Access history and audit logging in Snowflake - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to query the access history for the last 7 days.

Snowflake

SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY WHERE EVENT_TIMESTAMP >= CURRENT_DATE() - INTERVAL '[1]' DAY;

Drag options to blanks, or click blank then click option'

A1

B14

C7

D30

Attempts:

3 left

💡 Hint

Common Mistakes

Using a number without quotes in INTERVAL.

Using a wrong number of days like 30 or 1.

The query filters access history for the last 7 days using INTERVAL '7' DAY.

2fill in blank

medium

Complete the code to filter audit logs by a specific user.

Snowflake

SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY WHERE USER_NAME = '[1]';

Drag options to blanks, or click blank then click option'

ASYSADMIN

BADMIN

CPUBLIC

DJOHN_DOE

Attempts:

3 left

💡 Hint

Common Mistakes

Using role names instead of usernames.

Using lowercase when username is uppercase.

Replace '{{BLANK_1}}' with the exact username to filter logs for that user.

3fill in blank

hard

Fix the error in the query to get audit logs for a specific object type.

Snowflake

SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY WHERE OBJECT_TYPE = '[1]';

Drag options to blanks, or click blank then click option'

ATABLE

BTable

Ctable

Dtables

Attempts:

3 left

💡 Hint

Common Mistakes

Using lowercase or plural forms for object types.

Using quotes incorrectly.

Object types in Snowflake audit logs are uppercase, so use 'TABLE'.

4fill in blank

hard

Fill both blanks to create a query that counts access events grouped by user and event type.

Snowflake

SELECT USER_NAME, [1], COUNT(*) AS EVENT_COUNT FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY GROUP BY USER_NAME, [2];

Drag options to blanks, or click blank then click option'

AEVENT_TYPE

BEVENT_TIMESTAMP

CUSER_NAME

DOBJECT_NAME

Attempts:

3 left

💡 Hint

Common Mistakes

Grouping by USER_NAME twice.

Grouping by a column not selected.

Grouping by EVENT_TYPE along with USER_NAME counts events per user per event type.

5fill in blank

hard

Fill all three blanks to create a query that filters access history for a specific database, object type, and orders by event time descending.

Snowflake

SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY WHERE DATABASE_NAME = '[1]' AND OBJECT_TYPE = '[2]' ORDER BY [3] DESC;

Drag options to blanks, or click blank then click option'

AMY_DATABASE

BTABLE

CEVENT_TIMESTAMP

DSCHEMA_NAME

Attempts:

3 left

💡 Hint

Common Mistakes

Using schema name instead of database name.

Ordering by a non-timestamp column.

This query filters by database name and object type, then orders results by event timestamp descending.

Practice

1. What does the ACCESS_HISTORY view in Snowflake primarily provide?

easy

A. Information about who accessed data and when

B. Details about Snowflake account billing

C. List of all database tables and schemas

D. Performance metrics of queries

Solution

1. Step 1: Understand the purpose of ACCESS_HISTORY

   The ACCESS_HISTORY view records user activity related to data access in Snowflake.

2. Step 2: Identify what ACCESS_HISTORY tracks

   It tracks who accessed what data and when, useful for audit and compliance.

3. Final Answer:

   Information about who accessed data and when -> Option A

4. Quick Check:

   ACCESS_HISTORY = Data access logs [OK]

Hint: ACCESS_HISTORY logs user data access events only [OK]

Common Mistakes:

• Confusing ACCESS_HISTORY with billing or performance views
• Thinking it shows database structure
• Assuming it tracks query performance

2. Which of the following is the correct syntax to query the ACCESS_HISTORY view for all accesses in the last 7 days?

easy

A. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME = CURRENT_DATE - 7;

B. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME < CURRENT_DATE + 7;

C. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7;

D. SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME BETWEEN CURRENT_DATE AND CURRENT_DATE + 7;

Solution

1. Step 1: Understand date filtering in Snowflake SQL

   To get records from the last 7 days, filter where ACCESS_TIME is greater than current date minus 7 days.

2. Step 2: Check each option's date condition

   SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7; correctly uses ACCESS_TIME > CURRENT_DATE - 7 to get recent records.

3. Final Answer:

   SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7; -> Option C

4. Quick Check:

   Date filter for last 7 days = SELECT * FROM ACCESS_HISTORY WHERE ACCESS_TIME > CURRENT_DATE - 7; [OK]

Hint: Use > CURRENT_DATE - 7 for last 7 days filter [OK]

Common Mistakes:

• Using < instead of > for recent dates
• Using = which matches only one day
• Using BETWEEN with future dates incorrectly

3. What will be the result of this query?

SELECT USER_NAME, COUNT(*) AS ACCESS_COUNT
FROM ACCESS_HISTORY
WHERE OBJECT_NAME = 'CUSTOMERS'
GROUP BY USER_NAME
ORDER BY ACCESS_COUNT DESC
LIMIT 3;

medium

A. All users who accessed any object named CUSTOMERS

B. An error because OBJECT_NAME is not a valid column

C. The total number of accesses to all objects

D. Top 3 users who accessed the CUSTOMERS object most frequently

Solution

1. Step 1: Analyze the query components

   The query counts accesses per user filtered by OBJECT_NAME = 'CUSTOMERS'.

2. Step 2: Understand GROUP BY and ORDER BY

   It groups by USER_NAME, orders by count descending, and limits to top 3 users.

3. Final Answer:

   Top 3 users who accessed the CUSTOMERS object most frequently -> Option D

4. Quick Check:

   GROUP BY USER_NAME with LIMIT 3 = Top 3 users who accessed the CUSTOMERS object most frequently [OK]

Hint: GROUP BY user and LIMIT 3 shows top 3 users [OK]

Common Mistakes:

• Thinking it lists all users without limit
• Assuming OBJECT_NAME is invalid
• Confusing total accesses with per-user counts

4. You run this query but get an error:

SELECT * FROM ACCESS_HISTORY WHERE USER = 'JOHN';

What is the likely cause and fix?

medium

A. Column USER does not exist; use USER_NAME instead

B. ACCESS_HISTORY view is not accessible to your role

C. Syntax error due to missing semicolon

D. USER is a reserved keyword; enclose in double quotes

Solution

1. Step 1: Check column names in ACCESS_HISTORY

   The correct column for user is USER_NAME, not USER.

2. Step 2: Correct the query column name

   Replace USER with USER_NAME to fix the error.

3. Final Answer:

   Column USER does not exist; use USER_NAME instead -> Option A

4. Quick Check:

   Use USER_NAME column, not USER [OK]

Hint: Use USER_NAME, not USER, as column name [OK]

Common Mistakes:

• Using USER instead of USER_NAME
• Assuming missing semicolon causes error
• Thinking ACCESS_HISTORY is inaccessible

5. You want to audit all SELECT queries on the SALES table in the last 30 days. Which query correctly retrieves this from ACCESS_HISTORY?

hard

A. SELECT QUERY_TEXT, USER_NAME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'INSERT' AND ACCESS_TIME > CURRENT_DATE - 30;

B. SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30;

C. SELECT * FROM ACCESS_HISTORY WHERE TABLE_NAME = 'SALES' AND QUERY_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30;

D. SELECT QUERY_TEXT, USER_NAME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TIME < CURRENT_DATE - 30;

Solution

1. Step 1: Identify correct column names and filters

   ACCESS_HISTORY uses OBJECT_NAME for table, ACCESS_TYPE for operation, and ACCESS_TIME for timestamp.

2. Step 2: Check filter conditions for SELECT and last 30 days

   SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30; filters OBJECT_NAME = 'SALES', ACCESS_TYPE = 'SELECT', and ACCESS_TIME > CURRENT_DATE - 30 correctly.

3. Final Answer:

   SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30; -> Option B

4. Quick Check:

   Correct columns and filters = SELECT QUERY_TEXT, USER_NAME, ACCESS_TIME FROM ACCESS_HISTORY WHERE OBJECT_NAME = 'SALES' AND ACCESS_TYPE = 'SELECT' AND ACCESS_TIME > CURRENT_DATE - 30; [OK]

Hint: Filter by OBJECT_NAME, ACCESS_TYPE, and recent ACCESS_TIME [OK]

Common Mistakes:

• Using TABLE_NAME or QUERY_TYPE which don't exist
• Filtering for INSERT instead of SELECT
• Using ACCESS_TIME < CURRENT_DATE - 30 (old data)