What is the primary goal of a post-incident review?

To identify gaps and improve future incident response procedures

After a security incident, your team conducts a post-incident review. Which action is part of the lessons learned phase?

Update the incident response plan based on identified gaps

Restore all systems to their pre-incident state as quickly as possible

Assign blame to the individuals who caused the incident

Delete all evidence related to the incident

Following a ransomware incident, you have eradicated the malicious objects and revoked the compromised credentials. You now need to recover affected Snowflake resources. Which action should be part of the recovery phase?

Disable all network policies to ensure no external access is blocked

Re-enable all users and roles that were disabled during containment

Restore data from a backup taken before the incident and validate its integrity

Drop all warehouses and recreate them from scratch

During an incident, you discover that a compromised role has been granted to multiple users. To contain the incident, which action should you take?

Change the password for all users who have the role

Revoke the role from all users and disable the role

Suspend all warehouses that the role can access

Snowflake SnowPro Advanced:Security Engineer

Domain 4Objective 2

Execute Security Incident Response Protocols SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 1)

Part of the Threat and Risk Management domain, which makes up ~27% of our current practice bank.

29questions here

6free pages

9concepts

Questions 1–5

1foundation · easy
What is the primary goal of a post-incident review?
Select an answer first
2foundation · easy
Which Snowflake view provides information about which users accessed specific data, useful for assessing the impact of a potential data breach?
Select an answer first
3application · medium
After a security incident, your team conducts a post-incident review. Which action is part of the lessons learned phase?
Select an answer first
4application · medium
Following a ransomware incident, you have eradicated the malicious objects and revoked the compromised credentials. You now need to recover affected Snowflake resources. Which action should be part of the recovery phase?
Select an answer first
5application · medium
During an incident, you discover that a compromised role has been granted to multiple users. To contain the incident, which action should you take?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SNOWPRO-ADVANCED-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Snowflake. “SNOWPRO-ADVANCED-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.