Snowflake SEA-C01: SnowPro Advanced: Security Engineer

Last checked October 22, 2026 against the official Snowflake exam page.

1. Question 1Data protection

   A column contains personal email addresses. Analysts should see the value masked, while a privacy officer sees the full value. Which feature achieves this?

   1. AA secure view that omits the column from its select list
   2. BA masking policy on the column that checks the querying role
   3. CA Time Travel query that reads the table as it existed
   4. DA stream on the table that captures inserts, updates and deletes made
   Show answer and explanationHide answer

   Correct answer: B

   A masking policy on the column returns masked or unmasked values based on the querying role. Deleting the column, streams and Time Travel do not provide role-based masking.

2. Question 2Identity and access

   A company requires that users authenticate with its corporate identity provider using SAML. Which Snowflake feature provides this?

   1. AA local role with no login authentication step
   2. BA shared account password that every analyst enters at login
   3. CSAML 2.0 security integration with the identity provider
   4. DAn email reminder that asks users to change their password regularly
   Show answer and explanationHide answer

   Correct answer: C

   A SAML 2.0 security integration connects Snowflake to the corporate identity provider. Shared passwords, roles without authentication and reminder emails do not provide federated sign-in.

3. Question 3Network security

   A security engineer wants to allow connections to a Snowflake account only from the corporate office IP range. Which object should be created and applied?

   1. AA network policy with an allowed IP list for the office range
   2. BA masking policy on every table column with a role check
   3. CA row access policy on the users table that filters visible rows by role
   4. DA resource monitor with a credit quota on the warehouse
   Show answer and explanationHide answer

   Correct answer: A

   A network policy with an allowed IP list restricts account or user access to specified addresses. Masking, row access and resource monitors control data or cost rather than network origin.

4. Question 4Governance

   Which practice keeps network policy changes controlled and auditable in a regulated environment?

   1. ADisable change tracking to reduce overhead in the account so that query latency stays low at peak times
   2. BLet every database user change network policies from their own workstation through a shared login account
   3. CManage policy changes through a reviewed change process and keep the changes in version control
   4. DMake changes directly in the production console with no record during on-call hours
   Show answer and explanationHide answer

   Correct answer: C

   Reviewed change processes and version control keep policy changes controlled and auditable. Unrecorded console changes, open access and disabled tracking remove control.

5. Question 5Monitoring

   A security engineer wants to be alerted when a user logs in from an unusual location. Which approach supports this?

   1. AWait for the user to report it and then when the user files a support ticket about it today
   2. BTurn off login logging to reduce the volume of records in the account usage views and storage
   3. CUse login history in the account usage views and build an alert on unusual patterns
   4. DCheck the login history once a year during an annual compliance audit that samples a few accounts
   Show answer and explanationHide answer

   Correct answer: C

   Login history can feed alerts on unusual patterns, which gives timely detection. Waiting for reports, disabling logging and annual checks do not provide timely detection.