Execute Security Incident Response Protocols SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In the incident response lifecycle, which phase involves restoring affected systems and validating that they are operating securely before returning them to normal use?

   • ARecovery
   • BLessons Learned
   • CContainment
   • DEradication
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During an incident investigation, you discover that a compromised service account has been used to create a new warehouse and run heavy queries. You need to contain the incident while preserving evidence for forensic analysis. Which action should you take FIRST?

   • ANotify the security team and wait for further instructions
   • BChange the service account's password and rotate credentials
   • CDisable the compromised service account and suspend the warehouse
   • DDrop the warehouse created by the compromised account
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst is triaging a potential incident where a user's credentials were used to run a series of queries that returned sensitive data. The analyst needs to determine the scope of the incident. Which combination of data sources would provide the MOST comprehensive view of the incident's scope?

   • AQuery history, access history, and login history
   • BBilling statements and account usage reports
   • CNetwork policies and IP allowlists
   • DWarehouse usage metrics and storage usage reports
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security engineer at a large enterprise discovers that a compromised user has been using a role with elevated privileges to create and drop tables in a production database. The engineer needs to contain the incident while minimizing disruption to business operations. Which action BEST balances containment and business continuity?

   • AChange the password for all users with the elevated role
   • BDrop the elevated role immediately
   • CSuspend all warehouses in the production account
   • DDisable the compromised user and revoke the elevated role from the user
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of communication protocols during a security incident?

   • ATo notify stakeholders and escalate incidents appropriately
   • BTo disable compromised users
   • CTo restore affected systems
   • DTo collect forensic evidence
   Reveal Solution Discussion Select an answer first