Execute Security Incident Response Protocols SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a valid eradication step for a security incident in Snowflake?

   • ADropping a malicious object
   • BNotifying stakeholders
   • CDisabling a network policy
   • DRe-enabling a suspended warehouse
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a containment measure that can be applied to limit the spread of a security incident in Snowflake?

   • ADisabling a compromised user
   • BRestoring data from backups
   • CRevoking compromised credentials
   • DDropping a malicious object
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a key component of documenting actions during an incident response?

   • ASuspending all warehouses
   • BDeleting audit logs
   • CRecording the timeline of actions taken
   • DDisabling all users
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After resolving a security incident, your team conducts a post-incident review. Which outcome is the PRIMARY goal of this review?

   • AAssign blame to the individuals who caused the incident
   • BRestore all systems to their pre-incident state as quickly as possible
   • CIdentify gaps in the incident response process and update security policies
   • DDelete all evidence related to the incident to protect the company
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is an output of a post-incident review?

   • ARestored data from backups
   • BSuspended warehouses
   • CUpdated security policies
   • DRevoked credentials
   Reveal Solution Discussion Select an answer first