SEA-C01 SnowPro Advanced: Security Engineer Practice Questions
Prepare for SEA-C01 with more than an answer.
- Exam fee
- $375 USD
- Time limit
- 115 minutes
- Questions on the exam
- 65
- Passing score
- 750 (scaled scoring from 0-1000) (scale 0-1000)
- Level
- Advanced
- Valid for
- 2 years
Domains covered on the exam 5
- Access Control and Identity Management22%
- Data Protection, Data Privacy, and Data Governance30%
- Auditing, Monitoring, and Compliance18%
- Threats, Risk Assessment, Incident Response, and Forensics18%
- Securing Snowflake Services and Features for AI/ML and Applications12%
- 1
A government agency uses Snowflake Tri-Secret Secure to protect highly sensitive data. The architecture combines a Snowflake-managed key and a Customer-Managed Key (CMK) hosted in AWS KMS to create a composite master key. If the agency's security team revokes Snowflake's access to the CMK in AWS KMS, what is the immediate impact on the Snowflake account?
Show answer details
Correct answer: A
With Tri-Secret Secure, the composite master key requires both the Snowflake key and the Customer-Managed Key (CMK). If access to the CMK is revoked, Snowflake cannot decrypt the data. By design, to prevent data exposure, Snowflake immediately blocks all data access, aborts running queries, and flushes data caches.
- 2
A healthcare provider is implementing Tag-Based Masking in Snowflake to govern access to Protected Health Information (PHI). The architecture involves a complex tag hierarchy.
The security architect applies a tag named
CONFIDENTIALITY='HIGH'at the schema level, which has a masking policy that masks all string columns as***HIGH***. They also apply a tag namedPII='TRUE'at a specific column level (PATIENT_NAME), which has a masking policy that masks strings as***PII***.During an audit, an analyst with a role that is NOT exempted by either masking policy runs a
SELECT PATIENT_NAME FROM PATIENTSquery.According to Snowflake's tag lineage and masking policy precedence rules, what will the analyst see in the
PATIENT_NAMEcolumn?Show answer details
Correct answer: A
In Snowflake's tag-based masking framework, tags follow an inheritance hierarchy (Database -> Schema -> Table -> Column). However, when determining which masking policy to apply, a tag attached directly to the lowest-level object (the column) takes precedence over tags inherited from parent objects (the schema). Therefore, the policy associated with
PII='TRUE'applies.graph TD DB[Database] --> Sch[Schema: CONFIDENTIALITY='HIGH'] Sch --> Tab[Table: PATIENTS] Tab --> Col[Column: PATIENT_NAME, PII='TRUE'] style Col stroke:#f66,stroke-width:2px,stroke-dasharray: 5 5 note1[Tag on column overrides inherited schema tag] -.-> Col - 3
When sharing data using Snowflake Secure Data Sharing, a data provider often creates Secure Views to expose specific subsets of data. Which of the following statements accurately describe the internal behavior of Secure Views compared to standard views? (Select TWO)
Show answer details
Correct answer: A, D
To prevent malicious users from inferring hidden data (e.g., via query execution times or error messages in standard views), the Snowflake query optimizer restricts certain optimizations (like pushing filters down before evaluating view logic) when processing Secure Views.
One of the primary purposes of a Secure View is to hide the underlying business logic and table structures. Users without explicit ownership cannot view the definition using
GET_DDLor by querying theINFORMATION_SCHEMA. - 4
A security engineer is configuring authentication policies in Snowflake for a multinational enterprise. The organization has set an account-level authentication policy that requires multi-factor authentication (MFA) for all users. However, a specific service account named
ETL_SVC_ACCOUNTis used by an automated pipeline that cannot process MFA prompts. The engineer creates a new authentication policy that disables the MFA requirement and assigns it directly to theETL_SVC_ACCOUNTuser. When the ETL pipeline attempts to connect, which of the following describes the outcome?Show answer details
Correct answer: D
In Snowflake, when authentication policies are applied at multiple levels, the most granular level takes precedence. A policy attached directly to a user overrides a policy attached to the account. Therefore, the user-level policy disabling MFA will apply to the service account, allowing the automated pipeline to connect successfully.
- 5
An organization is enforcing strict discretionary access control (DAC) by utilizing Managed Access Schemas. A data engineer with a custom role named
DATA_ENGINEER_ROLEcreates a new table within a Managed Access Schema. Which of the following entities have the authority to grant privileges on this newly created table to other roles? (Select TWO)Show answer details
Correct answer: B, C
In a Managed Access Schema, the schema owner manages all privilege grants, including future grants, on objects within the schema. The role that creates an object inside the schema (the object owner) loses the ability to grant privileges on that object to other roles.
Roles with the global
MANAGE GRANTSprivilege (typicallySECURITYADMINorACCOUNTADMIN) bypass standard ownership restrictions and can grant or revoke privileges on any object, including those within a Managed Access Schema. - 6
A financial services institution is building a custom web application that requires access to Snowflake data. The security architecture mandates the use of OAuth for delegating authorization. The application will act as an external OAuth client.
The security engineering team needs to configure a security integration in Snowflake for this custom client. The requirements stipulate that the access tokens issued must expire in exactly 30 minutes to minimize the window of exposure, and refresh tokens must not be issued to this specific client due to the application's stateless nature.
During the implementation, the lead engineer creates the security integration using the
CREATE SECURITY INTEGRATIONcommand. However, during testing, the security team notices that the application is still receiving refresh tokens, and the access tokens are valid for the default 10 minutes rather than the requested 30 minutes.Based on this scenario, which combination of properties must be explicitly set on the security integration to meet the strict security requirements?
Show answer details
Correct answer: B
To configure a custom OAuth client in Snowflake, the security integration must be created with
TYPE = OAUTHandOAUTH_CLIENT = CUSTOM. TheOAUTH_ACCESS_TOKEN_VALIDITYproperty is specified in seconds, so 30 minutes equals 1800 seconds. To prevent the issuance of refresh tokens,OAUTH_ISSUE_REFRESH_TOKENSmust be set toFALSE. Setting these exact parameters ensures the tokens adhere to the stringent 30-minute lifespan without refresh capabilities.sequenceDiagram participant App as Custom Web App participant Auth as Authorization Server participant SF as Snowflake App->>Auth: Request Authorization Auth-->>App: Authorization Grant App->>Auth: Exchange Grant for Token Auth-->>App: Access Token (Expires in 1800s, No Refresh) App->>SF: API Request + Access Token SF-->>App: Data Payload
