COF-C03 Question 188
Single answerEncryption key managementA financial services company stores regulated customer data in Snowflake and must demonstrate to auditors that encryption keys can be centrally controlled and revoked by the company, not by the cloud provider. The security team wants to use its own cloud key management service while minimizing application changes for Snowflake users. Which Snowflake feature best meets this requirement?
- A
Tri-Secret Secure, which combines a customer-managed key in the cloud provider's key management service with Snowflake-managed keys to protect data
- B
A network policy that restricts access to Snowflake only from approved corporate IP addresses
- C
Dynamic data masking policies that obfuscate sensitive columns unless a user has a privileged role
- D
External tokenization, which replaces sensitive values before they are loaded into Snowflake and removes the need for Snowflake encryption keys
Show answer and explanation
Correct answer: A
Explanation
The best answer is Tri-Secret Secure. In Snowflake, all customer data is encrypted by default using strong encryption and a hierarchical key model managed by Snowflake. When an organization must retain additional control over encryption keys for compliance or internal governance, Tri-Secret Secure allows the customer to use a key managed in the cloud provider's key management service in addition to Snowflake-managed keys. This supports centralized control and the ability to revoke access by disabling or removing the customer-managed key. The other options are important security features, but they do not meet the specific requirement for customer-controlled encryption key management. This aligns with Snowflake documentation on Tri-Secret Secure and encryption key management best practices.
- A. Correct.
Correct. Tri-Secret Secure is designed for customers who need additional control over encryption by using a customer-managed key in the cloud provider's key management service together with Snowflake's internal key hierarchy. This helps satisfy requirements for centralized customer control and the ability to disable access by revoking the customer-managed key, while keeping the standard Snowflake user experience largely unchanged.
- B. Incorrect.
Incorrect. Network policies improve access security by limiting which IP addresses can connect, but they do not address encryption key ownership, customer-controlled revocation, or centralized key management. Someone might choose this option because it is a valid security control, but it is unrelated to key management.
- C. Incorrect.
Incorrect. Dynamic data masking protects data visibility at query time based on roles and policies, not encryption key control. It is a common misconception to confuse data protection features with encryption key management features. Masking does not provide customer-managed encryption keys or key revocation capability.
- D. Incorrect.
Incorrect. External tokenization can reduce exposure of sensitive data by storing tokens instead of original values, but it is a separate data protection pattern and does not replace Snowflake's platform encryption or provide centralized control of Snowflake encryption keys. It also typically requires application or pipeline changes, which conflicts with the goal of minimizing changes for Snowflake users.