SnowPro® Advanced: Security Engineer flashcards
SAE-C01 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Primary role
- The single active role in a session that determines the privileges in effect; secondary roles can add privileges but the primary role governs ownership and context.
- Secondary roles
- Additional roles enabled with USE SECONDARY ROLES ALL that contribute privileges alongside the primary role; they cannot override the primary role's ownership.
- Role hierarchy inheritance
- Privileges flow downward through granted roles: a parent role inherits all privileges of its child roles, but a child never inherits the parent's privileges.
- ACCOUNTADMIN role
- The top-level account role that encompasses SYSADMIN and SECURITYADMIN; it should be tightly restricted and protected with MFA due to its broad privileges.
- SECURITYADMIN role
- The role that manages users and grants; it can create and manage roles and has the MANAGE GRANTS privilege to administer access across the account.
- Future grants
- Grants made ON FUTURE TABLES or FUTURE SCHEMAS in a schema that automatically apply to objects created later, reducing manual grant maintenance.
- Object tagging
- Schema-level tags applied to tables, columns, or other objects to classify data; tags can drive masking and are reported in governance views.
- Key-pair authentication
- An RSA public key registered on the user and a private key held by the client; the client proves identity by signing, so no password crosses the network.
- SAML SSO federation
- Snowflake delegates authentication to an external identity provider, validates the signed SAML assertion, and maps the federated user to a Snowflake user account.
- OAuth security integration
- Configuration where an external authorization server issues access tokens; Snowflake validates the presented token against the integration to authenticate the client.
- SCIM provisioning
- Automated synchronization of users and roles from an identity provider into Snowflake through a security integration, simplifying onboarding and offboarding.
- Authentication policy
- An account- or user-level policy controlling allowed authentication methods, MFA enrollment requirements, and permitted client types for sign-in.
- Password policy
- A policy object enforcing password length, complexity, reuse, and lockout rules for users who authenticate with passwords.
- Network policy
- An object with ALLOWED_IP_LIST and BLOCKED_IP_LIST that restricts which IP addresses may connect; blocked entries take precedence over allowed entries.
- MFA enforcement
- Requiring multi-factor authentication for sign-in; Snowflake enforces MFA for ACCOUNTADMIN password logins by default and can require it account-wide via policy.
- Envelope encryption
- A hierarchical key scheme where a root key protects account keys, which protect table keys, which in turn encrypt the actual data at rest.
- Tri-Secret Secure
- Customer-managed key model combining a Snowflake-held key with a customer key in a cloud KMS; revoking the customer key makes data unreadable.
- Key rotation
- Periodic replacement of encryption keys; Snowflake rotates managed keys automatically and re-encrypts table master keys without rewriting table data.
- Dynamic data masking
- A masking policy attached to a column that returns a transformed value at query time depending on the querying role, leaving stored data unchanged.
- Tag-based masking
- Attaching a masking policy to a tag so that every column carrying that tag is masked automatically, avoiding per-column policy attachment.
- Row access policy
- A policy that filters which rows a query returns based on a mapping table or role, applied at query time to SELECT statements.
- Projection policy
- A policy that restricts which columns a query may project, providing column-level access control without altering the stored values.
- Secure view
- A view whose definition is hidden from non-owners and whose query plan cannot leak underlying data, used to share sensitive logic safely.
- External tokenization
- Replacing sensitive values with tokens via an external function or service so that plaintext never lands in Snowflake tables.
- Private connectivity
- Connecting to Snowflake over a private endpoint using AWS PrivateLink, Azure Private Link, or Google Private Service Connect instead of the public internet.
- Network rule
- A reusable object defining an ingress or egress list of IP addresses or private endpoints, grouped into network policies or external access integrations.
- External access integration
- An object that grants outbound network access from Snowflake (e.g., external functions) to specified endpoints defined by network rules.
- Private endpoint authorization
- Enabling a cloud private endpoint on the account using SYSTEM$AUTHORIZE_PRIVATELINK so traffic reaches Snowflake without public exposure.
- Access history
- A view recording read and write access to objects, including which columns were read, supporting audit of who accessed which data.
- ACCOUNT_USAGE schema
- A shared schema of account-level views such as LOGIN_HISTORY and QUERY_HISTORY with up to one-year retention and latency of roughly 45 minutes.
- LOGIN_HISTORY view
- An audit view recording authentication attempts with success or failure, client IP, and method, useful for detecting unauthorized access attempts.
- Snowflake Trust Center
- A built-in security posture tool that scans the account for risks such as missing MFA or network policies and surfaces findings for remediation.