COF-C03 Question 182
Single answerObject taggingA data governance team at a retail company uses Snowflake object tags to classify sensitive data. They created a tag named DATA_CLASSIFICATION and assigned allowed values of PUBLIC, INTERNAL, and RESTRICTED. The team wants to ensure that analysts can apply only those approved values when tagging tables and columns across multiple schemas. Which action should the Snowflake administrator take to meet this requirement?
- A
Create the tag with an ALLOWED_VALUES list and grant APPLY TAG on the tag to the analyst role.
- B
Grant OWNERSHIP on the tag to the analyst role so analysts can assign only the predefined tag values.
- C
Create a masking policy that references the tag values and grant APPLY MASKING POLICY to the analyst role.
- D
Grant USAGE on the database and schema containing the tag; Snowflake will automatically restrict tag values to the approved list when analysts set tags.
- E
Create a row access policy on the tagged tables so only valid tag values can be used during ALTER TABLE ... SET TAG operations.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to define the tag with ALLOWED_VALUES and grant the appropriate privilege to apply it. In Snowflake, object tags are schema-level objects used for governance and classification. Administrators can define a tag with a constrained list of valid values, which prevents users from assigning arbitrary values. To apply the tag to supported objects such as tables or columns, a role needs the APPLY TAG privilege on the tag and sufficient privileges on the target object. Granting broader privileges such as OWNERSHIP is unnecessary and violates least-privilege best practices. Masking policies and row access policies are separate governance features and do not control which metadata tag values can be assigned. This aligns with Snowflake documentation on CREATE TAG, ALLOWED_VALUES, and tag privileges such as APPLY TAG.
- A. Correct.
Correct. Snowflake supports creating tags with an ALLOWED_VALUES list, which restricts the values that can be assigned to that tag. To let a role assign the tag to supported objects, the role needs the APPLY TAG privilege on the tag, along with appropriate privileges on the target objects. This directly satisfies the requirement that analysts can apply only approved values.
- B. Incorrect.
Incorrect. OWNERSHIP is a much stronger privilege than necessary and transfers control of the tag object. While the owner can manage the tag, granting OWNERSHIP is not the appropriate way to ensure analysts can only use approved values. The restriction comes from the tag's ALLOWED_VALUES definition, not from OWNERSHIP.
- C. Incorrect.
Incorrect. Masking policies can be associated with tags in some governance designs, but they do not enforce which tag values can be set during tagging operations. APPLY MASKING POLICY is unrelated to controlling the allowed values of an object tag.
- D. Incorrect.
Incorrect. USAGE on the database and schema is not sufficient for applying a tag, and it does not by itself authorize setting tag values. Snowflake requires APPLY TAG on the tag. The approved-value enforcement comes from defining ALLOWED_VALUES on the tag, not from basic namespace privileges.
- E. Incorrect.
Incorrect. Row access policies control row-level visibility in query results. They do not validate or restrict the values used in SET TAG statements. This option confuses governance enforcement at query time with metadata classification controls.