SnowPro® Advanced: Security Engineer study guide
SAE-C01 · Work through your exam, one topic at a time.
The SnowPro® Advanced: Security Engineer credential, exam code SEA-C01, is one of Snowflake's advanced-level SnowPro certifications. It is aimed at security engineers, security architects, and senior administrators who already work hands-on with Snowflake and want independent validation of their ability to design, implement, and operate a secure Snowflake environment. The SAE-C01 study guide has 5 sections and about 1,624 words.
01Snowflake Security and Governance Fundamentals
Snowflake security rests on the separation of the control plane (Snowflake-managed metadata services that handle authentication, query parsing, and access decisions) from the data plane (compute and storage in the customer's cloud region). Understanding this split explains why account-level objects and policies behave the way they do.
365 words, about 2 min02Identity, Authentication, and Access Control
A user is an identity; a role is a set of privileges; a session activates one role at a time (with secondary roles optionally enabled). Authentication methods include password (with MFA), key-pair authentication (RSA, used for service users and programmatic access), OAuth (including Snowflake OAuth and external OAuth via an identity provider), and SAML 2.0 federated authentication for SSO.
321 words, about 2 min03Data Protection, Encryption, and Masking
Snowflake encrypts data at rest with AES-256, using hierarchical key management : account master keys protect table master keys, which protect file keys. Tri-Secret Secure combines a Snowflake-managed key with a customer-managed key (in AWS KMS, Azure Key Vault, or GCP KMS) so that neither party alone can decrypt data.
324 words, about 2 min04Network Security and Connectivity
Connections use the Snowflake service endpoint over TLS. Network policies define allowed and blocked IP ranges (IPv4) at the account or user level, and can be scoped to specific services.
312 words, about 2 min05Monitoring, Auditing, and Compliance
Snowflake provides ACCESS HISTORY (which objects and columns a query read or wrote), QUERY HISTORY , LOGIN HISTORY , SESSIONS , and INFORMATION SCHEMA views. Account Usage views (in the SNOWFLAKE database) retain longer history than Information Schema, which is scoped and shorter.
302 words, about 2 min