ignore the failed attempts because they are common.

Immediately lock the user's account.

Snowflake SnowPro Advanced:Security Engineer

Domain 3Objective 1

Audit and Monitor Security Policies and Controls SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 4)

Part of the Security Auditing and Compliance domain, which makes up ~22% of our current practice bank.

21questions here

5free pages

5concepts

Questions 16–20

16application · medium
Your organization has a policy that all data sharing must be through secure shares and not through public exposure. You need to monitor for any shares that are created with the PUBLIC role. Which approach would be most effective?
Select an answer first
17application · medium
A security engineer notices that a user with the ACCOUNTADMIN role has been executing `CREATE USER` statements at unusual hours. The engineer suspects the user's credentials may be compromised. Which approach would provide the most direct evidence to confirm or refute this suspicion?
Select an answer first
18application · medium
A security auditor wants to verify that no user has been granted the ACCOUNTADMIN role without proper approval. Which query would provide the most complete list of users with this role?
Select an answer first
19application · medium
A security engineer is investigating a potential unauthorized access attempt. They see in the LOGIN_HISTORY that a user had multiple failed login attempts from an unfamiliar IP address. What is the most appropriate next step?
Select an answer first
20application · medium
A financial institution must provide a quarterly report to regulators showing all access to customer data. Which Snowflake view should be the primary source for this report?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SNOWPRO-ADVANCED-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Snowflake. “SNOWPRO-ADVANCED-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.