I85PREP
⌘ K
SAE-C01 study materials
SAE-C01 study resources

SnowPro® Advanced: Security Engineer practice questions

One question at a time. Build your SAE-C01 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Snowflake Security and Governance Fundamentals

Which Snowflake role is a system-defined role that owns all objects in an account and is intended for account-level administration?

  1. ACCOUNTADMIN Correct answer.
  2. SYSADMIN
  3. SECURITYADMIN
  4. PUBLIC

Explanation

ACCOUNTADMIN is the top-level system role that encapsulates SYSADMIN and SECURITYADMIN and is intended for account-wide administration. It should be granted sparingly because it has the broadest privileges.

Question 2Snowflake Security and Governance Fundamentals

A user needs to create and manage virtual warehouses but should not manage users or grants. Which system role is designed for this responsibility?

  1. SYSADMIN Correct answer.
  2. ACCOUNTADMIN
  3. USERADMIN
  4. SECURITYADMIN

Explanation

SYSADMIN is the system role intended to create and manage warehouses and databases. Administrative roles such as SECURITYADMIN and USERADMIN focus on access control, not warehouse ownership.

Question 3Snowflake Security and Governance Fundamentals

What is the default role assigned to a newly created user if no default role is specified?

  1. No role is assigned
  2. ACCOUNTADMIN
  3. PUBLIC Correct answer.
  4. SYSADMIN

Explanation

When a user is created without an explicit default role, Snowflake assigns the PUBLIC role, which is granted to all users by default. This gives the user minimal baseline privileges.

Question 4Snowflake Security and Governance Fundamentals

Which privilege must be granted on a database to allow a role to create schemas within it?

  1. CREATE SCHEMA Correct answer.
  2. OWNERSHIP
  3. USAGE
  4. CREATE DATABASE

Explanation

The CREATE SCHEMA privilege on a database allows a role to create new schemas inside that database. USAGE only permits seeing and referencing the database.

Question 5Snowflake Security and Governance Fundamentals

Which object type does a masking policy get applied to in order to protect column data at query time?

  1. A column Correct answer.
  2. A warehouse
  3. A user
  4. A role

Explanation

Masking policies are attached to columns and transform the value returned based on the role of the querying user. They do not attach to warehouses, roles, or users directly.

Question 6Snowflake Security and Governance Fundamentals

Which Snowflake feature records queries and DDL executed in the account for auditing purposes?

  1. Resource Monitors
  2. Access History and Query History Correct answer.
  3. Time Travel
  4. Clustering Keys

Explanation

Access History and Query History provide audit records of data access and SQL execution. They are the primary sources for auditing activity in an account.

Question 7Snowflake Security and Governance Fundamentals

Which privilege allows a role to use a virtual warehouse to run queries?

  1. MODIFY
  2. OPERATE
  3. USAGE Correct answer.
  4. MONITOR

Explanation

The USAGE privilege on a warehouse lets a role run queries using that warehouse. OPERATE and MONITOR control management and monitoring, not query execution.

Question 8Snowflake Security and Governance Fundamentals

What does a row access policy control?

  1. How long data is retained
  2. Which rows a user can see in a table Correct answer.
  3. Which columns are returned in a query
  4. Which warehouse processes a query

Explanation

Row access policies filter the rows returned to a user based on conditions such as role or session context. They do not control columns or retention.

Question 9Snowflake Security and Governance Fundamentals

A role has USAGE on a database and USAGE on a schema but no privilege on a table. What can the role do with the table?

  1. Nothing; it cannot query the table Correct answer.
  2. Query the table but not modify it
  3. Query and modify the table
  4. Drop the table

Explanation

Privileges are required at each level of the object hierarchy; schema USAGE alone does not grant access to tables within it. A table-level privilege such as SELECT is required to query it.

Question 10Snowflake Security and Governance Fundamentals

Which approach best follows the principle of least privilege when granting access to a team?

  1. Grant SYSADMIN to the team
  2. Grant ACCOUNTADMIN to each team member
  3. Grant a custom role only the specific privileges the team needs Correct answer.
  4. Grant PUBLIC all object privileges

Explanation

Least privilege means granting only the privileges required for the job through a purpose-built custom role. Broad administrative roles or PUBLIC grants exceed what is needed.

Question 11Snowflake Security and Governance Fundamentals

Which statement about role hierarchy in Snowflake is accurate?

  1. A role inherits privileges from roles granted to it Correct answer.
  2. Roles cannot be granted to other roles
  3. A role inherits privileges from roles it grants to others
  4. Privileges flow upward from parent to child roles

Explanation

When role B is granted to role A, role A inherits all privileges of role B; privileges flow from the granted role to the grantee role. This builds the role hierarchy used for access control.

Question 12Snowflake Security and Governance Fundamentals

A masking policy is applied to a column with no mapping exception. What happens to the column value for a role that does not satisfy the policy condition?

  1. The value is returned unchanged
  2. The value is replaced by the masking expression result Correct answer.
  3. The query fails with an authorization error
  4. The column is dropped from the result set

Explanation

A masking policy returns the result of its masking expression when the role does not meet the condition. The query still runs; only the returned value is transformed.

Question 13Snowflake Security and Governance Fundamentals

Which privilege is required to apply a masking policy to a column?

  1. USAGE on the policy
  2. APPLY MASKING POLICY on the column Correct answer.
  3. OWNERSHIP on the schema
  4. SELECT on the table

Explanation

Applying a masking policy to a column requires the APPLY MASKING POLICY privilege on that column, in addition to appropriate rights on the policy. Table SELECT or schema ownership does not confer it.

Question 14Snowflake Security and Governance Fundamentals

Which Snowflake feature helps detect and restrict access based on tags such as data sensitivity classification?

  1. Tag-based masking policies Correct answer.
  2. Search optimization
  3. Query acceleration
  4. Resource monitors

Explanation

Tags can drive masking policies so that columns tagged with a sensitivity level are automatically protected. This supports scalable, consistent governance across many columns.

Question 15Snowflake Security and Governance Fundamentals

A security administrator wants to know which users accessed a specific column over the past 30 days. Which feature should be used?

  1. Login History
  2. Access History Correct answer.
  3. Query History
  4. Warehouse Metering History

Explanation

Access History records column-level read access by user and can be queried for a time range. It is the appropriate source for column-level access auditing.

Question 16Snowflake Security and Governance Fundamentals

Which statement correctly describes the relationship between a database, a schema, and a table in Snowflake?

  1. A schema belongs to a database and contains tables Correct answer.
  2. A table contains schemas, which contain databases
  3. Databases, schemas, and tables are independent objects
  4. A database belongs to a schema and contains tables

Explanation

Snowflake uses a containment hierarchy in which tables reside in schemas, and schemas reside in databases. Privileges must be granted appropriately along that hierarchy.

Question 17Snowflake Security and Governance Fundamentals

What is the effect of granting a role to a user with the DEFAULT_ROLE property set to that role?

  1. The user gains ACCOUNTADMIN privileges
  2. The role is granted to PUBLIC
  3. The role is dropped after the session
  4. The role becomes active automatically when the user starts a session Correct answer.

Explanation

The DEFAULT_ROLE property determines which role is active when a user begins a session. Setting it to a granted role makes that role active automatically.

Question 18Snowflake Security and Governance Fundamentals

Which practice most reduces risk when granting access to production data?

  1. Disable all auditing to reduce overhead
  2. Grant privileges directly to individual users
  3. Grant privileges to custom roles and assign users to those roles Correct answer.
  4. Share the ACCOUNTADMIN credentials among the team

Explanation

Managing access through custom roles centralizes and simplifies governance and supports least privilege. Direct user grants and shared administrative credentials increase risk and are harder to audit.

Question 19Snowflake Security and Governance Fundamentals

Which Snowflake object is used to classify data by attaching key-value metadata to columns, tables, or other objects?

  1. Tag Correct answer.
  2. Masking policy
  3. Row access policy
  4. Secure view

Explanation

Tags are schema-level objects that attach key-value metadata to objects and columns for classification and governance. They can be referenced by policies to automate protection.

Question 20Snowflake Security and Governance Fundamentals

A role is granted SELECT on a table and USAGE on the schema and database. Which additional privilege is needed to run a SELECT query against that table?

  1. INSERT on the table
  2. CREATE TABLE on the schema
  3. OWNERSHIP of the table
  4. USAGE on a warehouse Correct answer.

Explanation

Running a query requires compute, so the role needs USAGE on a virtual warehouse in addition to the data privileges. SELECT plus schema and database USAGE covers the data side.

Question 21Snowflake Security and Governance Fundamentals

An analyst can see all rows of a table even though a row access policy is attached. Which explanation is most likely?

  1. The analyst's active role satisfies the policy condition Correct answer.
  2. The policy was created by the analyst
  3. The analyst has USAGE on the warehouse
  4. The table has a clustering key

Explanation

A row access policy returns all rows when the querying role meets its condition. Seeing all rows indicates the active role is authorized by the policy.

Question 22Snowflake Security and Governance Fundamentals

Which combination correctly describes how masking and row access policies differ in what they protect?

  1. Both filter rows only
  2. Masking filters rows; row access transforms column values
  3. Both transform column values only
  4. Masking transforms column values; row access filters rows Correct answer.

Explanation

Masking policies alter the values returned for a column, while row access policies determine which rows are returned. They address different dimensions of data protection.

Question 23Snowflake Security and Governance Fundamentals

A user with ACCOUNTADMIN creates a database, then grants SYSADMIN ownership. What is the primary governance benefit of this pattern?

  1. Object administration moves to SYSADMIN while ACCOUNTADMIN stays reserved for account tasks Correct answer.
  2. It prevents SYSADMIN from creating schemas
  3. It automatically grants all users access
  4. It disables auditing on the database

Explanation

Transferring ownership to SYSADMIN keeps routine object administration with the appropriate role and avoids using the highly privileged ACCOUNTADMIN for daily work. This supports least privilege and clearer accountability.

Question 24Snowflake Security and Governance Fundamentals

Which statement about secure views is accurate?

  1. They hide the view definition and underlying query details from users who query them Correct answer.
  2. They encrypt the underlying table data at rest
  3. They prevent the view owner from querying data
  4. They replace the need for masking policies

Explanation

Secure views limit the exposure of view definitions and internal query details and are often used to prevent users from inferring underlying data. They do not encrypt data or substitute for masking policies.

Question 25Snowflake Security and Governance Fundamentals

A team wants to ensure that only authorized roles can read PII columns while all other roles see a redacted value. Which feature should be implemented?

  1. A default role set to PUBLIC
  2. A resource monitor on the warehouse
  3. A clustering key on the PII columns
  4. A masking policy attached to the PII columns Correct answer.

Explanation

A masking policy returns the real value only for roles that satisfy its condition and a redacted value for everyone else. This directly satisfies the requirement to protect PII columns.

Question 26Snowflake Security and Governance Fundamentals

Which Snowflake object is a named collection of privileges that can be granted to users and other roles?

  1. Warehouse
  2. User
  3. Database
  4. Role Correct answer.

Explanation

A role is the principal that holds privileges in Snowflake. Users are granted roles, and roles can be granted to other roles to form a hierarchy. Warehouses and databases are securable objects, not privilege containers.

Question 27Snowflake Security and Governance Fundamentals

Which authentication method requires a user to supply a time-based one-time passcode from an authenticator app in addition to a password?

  1. Multi-factor authentication Correct answer.
  2. OAuth
  3. Key-pair authentication
  4. Single sign-on with SAML

Explanation

Multi-factor authentication combines something the user knows (password) with something the user possesses (a time-based passcode). SAML SSO, key-pair, and OAuth are alternative authentication mechanisms but are not defined by the password-plus-passcode combination.

Question 28Snowflake Security and Governance Fundamentals

What is the purpose of a network policy in Snowflake?

  1. To restrict which IP addresses can connect to the account or individual users Correct answer.
  2. To encrypt data at rest within the account
  3. To define password complexity rules for users
  4. To control which roles can access a virtual warehouse

Explanation

A network policy defines allowed and blocked IP address ranges for account and user connections. It is an access-control mechanism at the network layer and does not manage encryption, password rules, or warehouse privileges.

Question 29Snowflake Security and Governance Fundamentals

Which privilege is required on a database to create a new schema inside it?

  1. CREATE SCHEMA Correct answer.
  2. CREATE TABLE
  3. USAGE
  4. OWNERSHIP

Explanation

The CREATE SCHEMA privilege on a database allows a role to create schemas within that database. USAGE allows seeing the database but not creating objects, and CREATE TABLE applies to schemas, not databases.

Question 30Snowflake Security and Governance Fundamentals

A security administrator wants to ensure that a service account can query only one specific table and nothing else in the database. Which grant strategy best meets this requirement?

  1. Grant SELECT on all tables in the schema to a dedicated role and grant that role to the service user.
  2. Grant SELECT on the specific table plus USAGE on its schema and database to a dedicated role, and grant that role to the service user. Correct answer.
  3. Grant the SYSADMIN role to the service user and rely on query filters.
  4. Grant the PUBLIC role SELECT on the table so the service user inherits access.

Explanation

Least privilege requires granting only the privileges needed: SELECT on the one table, plus the USAGE privileges on containers needed to reach it. Broad schema-wide grants, PUBLIC grants, or SYSADMIN violate least privilege.

Question 31Snowflake Security and Governance Fundamentals

A role has been granted the USAGE privilege on a warehouse but not OPERATE. Which action can the role perform?

  1. Suspend or resume the warehouse
  2. Resize the warehouse
  3. Run queries that use the warehouse Correct answer.
  4. Drop the warehouse

Explanation

USAGE on a warehouse allows a role to use it for query execution. Administrative actions such as resizing, suspending, resuming, or dropping require OPERATE, MODIFY, or OWNERSHIP privileges.

Question 32Snowflake Security and Governance Fundamentals

A masking policy is applied to a column without a mapping exception. What does a user whose role is not authorized by the policy see when querying that column?

  1. A null value regardless of the policy definition
  2. The original unmasked value
  3. The masked value defined by the policy Correct answer.
  4. An error indicating insufficient privileges

Explanation

When a masking policy is attached and no mapping exception applies, unauthorized roles receive the masked result defined in the policy. The policy itself determines the masked representation, which may be a constant, a hash, or null depending on its definition.

Question 33Snowflake Security and Governance Fundamentals

Which object provides a centralized way to define and enforce column-level security by associating a policy with one or more columns?

  1. Row access policy
  2. Masking policy Correct answer.
  3. Network policy
  4. Secure view

Explanation

A masking policy is attached to columns and returns a masked value based on the role of the querying user. Row access policies filter rows, secure views hide underlying definitions, and network policies restrict IP addresses.

Question 34Snowflake Security and Governance Fundamentals

A row access policy is attached to a table, but a user with the ACCOUNTADMIN role sees all rows. Which explanation is most likely?

  1. Row access policies never apply to ACCOUNTADMIN.
  2. The user has the SELECT privilege on the table, which bypasses row filtering.
  3. The policy includes a mapping that authorizes ACCOUNTADMIN, or the role has been exempted in the policy logic. Correct answer.
  4. The table owner always bypasses row access policies.

Explanation

Row access policies evaluate their logic for every role; if the policy authorizes ACCOUNTADMIN or exempts it, that role sees all rows. There is no automatic bypass for ACCOUNTADMIN, SELECT privilege, or table ownership.

Question 35Snowflake Security and Governance Fundamentals

Which statement accurately describes the effect of granting a role to a user without setting a default role?

  1. The user can use the granted role after switching to it with USE ROLE, but the session may start with a different default role. Correct answer.
  2. The granted role automatically becomes the user's default role.
  3. The granted role is inactive until the user logs in again.
  4. The user cannot use the granted role until it is granted to PUBLIC.

Explanation

Granting a role makes it available to the user, but the default role is a separate property. Without a default role set, the session uses the user's default role (often PUBLIC) until the user explicitly switches with USE ROLE.

Question 36Snowflake Security and Governance Fundamentals

Which Snowflake feature allows an administrator to review the history of privilege grants and revokes on objects over time?

  1. Warehouse meter history
  2. Login history
  3. Query history
  4. Access history in Access Control Correct answer.

Explanation

Access history records privilege grants and revokes as well as object access, supporting audit and governance. Query history records SQL statements, login history records authentication events, and warehouse meter history records credit usage.

Question 37Snowflake Security and Governance Fundamentals

A data steward wants to mark columns containing personal data so that policies can be applied based on that classification. Which Snowflake object should be used?

  1. Secure view
  2. External function
  3. Masking policy
  4. Tag Correct answer.

Explanation

Tags are key-value metadata that can be attached to columns and other objects to classify data. Policies such as masking or row access policies can then reference tag values to enforce governance.

Question 38Snowflake Security and Governance Fundamentals

A role has SELECT on a table and USAGE on the schema and database. Which additional privilege is needed to query the table successfully?

  1. USAGE on the account
  2. OPERATE on the virtual warehouse
  3. USAGE on a virtual warehouse Correct answer.
  4. CREATE TABLE on the schema

Explanation

Running a query requires compute, so the role must have USAGE on at least one warehouse. OPERATE is for warehouse administration, CREATE TABLE is unrelated to reading, and USAGE on the account is not a valid privilege.

Question 39Snowflake Security and Governance Fundamentals

An administrator wants to ensure that only authorized roles can read a PII column while all other roles see a redacted value, and the policy must be reusable across multiple tables. Which approach is most appropriate?

  1. Create a secure view for each table that projects a redacted column and grant access only to the view.
  2. Create a masking policy that returns the real value for authorized roles and a redacted value otherwise, then attach it to each PII column. Correct answer.
  3. Create a row access policy that filters out rows containing PII for unauthorized roles.
  4. Grant SELECT on the PII column only to authorized roles and revoke it from all others.

Explanation

A masking policy centralizes the redaction logic and can be attached to many columns, ensuring unauthorized roles see a masked value while authorized roles see the real value. Secure views require duplicating logic per table, column-level grants do not redact, and row access policies filter rows rather than mask values.

Question 40Snowflake Security and Governance Fundamentals

A user with ACCOUNTADMIN creates a database and then transfers ownership to SYSADMIN. What is the primary governance benefit of this transfer?

  1. It automatically grants PUBLIC access to the database.
  2. It removes the database from the account's access history.
  3. It ensures that routine object management is performed by a functional role rather than the highly privileged account administrator. Correct answer.
  4. It prevents SYSADMIN from granting privileges on the database.

Explanation

Transferring ownership to SYSADMIN separates day-to-day object administration from the ACCOUNTADMIN role, supporting least privilege and reducing reliance on the highest-privilege role. Ownership by SYSADMIN still allows granting privileges and does not affect audit history or PUBLIC access.

Question 41Identity, Authentication, and Access Control

In an AWS environment, which mechanism is used to grant temporary, automatically rotated credentials to an EC2 instance so that applications can call AWS APIs without embedding long-term keys?

  1. A root account access key stored in a configuration file
  2. An IAM group policy attached directly to the instance
  3. An IAM role attached to the instance via an instance profile Correct answer.
  4. An IAM user access key pair stored in the instance metadata

Explanation

An IAM role associated with an instance profile lets the instance obtain short-lived credentials from the instance metadata service, and those credentials rotate automatically. This avoids distributing long-term access keys to the workload.

Question 42Identity, Authentication, and Access Control

A company wants its workforce to sign in to multiple SaaS applications using their existing corporate directory credentials, with the identity provider acting as the source of truth. Which standard should the company implement?

  1. SAML 2.0 single sign-on with the corporate IdP as the asserting party Correct answer.
  2. Basic authentication proxied through a reverse proxy
  3. Shared local accounts created separately in each SaaS application
  4. Static API keys distributed to each SaaS application

Explanation

Federated SSO via SAML 2.0 lets the corporate identity provider authenticate users and assert their identity to relying-party SaaS applications. This centralizes authentication and avoids duplicating credentials per application.

Question 43Identity, Authentication, and Access Control

Which principle states that a subject should be granted only the permissions required to perform its current task, and nothing more?

  1. Defense in depth
  2. Separation of duties
  3. Least privilege Correct answer.
  4. Fail-safe defaults

Explanation

Least privilege limits permissions to exactly what is needed for the task, reducing the blast radius of misuse or compromise. Separation of duties and defense in depth address different control objectives.

Question 44Identity, Authentication, and Access Control

An organization requires that administrators use a second authentication factor that is resistant to real-time phishing and does not rely on a shared secret transmitted to the user. Which factor best meets this requirement?

  1. Email-delivered one-time passcodes
  2. Time-based one-time passwords in an authenticator app
  3. FIDO2 security keys using WebAuthn Correct answer.
  4. SMS one-time passcodes

Explanation

FIDO2/WebAuthn credentials are bound to the relying party origin and use public-key cryptography, making them resistant to real-time phishing. Codes delivered by SMS, email, or TOTP can be relayed by an attacker in real time.

Question 45Identity, Authentication, and Access Control

Which OAuth 2.0 grant type is appropriate for a single-page application where the client cannot keep a secret, when combined with the authorization code flow?

  1. Resource owner password credentials
  2. Authorization code with PKCE Correct answer.
  3. Implicit
  4. Client credentials

Explanation

PKCE binds the authorization request to the token request using a dynamically generated verifier, protecting public clients that cannot hold a client secret. The implicit and password grants are deprecated for this use case.

Question 46Identity, Authentication, and Access Control

A security engineer reviews an IAM policy where a role has an explicit Allow for s3:GetObject on a bucket and an explicit Deny for s3:GetObject on a specific prefix within that bucket. A request targets an object under the denied prefix. What is the effective result?

  1. The request is allowed because the broader Allow takes precedence
  2. The request is allowed only if the caller is an administrator
  3. The request is denied because an explicit Deny overrides any Allow Correct answer.
  4. The request result depends on the order in which statements are evaluated

Explanation

In policy evaluation, an explicit Deny always overrides an Allow regardless of specificity. Statement order does not affect the outcome.

Question 47Identity, Authentication, and Access Control

Which access control model bases decisions on attributes of the subject, the resource, the action, and the environment evaluated against policies at request time?

  1. Discretionary access control
  2. Mandatory access control
  3. Role-based access control
  4. Attribute-based access control Correct answer.

Explanation

ABAC evaluates attributes of the subject, resource, action, and context against policies to reach an authorization decision. This enables fine-grained, context-aware decisions beyond static role membership.

Question 48Identity, Authentication, and Access Control

An application needs to assume an IAM role in a different AWS account. What must the role's trust policy specify to permit this?

  1. The ARN of the calling principal or account as a trusted principal in the AssumeRole trust policy Correct answer.
  2. A KMS grant that authorizes the cross-account caller
  3. A resource-based policy on the application's load balancer
  4. An access key pair that matches the destination account root key

Explanation

Cross-account role assumption requires the target role's trust policy to list the calling principal or account as a trusted entity. The caller then calls AssumeRole to obtain temporary credentials.

Question 49Identity, Authentication, and Access Control

Which statement accurately describes the relationship between authentication and authorization?

  1. Authentication determines permissions, while authorization verifies credentials
  2. Authentication verifies identity, while authorization determines what an authenticated subject may do Correct answer.
  3. Authorization always occurs before authentication in a request flow
  4. Both terms describe the same process of validating credentials

Explanation

Authentication establishes who a subject is; authorization decides which actions that subject is permitted to perform. They are distinct steps, and authorization logically follows authentication.

Question 50Identity, Authentication, and Access Control

A web application issues session cookies after login. Which attribute combination best mitigates cross-site scripting theft and cross-site request forgery of the session cookie?

  1. Long expiration time with no other attributes
  2. Secure and SameSite=Strict, with HttpOnly set on the session cookie Correct answer.
  3. Path set to the application root only
  4. Domain set to a broad parent domain

Explanation

HttpOnly prevents client-side scripts from reading the cookie, mitigating XSS theft, while SameSite restricts cross-site sending and Secure limits transmission to HTTPS. Together they harden the session cookie against common attacks.