CertArea
All Snowflake exams

Free SEA-C01 practice test: 30 questions with answers

30 original questions for SnowPro Advanced: Security Engineer, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

SEA-C01 exam guide: topics, cost and format

All 30 SEA-C01 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Data protection (5 questions)

  1. Question 1

    A column contains personal email addresses. Analysts should see the value masked, while a privacy officer sees the full value. Which feature achieves this?

    1. AA secure view that omits the column from its select list
    2. BA masking policy on the column that checks the querying role
    3. CA Time Travel query that reads the table as it existed
    4. DA stream on the table that captures inserts, updates and deletes made
    Show answer and explanation
    Correct answer: B

    A masking policy on the column returns masked or unmasked values based on the querying role. Deleting the column, streams and Time Travel do not provide role-based masking.

  2. Question 2

    Which feature controls which rows a role can see based on a condition, without changing the table's data?

    1. ARow access policy
    2. BResource monitor
    3. CNetwork policy
    4. DStage encryption setting
    Show answer and explanation
    Correct answer: A

    A row access policy filters rows based on a condition evaluated at query time. Network policies control connection origin, resource monitors control credits, and stage encryption protects files.

  3. Question 3

    A team wants to apply the same masking rule to every column tagged as sensitive, without attaching policies to each column one by one. Which approach fits?

    1. ATag-based masking policies attached to a sensitivity tag
    2. BCreating a view for each sensitive column in the schema
    3. CCopying the table for each sensitivity level
    4. DRenaming each column to include the word sensitive in its name
    Show answer and explanation
    Correct answer: A

    Tag-based masking applies one policy to every object carrying the tag, which scales governance. Renaming, per-column views and table copies create maintenance burdens and gaps.

  4. Question 4

    Which property of a secure view makes it suitable for sharing row-filtered data with consumers without exposing the underlying query logic?

    1. AThe SECURE keyword on the view
    2. BThe CACHE keyword on the view
    3. CThe COMMENT on the view
    4. DThe name of the view ending in _v
    Show answer and explanation
    Correct answer: A

    A secure view hides its definition and the underlying data details from consumers who should not see them. Caching, comments and naming do not conceal definitions.

  5. Question 5

    A data engineer needs to find where a sensitive column is used, including by queries run in the last month. Which feature helps answer this?

    1. AThe warehouse's auto-suspend timeout setting
    2. BThe task's cron schedule and its time zone
    3. CThe stage's file format and its compression option
    4. DAccess history in the ACCOUNT_USAGE views
    Show answer and explanation
    Correct answer: D

    Access history records which objects and columns queries accessed. Auto-suspend, file formats and task schedules do not show data access.

Identity and access (5 questions)

  1. Question 6

    A company requires that users authenticate with its corporate identity provider using SAML. Which Snowflake feature provides this?

    1. AA local role with no login authentication step
    2. BA shared account password that every analyst enters at login
    3. CSAML 2.0 security integration with the identity provider
    4. DAn email reminder that asks users to change their password regularly
    Show answer and explanation
    Correct answer: C

    A SAML 2.0 security integration connects Snowflake to the corporate identity provider. Shared passwords, roles without authentication and reminder emails do not provide federated sign-in.

  2. Question 7

    A user is provisioned and deprovisioned automatically from the identity provider. Which feature supports this?

    1. AA manual CSV upload of users each quarter
    2. BA shared service account
    3. CSCIM provisioning integration
    4. DA role named provisioning with no rules
    Show answer and explanation
    Correct answer: C

    SCIM provisioning synchronizes user and group lifecycle from the identity provider. Manual uploads, shared accounts and role names alone do not automate lifecycle management.

  3. Question 8

    Why should service accounts use key pair authentication rather than a password?

    1. AKey pairs avoid sharing a reusable password and can be rotated with a defined process
    2. BKey pairs remove the need for explicit role grants on the service user
    3. CPasswords are not supported by Snowflake for service connections
    4. DKey pairs allow unlimited simultaneous sessions and skip session controls
    Show answer and explanation
    Correct answer: A

    Key pair authentication avoids a shared reusable password and supports defined rotation. Passwords are supported, key pairs still need role grants, and unlimited sessions are not a security feature.

  4. Question 9

    Which principle should guide the design of role hierarchies in a Snowflake account?

    1. AGranting ACCOUNTADMIN to analysts for convenience
    2. BLeast privilege, granting roles only the privileges users need
    3. CGranting every privilege to the PUBLIC role so new users inherit access
    4. DCreating one shared role that every user is assigned
    Show answer and explanation
    Correct answer: B

    Least privilege keeps access minimal and auditable. Broad administrator roles, PUBLIC grants and a single shared role all weaken control.

  5. Question 10

    Which role is designed to manage security-related settings such as network policies and masking policies, separately from object creation?

    1. AAn unprivileged user role
    2. BPUBLIC
    3. CSYSADMIN for every user
    4. DSECURITYADMIN
    Show answer and explanation
    Correct answer: D

    SECURITYADMIN manages security administration such as grants and policies. PUBLIC is a default role for all users, SYSADMIN is for object administration, and an unprivileged role does not manage security.

Network security (4 questions)

  1. Question 11

    A security engineer wants to allow connections to a Snowflake account only from the corporate office IP range. Which object should be created and applied?

    1. AA network policy with an allowed IP list for the office range
    2. BA masking policy on every table column with a role check
    3. CA row access policy on the users table that filters visible rows by role
    4. DA resource monitor with a credit quota on the warehouse
    Show answer and explanation
    Correct answer: A

    A network policy with an allowed IP list restricts account or user access to specified addresses. Masking, row access and resource monitors control data or cost rather than network origin.

  2. Question 12

    An administrator applies a network policy at the account level and also at the user level for one service account. Which policy takes precedence for that user?

    1. AThe account-level policy takes effect and ignores user-level settings
    2. BThe policy that was created first remains in effect and governs the user
    3. CThe user-level network policy overrides the account-level policy for that user
    4. DBoth policies are ignored, so the user faces no network restriction
    Show answer and explanation
    Correct answer: C

    A user-level network policy takes precedence over the account-level policy for that user. The other options misstate how the two levels interact.

  3. Question 13

    Which feature allows private connectivity from a cloud virtual network to Snowflake without traffic traversing the public internet?

    1. AA public IP allow list that restricts client addresses over the internet route to Snowflake
    2. BA shared password that every service account and analyst enters during login, kept in a team vault
    3. CA Snowflake Marketplace listing that shares read-only data sets with consumer accounts through a provider-managed share for analysts
    4. DCloud provider private connectivity such as AWS PrivateLink, Azure Private Link, or Google Private Service Connect
    Show answer and explanation
    Correct answer: D

    Private connectivity options keep traffic on the cloud provider's private network. An IP allow list still uses public routing, a shared password is authentication, and a marketplace listing is a data-sharing feature.

  4. Question 14

    Which object defines the hosts and ports that a Snowflake feature such as an external access integration may reach?

    1. AA masking policy attached to a column that returns redacted values
    2. BA stream on a table that records row-level DML changes
    3. CA network rule referenced by an external access integration
    4. DA warehouse size that sets the number of compute nodes for queries
    Show answer and explanation
    Correct answer: C

    Network rules define allowed egress destinations, and external access integrations reference them. Masking policies, streams and warehouse sizes do not control outbound destinations.

Governance (4 questions)

  1. Question 15

    Which practice keeps network policy changes controlled and auditable in a regulated environment?

    1. ADisable change tracking to reduce overhead in the account so that query latency stays low at peak times
    2. BLet every database user change network policies from their own workstation through a shared login account
    3. CManage policy changes through a reviewed change process and keep the changes in version control
    4. DMake changes directly in the production console with no record during on-call hours
    Show answer and explanation
    Correct answer: C

    Reviewed change processes and version control keep policy changes controlled and auditable. Unrecorded console changes, open access and disabled tracking remove control.

  2. Question 16

    Which practice ensures that sensitive data classifications are applied to new tables automatically?

    1. ATag-based policies that apply masking or access rules to objects carrying the classification tag
    2. BAsking each developer to remember to classify every new table before each release too
    3. CClassifying data after an incident once forensics finishes its report on the leak
    4. DStoring classifications in a text file on a laptop saved in a shared folder copied across unmanaged devices
    Show answer and explanation
    Correct answer: A

    Tag-based policies apply controls wherever the classification tag is present, which scales to new tables. Memory-based classification, post-incident work and laptop files leave gaps.

  3. Question 17

    Which role is typically responsible for approving changes to data access policies in a well-governed Snowflake account?

    1. AThe warehouse operator on duty who manages cluster sizing and credits
    2. BAn analyst who needs quick access to production dashboards today
    3. CA data governance or security owner who reviews and approves policy changes
    4. DThe marketing team that consumes reports and gets weekly extracts
    Show answer and explanation
    Correct answer: C

    A governance or security owner reviews and approves access policy changes. Analysts requesting access, warehouse operators and report consumers should not approve their own policy changes.

  4. Question 18

    Which two practices make a Snowflake security configuration easier to audit? (Choose two.)

    1. ADocument roles, policies and their owners in a maintained register
    2. BApply tags consistently so that policies can be reviewed by classification
    3. CChange configurations ad hoc with no change record
    4. DKeep policy names random so that they are hard to guess
    5. EStore configuration decisions only in individual memories
    Show answer and explanation
    Correct answer: A, B

    A maintained register of roles and policies, and consistent tagging, make configurations auditable. Ad hoc changes, random names and undocumented memories hinder audit.

Monitoring (4 questions)

  1. Question 19

    A security engineer wants to be alerted when a user logs in from an unusual location. Which approach supports this?

    1. AWait for the user to report it and then when the user files a support ticket about it today
    2. BTurn off login logging to reduce the volume of records in the account usage views and storage
    3. CUse login history in the account usage views and build an alert on unusual patterns
    4. DCheck the login history once a year during an annual compliance audit that samples a few accounts
    Show answer and explanation
    Correct answer: C

    Login history can feed alerts on unusual patterns, which gives timely detection. Waiting for reports, disabling logging and annual checks do not provide timely detection.

  2. Question 20

    Which kind of query history is most useful for finding failed login attempts over the last week?

    1. ALogin history in the account usage views, filtered by status and time
    2. BThe list of schemas in a database with their creation dates, owners, and comments
    3. CThe warehouse's name history for each rename event over time
    4. DThe stage file listing showing each staged object and sizes
    Show answer and explanation
    Correct answer: A

    Login history filtered by status and time shows failed attempts. Warehouse names, schema lists and stage listings do not record login outcomes.

  3. Question 21

    A query that touched sensitive data was run by an unexpected user. Which information shows which objects were read by that query?

    1. AAccess history, which records the objects and columns accessed by the query
    2. BThe stage's file format that is applied to staged files when they are loaded into tables
    3. CThe number of worksheets the user created in Snowsight over the last 30 days so far
    4. DThe warehouse's auto-resume setting and suspend timeout rules
    Show answer and explanation
    Correct answer: A

    Access history records which objects and columns a query accessed. Warehouse settings, file formats and worksheet counts do not show data access.

  4. Question 22

    Which two signals are useful when investigating a suspected data exfiltration? (Choose two.)

    1. AUnusually large result exports or downloads from a single user
    2. BThe warehouse's logo colour
    3. CThe number of stars on the account's documentation
    4. DQuery history showing access to many sensitive tables in a short period
    5. EThe name of the weekly team lunch
    Show answer and explanation
    Correct answer: A, D

    Large exports and bursts of access to sensitive tables are classic exfiltration signals. Logo colours, documentation stars and lunch plans are unrelated.

Encryption and keys (4 questions)

  1. Question 23

    Which encryption option lets a customer control the root key used to protect Snowflake data, with a customer-managed key in its own cloud account?

    1. AA default setting with no customer control over keys
    2. BStoring the data in an unencrypted internal stage
    3. CTri-Secret Secure with a customer-managed key
    4. DUsing a shared password as the master encryption key
    Show answer and explanation
    Correct answer: C

    Tri-Secret Secure combines a customer-managed key with Snowflake's key to protect data. Default settings give no customer control, unencrypted stages are unsafe, and passwords are not encryption keys.

  2. Question 24

    Snowflake encrypts data at rest and in transit. Which statement about encryption in transit is correct?

    1. AThe metadata is encrypted in transit while query results travel unencrypted
    2. BData is sent in plain text between the client driver and Snowflake by default
    3. CEncryption in transit requires a manual site-to-site VPN tunnel configured separately for each query
    4. DClient connections use TLS so that data is encrypted between the client and Snowflake
    Show answer and explanation
    Correct answer: D

    Snowflake uses TLS for client connections, which encrypts data in transit. Plain text transfer, manual VPNs per query and metadata-only encryption are incorrect.

  3. Question 25

    A security team must rotate an encryption key used for protected data. What should they expect?

    1. AEvery table must be dropped and reloaded from source files after rotation into a new schema
    2. BSnowflake performs automatic key rotation on a defined schedule for its managed keys
    3. CUsers must change their passwords each time the key is rotated by the team
    4. DThe data becomes permanently unreadable to every role after rotation
    Show answer and explanation
    Correct answer: B

    Snowflake manages automatic key rotation for its managed keys on a defined schedule. Reloading tables, password changes and permanent unreadability are not the expected outcome.

  4. Question 26

    Which two practices support a sound key management program for a Snowflake account? (Choose two.)

    1. AStore the key material in a shared spreadsheet
    2. BUse the same key for every environment regardless of sensitivity
    3. CUse customer-managed keys where regulatory requirements call for them
    4. DDisable logging of key usage to reduce noise
    5. ERecord key rotation and access events for audit
    Show answer and explanation
    Correct answer: C, E

    Customer-managed keys where required and recorded rotation and access events support a sound key program. Spreadsheets, shared keys across sensitivity levels and disabled logging all weaken it.

Recovery (4 questions)

  1. Question 27

    A table was accidentally dropped yesterday, and the data must be recovered. Which feature is the first option to consider?

    1. AFail-safe, which the customer can request directly
    2. BA new stream on the dropped table that replays its changes
    3. CA network policy change that adds an IP range
    4. DTime Travel, using UNDROP within the retention period
    Show answer and explanation
    Correct answer: D

    Time Travel with UNDROP restores objects within the retention period. Fail-safe is not customer-accessible for direct recovery, streams do not restore dropped tables, and network policies are unrelated.

  2. Question 28

    A security incident may have modified a table. Which feature lets the team view the table as it was before the change?

    1. ATime Travel queries using AT or BEFORE with a timestamp or statement
    2. BChanging the warehouse size to a bigger tier for reviews
    3. CDropping and recreating the table with the same name and default privileges
    4. DCopying the stage into a new location for offline review
    Show answer and explanation
    Correct answer: A

    Time Travel queries with AT or BEFORE show the table's earlier state within the retention period. Dropping, warehouse changes and stage copies do not restore prior states.

  3. Question 29

    A security team needs a read-only, point-in-time copy of data before investigating an incident. Which feature is most appropriate?

    1. AA stream that captures future changes on the table
    2. BA zero-copy clone created from the table at the required time
    3. CA view with no snapshot that reads the base table live on each query run
    4. DA new table filled manually with the same values by hand from the export
    Show answer and explanation
    Correct answer: B

    A zero-copy clone from a past point in time preserves the state for investigation without copying all data. Manual rebuilds, views and future-only streams do not preserve the earlier state.

  4. Question 30

    A dropped schema must be restored after a mistaken deletion. Which Snowflake feature should be tried first?

    1. ACreating a new schema with the same name and no data
    2. BWaiting for Fail-safe to be requested by the customer
    3. CUNDROP within the Time Travel retention period
    4. DRestoring from a screenshot of the schema
    Show answer and explanation
    Correct answer: C

    UNDROP restores a dropped schema within the Time Travel retention period. A new empty schema loses the data, Fail-safe is not a customer recovery path, and screenshots cannot restore data.