SnowPro Advanced: Security Engineer Complete Guide

The SnowPro Advanced: Security Engineer Certification validates expert-level knowledge of designing, implementing, and operating security in a Snowflake environment. The exam comprehensively covers the features a security engineer designs and manages day to day, including network isolation, encryption architecture, RBAC/DAC, data masking, auditing, and compliance.

Exam Overview

Exam Domains and Weighting

Network Security

Network Policies

Private Connectivity

• AWS PrivateLink: private connection to Snowflake from inside a VPC, bypassing the internet
• Azure Private Link: private connection from inside a VNet
• GCP Private Service Connect: private connection from inside a VPC
• Available on Business Critical Edition or higher
• Access to Internal Stages (PUT/GET), Snowsight, and Snowpipe can also be protected over PrivateLink

Access Control

The Combined RBAC / DAC Model

Snowflake uses an access control model that combines RBAC (Role-Based Access Control) and DAC (Discretionary Access Control).

Role Hierarchy Design Best Practices

• Place every custom role under SYSADMIN (to prevent gaps in the role tree)
• Do not use ACCOUNTADMIN for routine work; switch to it only when needed
• Combine functional roles (DATA_READER / DATA_WRITER / ANALYST) with environment roles (DEV / STG / PROD)
• Use MANAGED ACCESS schemas to centralize privilege management with the schema owner

Data Masking

Row Access Policies

• Use a mapping table to define which data each role can access
• Use CURRENT_ROLE() and IS_ROLE_IN_SESSION() to evaluate roles inside the policy
• Combining with masking policies gives you column-level plus row-level double protection
• Available on Enterprise Edition or higher

Encryption and Key Management

Encryption Architecture

All data is automatically encrypted on write (Encryption at Rest), and network traffic is protected with TLS 1.2 (Encryption in Transit). There is no setting for users to toggle encryption on or off; it is always on.

Key Rotation

• Automatic rotation: Snowflake-managed keys are automatically rotated once a year (Enterprise Edition or higher)
• Periodic rekeying: data encrypted with older keys is re-encrypted with new keys (Periodic Rekeying)
• Customer-managed keys: when using Tri-Secret Secure, the customer sets the key rotation schedule in their own KMS

Auditing and Monitoring

For security audits, it's important to detect suspicious login attempts in LOGIN_HISTORY (large numbers of failures in a short window, access from unknown IPs) and analyze unexpected data access patterns in ACCESS_HISTORY.

Compliance

• For HIPAA compliance, you must execute a BAA (Business Associate Agreement) with Snowflake
• PCI DSS requires encryption of cardholder data, access restrictions, log recording, and periodic vulnerability scans
• GDPR requires you to design a personal data deletion process to honor the right to be forgotten

Check Your Understanding

Frequently Asked Questions