Access history and audit logging in Snowflake - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Access History in Snowflake?

Access History in Snowflake is a feature that records detailed information about user activities, such as queries run, objects accessed, and the time of access. It helps track who did what and when in your Snowflake account.

beginner

How does Snowflake Audit Logging help in security?

Audit Logging captures all account-level events like login attempts, role changes, and data access. This helps detect unauthorized access, monitor compliance, and investigate security incidents.

intermediate

Which Snowflake view provides access history details?

The view named ACCESS_HISTORY in the SNOWFLAKE.ACCOUNT_USAGE schema provides detailed records of user access to objects, including query IDs, user names, and timestamps.

intermediate

What is the retention period for Access History data in Snowflake?

By default, Access History data is retained for 1 year in Snowflake, allowing long-term auditing and analysis of user activities.

intermediate

How can you query audit logs in Snowflake?

You can query audit logs by selecting from the SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY and QUERY_HISTORY views to see login events and query executions respectively.

Which Snowflake schema contains the ACCESS_HISTORY view?

A SNOWFLAKE.DATABASES

B INFORMATION_SCHEMA

C SNOWFLAKE.ACCOUNT_USAGE

D PUBLIC

The ACCESS_HISTORY view is located in the SNOWFLAKE.ACCOUNT_USAGE schema.

What type of events does Snowflake Audit Logging NOT capture?

A User login attempts

B Query executions

C Role changes

D Local machine file changes

Audit Logging captures Snowflake account events, not changes on local machines.

How long is Access History data retained by default in Snowflake?

A 1 year

B 90 days

C Indefinitely

D 30 days

Access History data is retained for 1 year by default.

Which view would you query to see user login events in Snowflake?

A ACCESS_HISTORY

B LOGIN_HISTORY

C QUERY_HISTORY

D SESSION_HISTORY

LOGIN_HISTORY view shows user login events.

What is the main purpose of Access History in Snowflake?

A To track user activities and data access

B To store user passwords

C To manage database backups

D To optimize query performance

Access History tracks user activities and data access for auditing.

Explain how Access History and Audit Logging help maintain security in Snowflake.

Think about what information is recorded and why it matters for security.

Describe how you would find out who accessed a specific table in Snowflake using audit logs.

Focus on which views to use and what filters to apply.