Execute Security Incident Response Protocols SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security incident has been confirmed in your Snowflake environment. According to your organization's communication protocol, which stakeholders should be notified FIRST?

   • AExternal auditors and regulatory bodies
   • BThe public and media
   • CThe incident response team and the security operations center (SOC)
   • DAll employees in the company
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During a forensic investigation, you need to preserve evidence from Snowflake. Which data source is MOST important to preserve for analyzing unauthorized access?

   • AStorage usage reports
   • BLogin history
   • CBilling statements
   • DWarehouse usage metrics
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which Snowflake object can be suspended to immediately stop query execution during a security incident?

   • ANetwork Policy
   • BWarehouse
   • CRole
   • DDatabase
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a common signal that could indicate a security incident in a Snowflake environment?

   • AA scheduled task completing successfully
   • BA user running a routine SELECT query on a small table
   • CA user logging in from a new geographic location at an unusual time
   • DA warehouse auto-suspending after a period of inactivity
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During a security incident, you need to escalate the issue to the appropriate team. Which action is part of effective communication and escalation?

   • AWait until the incident is fully resolved before notifying anyone
   • BNotify only the legal department
   • CKeep the incident confidential to avoid panic
   • DDocument all actions taken during the response
   Reveal Solution Discussion Select an answer first