A Data Engineer is supporting a security audit and needs to identify all tables accessed by USER1 in the last month. What query can be used to meet this requirement? A. B. C. D.

Question

Exhibits

Options

• Aaccess_history_flattened as ( select o.value:objectName::text as object_name, o.value:objectDomain::text as object_domain, from snowflake.account_usage.access_history, lateral flatten(access_history.direct_objects_accessed) as o where access_history.query_start_time > current_date - 30 ) select distinct object_name from access_history_flattened where user_name='USER1' and object_domain='Table';
• Bselect direct_objects_accessed.objectName::text as object_name, direct_objects_accessed.objectDomain::text as object_domain, from snowflake.account_usage.access_history where user_name='USER1' and object_domain='Table';
• Caccess_history_flattened as ( select objects_accessed.value:objectName::text as object_name, objects_accessed.value:objectDomain::text as object_domain, from snowflake.account_usage.access_history, lateral flatten(access_history.objects_accessed) as objects_accessed where access_history.query_start_time > current_date - 30) select distinct object_name from access_history_flattened where user_name='USER1' and object_domain='Table';
• Dwith query_history_flattened as ( select objects_accessed.value:objectName::text as object_name, objects_accessed.value:objectDomain::text as object_domain, from snowflake.account_usage.query_history, lateral flatten(query_history.objects_accessed) as objects_accessed where query_history.query_start_time > current_date - 30) select distinct object_name from query_history_flattened where user_name='USER1' and object_domain='Table';

• A
  79% (37)
• B
  4% (2)
• C
  11% (5)
• D
  6% (3)

Explanation

The ACCOUNT_USAGE.ACCESS_HISTORY view’s DIRECT_OBJECTS_ACCESSED array contains exactly those tables a user directly queried. Flattening that array and filtering by user_name and object_domain='Table' (as shown in image 1) returns the distinct table names accessed by USER1 in the past 30 days.

No community discussion yet for this question.