SnowPro® Advanced: Security Engineer common mistakes
SAE-C01 · Understand the traps and how to avoid them.
Assuming that creating a user with a custom role automatically makes that role the user's default role, then wondering why objects are inaccessible after login.
Candidates conflate role grants with default role assignment; a granted role is not active until set as default or activated in the session, and DEFAULT_ROLE must also be allowed by DEFAULT_SECONDARY_ROLES/USER's DEFAULT_ROLE setting.
What to do instead
Remember the two-step model: grant the role to the user AND set it as the default (or use ALTER USER ... SET DEFAULT_ROLE). Test the effective role with SELECT CURRENT_ROLE() after re-authenticating.
Treating a role hierarchy as granting privileges downward from child to parent, or assuming privileges flow both directions.
The inheritance direction is counterintuitive: a role inherits privileges from roles granted TO it (parent inherits from child), so granting analyst to admin means admin gets analyst's privileges, not the reverse.
What to do instead
Draw the hierarchy before answering. State explicitly 'privileges flow from the granted role to the grantee role.' Verify with SHOW GRANTS TO ROLE and a SHOW GRANTS OF ROLE check.
Assuming ACCOUNTADMIN or SECURITYADMIN bypasses object-level privilege checks or that ACCOUNTADMIN is required for routine administration.
ACCOUNTADMIN is powerful but is not a universal superuser for every object context, and best practice (and exam intent) is least privilege; candidates over-rely on it as a shortcut answer.
What to do instead
For each scenario ask 'what is the minimum role that can do this?' Use SECURITYADMIN for grants, USERADMIN for user/role creation, and reserve ACCOUNTADMIN for account-level settings.
Confusing masking policies with row access policies, or expecting a masking policy to filter rows rather than transform column values.
Both are column/row-level governance objects attached to tables, but masking policies return a transformed value per column while row access policies return a boolean to filter rows.
What to do instead
Memorize the signature difference: masking policy takes the column value and returns the same type; row access policy takes column arguments and returns BOOLEAN. Match the scenario to the return type.
Assuming masking policies automatically apply to all roles including the policy owner, or that they can be bypassed by querying a view.
Masking is evaluated at query time based on the role, but policy owners and roles with certain privileges can see unmasked data, and views can expose underlying data depending on ownership and secure-view status.
What to do instead
Check the policy body's role conditions and the object ownership chain. Use secure views or secure functions when the intent is to prevent exposure through view definitions.
Believing that data at rest is unprotected once a user has network access, or conversely that network policies encrypt data.
Candidates blend the network and encryption domains; Snowflake encrypts data at rest by default with hierarchical key management, and network policies only control connection sources, not data protection.
What to do instead
Separate the controls: encryption (at rest, in transit via TLS) is always on and not something you enable per query; network policies restrict IP ranges. Answer each question by naming which layer it targets.
Assuming network policies apply to all connection types by default, or that a policy with no allowed list blocks everything.
Network policies have account-level and user-level variants, and the semantics of allowed vs blocked IP lists (and the default behavior when a user has no policy) are easy to mix up.
What to do instead
Recall that a network policy can be set at the account level and overridden per user; an empty allowed list with a blocked list behaves differently than an empty blocked list. Reason through the policy composition before choosing.
Confusing key-pair authentication with OAuth or assuming key-pair auth requires a password fallback.
Key-pair authentication is a public/private key mechanism for programmatic access, distinct from SSO/OAuth flows and from password-based login; candidates mix the credential types.
What to do instead
Map each mechanism to its use case: key-pair for service/programmatic users, SSO/OAuth for human federated login, password for legacy. Assign the public key to the user and never share the private key.
Assuming query history or access history alone satisfies auditing, or that ACCESS_HISTORY shows all reads regardless of retention.
Candidates conflate QUERY_HISTORY (SQL executed), ACCESS_HISTORY (column-level read/write lineage), and LOGIN_HISTORY; each answers a different audit question and has its own retention window.
What to do instead
Match the audit question to the view: who logged in -> LOGIN_HISTORY; what SQL ran -> QUERY_HISTORY; which columns were read by whom -> ACCESS_HISTORY. Note the retention period (e.g., ACCESS_HISTORY is time-bounded) before assuming availability.
Assuming that object tagging or classification automatically enforces access control, or that a tag alone masks data.
Tags are metadata for governance and discovery; enforcement requires attaching a masking policy (possibly tag-based masking) or other policy. Candidates treat tagging as a control rather than a label.
What to do instead
Distinguish labeling from enforcement: tags classify, policies enforce. If the scenario asks how to prevent access, choose a masking/row access policy; if it asks how to discover or categorize sensitive data, choose tags/classification.