COF-C03 Question 175
Single answer2.2 Define data governance features and how they are usedA healthcare company stores patient data in Snowflake. Analysts in the FINANCE role need to query billing columns, but they must not see full Social Security numbers in the PATIENT_SSN column. At the same time, a small compliance team must be able to view the unmasked values when investigating fraud. The company wants to enforce this centrally in Snowflake so that existing and future queries against the table automatically follow the rule. Which Snowflake feature should be used to meet this requirement?
- A
Create a masking policy on PATIENT_SSN that returns masked or unmasked values based on the querying role
- B
Create a row access policy on the table to hide the PATIENT_SSN column from the FINANCE role
- C
Use a resource monitor to block queries from FINANCE that access PATIENT_SSN
- D
Use a warehouse-level parameter to obfuscate sensitive string columns for non-privileged roles
Show answer and explanation
Correct answer: A
Explanation
The correct solution is to use a masking policy because the requirement is to protect a sensitive column while still allowing authorized roles to view the original value. In Snowflake, masking policies are schema-level objects that can be applied to columns and can use conditional logic based on role or other session context to return either masked or unmasked data. This makes them well suited for centralized, automatic enforcement across current and future queries. By contrast, row access policies govern row visibility, not column masking. Resource monitors are for cost governance, not data governance. A warehouse parameter for role-based obfuscation does not exist. This aligns with Snowflake best practices for data governance, where dynamic data masking is used for column-level protection of sensitive data such as SSNs, credit card numbers, and personal identifiers.
- A. Correct.
Correct. Dynamic data masking in Snowflake is implemented with masking policies. A masking policy can be attached directly to a column such as PATIENT_SSN and can evaluate context, including the current role, to determine whether to reveal the original value or a masked version. This is the appropriate governance feature when the goal is to protect sensitive column values centrally while allowing authorized users, such as a compliance team, to see clear text.
- B. Incorrect.
Incorrect. Row access policies control which rows are visible to a query, not how individual column values are masked. Someone might choose this option because row access policies are also a governance feature, but they are designed for row-level filtering rather than column-level redaction.
- C. Incorrect.
Incorrect. Resource monitors are used to track and control credit usage, typically by suspending warehouses or sending notifications when usage thresholds are reached. They do not provide data governance controls for masking sensitive values in query results.
- D. Incorrect.
Incorrect. Snowflake does not provide a warehouse-level parameter that automatically obfuscates sensitive columns for certain roles. Governance of sensitive data visibility is handled through features such as masking policies, row access policies, tags, and object privileges, not warehouse-level string obfuscation settings.