SnowPro® Advanced: Security Engineer study plan
SAE-C01 · Give each week a clear focus.
8 weeks · About 7 hours per week
Identity, Authentication, and Access Control
Map Snowflake's authentication methods (password, key-pair, SSO/SAML, OAuth) to the use cases each is designed for
Distinguish DAC via role grants from discretionary ownership-based privileges on securable objects
Outline the default role hierarchy and explain how privilege inheritance flows to SYSADMIN and ACCOUNTADMIN
Practice creating roles and assigning them to users in a trial account
Your checkpoint
A one-page diagram of role hierarchy plus a written comparison table of authentication methods with at least one use case each
Identity, Authentication, and Access Control & Snowflake Security and Governance Fundamentals
Configure federated authentication concepts: map SAML attributes to Snowflake users and roles
Explain SCIM provisioning purpose and how identity-provider groups map to roles
Differentiate object-level, schema-level, and future grants
Describe how managed access schemas change grant behavior
Your checkpoint
A written walkthrough (500+ words) of an SSO + SCIM onboarding flow from IdP group to Snowflake role, including where future grants apply
Snowflake Security and Governance Fundamentals
Define governance pillars: access control, data classification, and accountability
Explain the purpose of object tagging and how tags support classification and masking policies
Describe data lineage and object dependencies at a conceptual level
Summarize Snowflake's approach to least privilege and separation of duties
Your checkpoint
A governance framework outline mapping each pillar to at least two Snowflake features and the role responsible
Data Protection, Encryption, and Masking
Explain encryption at rest, in transit, and the role of key management
Compare Snowflake-managed keys with customer-managed keys (Tri-Secret Secure) at a conceptual level
Describe masking policies and when they apply versus when they do not
Differentiate masking from tokenization and from row access policies
Your checkpoint
A decision matrix (at least 6 scenarios) recommending masking policy, row access policy, or neither, with justification for each
Data Protection, Encryption, and Masking & Snowflake Security and Governance Fundamentals
Draft a masking policy design for PII columns using role-based conditions
Explain external tokenization and when it is preferred over native masking
Describe how tags can drive automated masking assignment
Identify governance risks of over-broad ACCOUNTADMIN usage
Your checkpoint
A written PII protection plan covering at least 5 column types, the masking approach for each, and the roles exempted from masking
Network Security and Connectivity
Explain network policies and how allowed/blocked IP lists are evaluated
Describe private connectivity options (PrivateLink, private connectivity to internal services) and their purpose
Differentiate public access with key-pair auth from private-only connectivity
List connectivity troubleshooting checkpoints for a failed private connection
Your checkpoint
A network security design brief for a hypothetical company requiring private-only access, listing configuration steps and failure points
Monitoring, Auditing, and Compliance
Identify which account-level and object-level events are captured in access history and query history
Describe how to detect anomalous login or privilege-escalation patterns
Explain the purpose of audit logs and how they support compliance evidence
Map common compliance requirements (least privilege, access review, encryption) to Snowflake controls
Your checkpoint
A monitoring runbook with at least 5 detection scenarios, the data source for each, and the recommended response
Snowflake Security and Governance Fundamentals & Identity, Authentication, and Access Control & Data Protection, Encryption, and Masking & Network Security and Connectivity & Monitoring, Auditing, and Compliance
Synthesize all domains into an end-to-end security architecture for a sample organization
Rehearse explaining trade-offs between security controls and operational usability
Identify and close weak areas using a self-assessment across all five domains
Your checkpoint
A full mock exam scored with a written remediation list for every domain scoring below 80%
Milestones
Week 2: Can explain the complete path from IdP group membership to effective Snowflake privileges without notes
Week 4: Can choose correctly between masking, row access, and tokenization for at least 5 of 6 scenarios
Week 6: Can describe a private-only connectivity design and its failure points from memory
Week 8: Mock exam score at or above 80% overall with no domain below 70%