What is the primary goal of the recovery phase in incident response?

To identify the root cause of the incident

To restore affected resources to a secure state

To limit the spread of the incident

During a forensic investigation of a suspected data breach, you need to preserve evidence that can be used in legal proceedings. Which action is MOST appropriate for evidence collection in Snowflake?

Keep all logs in Snowflake and do not copy them, to avoid altering the original

Copy relevant audit logs and query history to a secure external storage location

Modify the audit logs to remove any false positives

Delete any suspicious queries from the query history to prevent further exposure

After containing a security incident, you need to eradicate the root cause. The investigation reveals that a malicious UDF was created by a compromised user. Which action is part of eradication?

Disable the compromised user's login

Revoke the compromised user's access to the UDF

Suspend the warehouse that the UDF uses

Which action is an example of eradication in the incident response process?

Revoking compromised credentials

After containing a security incident, you need to eradicate the root cause. The investigation reveals that a malicious stored procedure was created by a compromised user and is scheduled to run via a task. Which set of actions BEST completes eradication?

Drop the stored procedure, disable the task, and revoke the compromised user's credentials

Change the compromised user's password and re-enable the task

Suspend the warehouse and disable the task, but keep the stored procedure for analysis

Restore the database from a backup and re-enable all users

Snowflake SnowPro Advanced:Security Engineer

Domain 4Objective 2

Execute Security Incident Response Protocols SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 4)

Part of the Threat and Risk Management domain, which makes up ~27% of our current practice bank.

29questions here

6free pages

9concepts

Questions 16–20

16foundation · easy
What is the primary goal of the recovery phase in incident response?
Select an answer first
17application · medium
During a forensic investigation of a suspected data breach, you need to preserve evidence that can be used in legal proceedings. Which action is MOST appropriate for evidence collection in Snowflake?
Select an answer first
18application · medium
After containing a security incident, you need to eradicate the root cause. The investigation reveals that a malicious UDF was created by a compromised user. Which action is part of eradication?
Select an answer first
19foundation · easy
Which action is an example of eradication in the incident response process?
Select an answer first
20application · medium
After containing a security incident, you need to eradicate the root cause. The investigation reveals that a malicious stored procedure was created by a compromised user and is scheduled to run via a task. Which set of actions BEST completes eradication?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SNOWPRO-ADVANCED-SECURITY-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Snowflake. “SNOWPRO-ADVANCED-SECURITY-ENGINEER” is a trademark of its owner, used for identification only.