COF-C03 Question 183
Single answerObject taggingA data governance team at a financial services company wants to classify sensitive data in Snowflake. They create a tag named DATA_CLASSIFICATION and define allowed values such as PUBLIC, INTERNAL, and CONFIDENTIAL. They want database engineers to apply this tag to tables and columns, but they also want to prevent invalid tag values from being used accidentally in production. Which approach best meets this requirement?
- A
Create the tag with an allowed values list, and grant the APPLY TAG privilege so engineers can set only approved values on supported objects.
- B
Create a masking policy that lists PUBLIC, INTERNAL, and CONFIDENTIAL, and attach the policy to each table so only approved tag values can be assigned.
- C
Grant OWNERSHIP on the tag to all database engineers so they can manage and apply the tag consistently across environments.
- D
Store the valid classification values in a reference table and rely on engineers to look up the values before using ALTER TABLE ... SET TAG.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use a Snowflake tag with allowed values and grant the APPLY TAG privilege to the appropriate roles. In Snowflake, tags are schema-level objects used for governance and metadata classification. Allowed values help standardize tag usage and prevent nonapproved values from being assigned. The APPLY TAG privilege is designed specifically for applying tags without granting broader administrative control such as OWNERSHIP. This aligns with Snowflake best practices for delegated governance: central teams define governance artifacts, while implementation teams are granted limited privileges to use them safely. Relevant Snowflake documentation covers CREATE TAG with allowed values, tag-based governance, and the APPLY TAG privilege.
- A. Correct.
Correct. Snowflake object tags can be created with an allowed values list, which restricts tag assignments to predefined values. Granting the APPLY TAG privilege lets users apply the tag to supported objects without needing full ownership of the tag. This is the most direct way to enforce approved classifications and reduce invalid values in production.
- B. Incorrect.
Incorrect. Masking policies control how data is exposed at query time; they do not define or validate the set of permissible values for an object tag. A common misconception is to treat masking policies as a general governance mechanism for all metadata controls, but tag value validation is handled through the tag definition itself.
- C. Incorrect.
Incorrect. OWNERSHIP is excessive for this use case. It would allow engineers to modify or transfer ownership of the tag, not just apply it. The requirement is to let engineers use the tag while preventing invalid values, which is better addressed with allowed values plus the APPLY TAG privilege.
- D. Incorrect.
Incorrect. A reference table and manual process do not enforce correctness. Engineers could still assign unsupported or misspelled values when setting the tag. The scenario asks for prevention of invalid values, so built-in enforcement through allowed values is preferable to procedural guidance.