COF-C03 Question 174
Single answer2.2 Define data governance features and how they are usedA healthcare company stores patient data in Snowflake. The compliance team must let analysts query a PATIENTS table, but analysts should only see full Social Security numbers for rows belonging to their own region. For all other rows, the SSN must be masked. The company also wants this protection to remain in effect regardless of which BI tool or SQL client is used. Which Snowflake feature should be implemented to meet this requirement most effectively?
- A
Create a masking policy on the SSN column that uses the current role to determine whether to show the full value or a masked value
- B
Create a row access policy on the PATIENTS table to hide the SSN column for unauthorized users
- C
Use a secure view instead of the base table, because secure views are the only way to enforce column-level data protection across all tools
- D
Grant analysts the imported privileges on the database so Snowflake can automatically mask sensitive values based on region
Show answer and explanation
Correct answer: A
Explanation
Snowflake data governance includes features such as masking policies for column-level protection and row access policies for row-level filtering. In this scenario, the requirement is to conditionally display or mask SSN values, which is a column-level governance problem. Therefore, a masking policy is the best fit. The policy can use context functions such as CURRENT_ROLE or other authorized mapping logic to determine when to reveal the true value. If the company also needed to restrict which regional rows analysts can query, a row access policy could be added separately for row-level security. Snowflake documentation describes dynamic data masking as the mechanism for protecting sensitive data in query results across applications, while row access policies are used to filter row visibility.
- A. Correct.
Correct. Dynamic data masking in Snowflake is implemented with masking policies, which are attached to specific columns. A masking policy can evaluate context such as the current role and return either the original SSN or a masked value. Because the policy is enforced in Snowflake, it applies consistently no matter which SQL client, worksheet, or BI tool issues the query. This is the appropriate governance feature for column-level protection of sensitive data.
- B. Incorrect.
Incorrect. Row access policies control which rows are visible to a query, not how individual column values are displayed. They are used for row-level security, such as restricting analysts to only rows for their region. They do not directly mask a column like SSN. A common misconception is to use row access policies for any data restriction requirement, but masking sensitive column values is the purpose of masking policies.
- C. Incorrect.
Incorrect. Secure views can help limit exposure of underlying logic and can be used to present filtered or transformed data, but they are not the only or primary Snowflake feature for column-level masking. The scenario specifically requires policy-based masking that remains enforced across tools, which is what masking policies are designed for. While a secure view could be part of a solution, it is less direct and less aligned with Snowflake's governance features for this use case.
- D. Incorrect.
Incorrect. Imported privileges are related to granting access to shared databases and certain objects from shares, not to automatic data masking or regional enforcement. Snowflake does not automatically mask values based on region through imported privileges. This option mixes unrelated concepts and reflects a misunderstanding of Snowflake access control and governance features.