Access history and audit logging in Snowflake - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Querying Access History for a User

What is the output of this query that retrieves access history for user 'JOHN_DOE' in the last 7 days?

Snowflake

SELECT event_time, user_name, object_name, action FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY WHERE user_name = 'JOHN_DOE' AND event_time >= DATEADD(day, -7, CURRENT_TIMESTAMP());

A

[
  {"event_time": "2024-06-10 14:23:01", "user_name": "JOHN_DOE", "object_name": "SALES_DATA", "action": "SELECT"},
  {"event_time": "2024-06-12 09:15:45", "user_name": "JOHN_DOE", "object_name": "CUSTOMERS", "action": "INSERT"}
]

B SyntaxError: missing FROM keyword

C Error: Table SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY does not exist

D []

💡 Hint

Check the table name and filter conditions carefully.

The query correctly filters access history for user 'JOHN_DOE' in the last 7 days, returning matching events.

🧠 Conceptual

intermediate

Purpose of Access History in Snowflake

What is the primary purpose of the ACCESS_HISTORY view in Snowflake?

A To store user passwords and authentication details

B To monitor system resource usage like CPU and memory

C To track all user activities on database objects for auditing and compliance

D To manage user roles and permissions

💡 Hint

Think about what audit logging means in a database context.

ACCESS_HISTORY records user actions on database objects, helping with auditing and compliance.

❓ Troubleshoot

advanced

Troubleshooting Missing Audit Logs

You notice that recent user activities are not appearing in the ACCESS_HISTORY view. What could be a likely cause?

A The ACCOUNT_USAGE schema is not enabled or data sharing is delayed

B User has no SELECT privileges on the ACCESS_HISTORY view

C The Snowflake account is in a paused state

D The ACCESS_HISTORY view only shows data older than 30 days

💡 Hint

Consider how Snowflake replicates usage data to ACCOUNT_USAGE.

ACCOUNT_USAGE views can have a delay of up to 45 minutes or more before recent data appears.

🔀 Workflow

advanced

Setting Up Audit Logging for Compliance

Which sequence of steps correctly sets up audit logging access for a security team in Snowflake?

A 2,1,3,4

B 1,2,3,4

C 1,3,2,4

D 3,1,2,4

💡 Hint

Think about granting access before verification.

First create the role with privileges, then grant it, verify access, and finally monitor logs.

✅ Best Practice

expert

Best Practice for Retaining Audit Logs

What is the recommended best practice for retaining audit logs in Snowflake for long-term compliance?

A Disable ACCESS_HISTORY to improve query performance

B Rely solely on the default retention period of ACCESS_HISTORY in Snowflake

C Delete old audit logs manually to save storage

D Periodically export ACCESS_HISTORY data to an external secure storage like AWS S3

💡 Hint

Think about compliance requirements for long-term data retention.

Snowflake's default retention may not meet all compliance needs; exporting logs externally is best practice.

Practice

1. What does the ACCESS_HISTORY view in Snowflake primarily provide?

easy

A. Information about who accessed data and when

B. Details about Snowflake account billing

C. List of all database tables and schemas

D. Performance metrics of queries

Solution

1. Step 1: Understand the purpose of ACCESS_HISTORY

   The ACCESS_HISTORY view records user activity related to data access in Snowflake.

2. Step 2: Identify what ACCESS_HISTORY tracks

   It tracks who accessed what data and when, useful for audit and compliance.

3. Final Answer:

   Information about who accessed data and when -> Option A

4. Quick Check:

   ACCESS_HISTORY = Data access logs [OK]

Hint: ACCESS_HISTORY logs user data access events only [OK]

Common Mistakes:

• Confusing ACCESS_HISTORY with billing or performance views
• Thinking it shows database structure
• Assuming it tracks query performance

2. Which of the following is the correct syntax to query the ACCESS_HISTORY view for all accesses in the last 7 days?

easy

A. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME = CURRENT_DATE - 7;

B. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME < CURRENT_DATE + 7;

C. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7;

D. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME BETWEEN CURRENT_DATE AND CURRENT_DATE + 7;

Solution

1. Step 1: Understand date filtering in Snowflake SQL

   To get records from the last 7 days, filter where ACCESS_TIME is greater than current date minus 7 days.

2. Step 2: Check each option's date condition

   SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7; correctly uses ACCESS_TIME > CURRENT_DATE - 7 to get recent records.

3. Final Answer:

   SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7; -> Option C

4. Quick Check:

   Date filter for last 7 days = SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7; [OK]

Hint: Use > CURRENT_DATE - 7 for last 7 days filter [OK]

Common Mistakes:

• Using < instead of > for recent dates
• Using = which matches only one day
• Using BETWEEN with future dates incorrectly

3. What will be the result of this query?

SELECT USER_NAME, COUNT(*) AS ACCESS_COUNT
FROM ACCESS_HISTORY
WHERE OBJECT_NAME = 'CUSTOMERS'
GROUP BY USER_NAME
ORDER BY ACCESS_COUNT DESC
LIMIT 3;

medium

A. All users who accessed any object named CUSTOMERS

B. An error because OBJECT_NAME is not a valid column

C. The total number of accesses to all objects

D. Top 3 users who accessed the CUSTOMERS object most frequently

Solution

1. Step 1: Analyze the query components

   The query counts accesses per user filtered by OBJECT_NAME = 'CUSTOMERS'.

2. Step 2: Understand GROUP BY and ORDER BY

   It groups by USER_NAME, orders by count descending, and limits to top 3 users.

3. Final Answer:

   Top 3 users who accessed the CUSTOMERS object most frequently -> Option D

4. Quick Check:

   GROUP BY USER_NAME with LIMIT 3 = Top 3 users who accessed the CUSTOMERS object most frequently [OK]

Hint: GROUP BY user and LIMIT 3 shows top 3 users [OK]

Common Mistakes:

• Thinking it lists all users without limit
• Assuming OBJECT_NAME is invalid
• Confusing total accesses with per-user counts

4. You run this query but get an error:

SELECT * FROM ACCESS_HISTORY WHERE USER = 'JOHN';

What is the likely cause and fix?

medium

A. Column USER does not exist; use USER_NAME instead

B. ACCESS_HISTORY view is not accessible to your role

C. Syntax error due to missing semicolon

D. USER is a reserved keyword; enclose in double quotes

Solution

1. Step 1: Check column names in ACCESS_HISTORY

   The correct column for user is USER_NAME, not USER.

2. Step 2: Correct the query column name

   Replace USER with USER_NAME to fix the error.

3. Final Answer:

   Column USER does not exist; use USER_NAME instead -> Option A

4. Quick Check:

   Use USER_NAME column, not USER [OK]

Hint: Use USER_NAME, not USER, as column name [OK]

Common Mistakes:

• Using USER instead of USER_NAME
• Assuming missing semicolon causes error
• Thinking ACCESS_HISTORY is inaccessible

5. You want to audit all SELECT queries on the SALES table in the last 30 days. Which query correctly retrieves this from ACCESS_HISTORY?

hard

A. SELECT QUERY_TEXT, USER_NAME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'INSERT' AND ACCESS_TIME > CURRENT_DATE - 30;

B. SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30;

C. SELECT * FROM ACCESS_HISTORY WHERE TABLE_NAME = 'SALES' AND QUERY_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30;

D. SELECT QUERY_TEXT, USER_NAME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TIME < CURRENT_DATE - 30;

Solution

1. Step 1: Identify correct column names and filters

   ACCESS_HISTORY uses OBJECT_NAME for table, ACCESS_TYPE for operation, and ACCESS_TIME for timestamp.

2. Step 2: Check filter conditions for SELECT and last 30 days

   SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30; filters OBJECT_NAME = 'SALES', ACCESS_TYPE = 'SELECT', and ACCESS_TIME > CURRENT_DATE - 30 correctly.

3. Final Answer:

   SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30; -> Option B

4. Quick Check:

   Correct columns and filters = SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30; [OK]

Hint: Filter by OBJECT_NAME, ACCESS_TYPE, and recent ACCESS_TIME [OK]

Common Mistakes:

• Using TABLE_NAME or QUERY_TYPE which don't exist
• Filtering for INSERT instead of SELECT
• Using ACCESS_TIME < CURRENT_DATE - 30 (old data)