ADA-C01 Question 157
Select 2Describe how Snowflake encrypts customer dataA security architect is reviewing how a company's Snowflake deployment protects regulated customer data. The architect wants to confirm which statements accurately describe Snowflake's native encryption model for data at rest and key protection, without relying on customer-managed keys. Which TWO statements should the architect validate as correct?
- A
Snowflake encrypts customer data at rest using a hierarchical key model, where file keys encrypt data files and higher-level keys protect lower-level keys.
- B
Snowflake stores encrypted data and the encryption keys together in the same cloud storage location so that cloud-provider access controls can protect both.
- C
Snowflake rotates keys through its key hierarchy and uses distinct keys for protecting data and key-encrypting keys rather than relying on a single static account-level key for all encryption.
- D
Snowflake requires Tri-Secret Secure for all customer accounts before any data can be encrypted at rest.
- E
Snowflake encrypts customer data only during transit between client applications and Snowflake; encryption at rest must be configured separately by the customer.
Show answer and explanation
Correct answers: A, C
Explanation
Snowflake natively encrypts customer data at rest and in transit. For data at rest, Snowflake uses a hierarchical key management and envelope encryption approach: lower-level keys encrypt data, and higher-level keys encrypt those lower-level keys. This allows secure isolation, controlled key rotation, and reduced blast radius compared with a flat single-key model. Snowflake's standard platform already includes encryption at rest; customers do not need Tri-Secret Secure to obtain baseline encryption. Tri-Secret Secure is an optional feature that introduces a customer-managed key component for organizations with stricter key custody requirements. For exam purposes, candidates should understand the practical distinction between Snowflake's default encryption model and optional customer-managed key enhancements, as described in Snowflake documentation on data encryption, key hierarchy, and Tri-Secret Secure.
- A. Correct.
Correct. Snowflake uses envelope encryption with a hierarchical key model for data at rest. Individual data files or micro-partition storage objects are protected by lower-level keys, and those keys are themselves encrypted by higher-level keys. This layered approach is a core part of Snowflake's native encryption design and is intended to limit exposure while supporting secure key management and rotation.
- B. Incorrect.
Incorrect. A common misconception is that encrypted data and keys are simply stored side by side and protected only by cloud-provider IAM controls. In Snowflake, key management is separated through a hierarchy of keys, and keys are not just co-located with the data as plaintext or directly usable material. The security model depends on encrypted key wrapping and separation of duties, not merely storage-location controls.
- C. Correct.
Correct. Snowflake's native encryption architecture uses multiple levels of keys and supports key rotation within the hierarchy. It does not depend on one static account-level key to encrypt all customer data directly. This is important in real-world audits because it demonstrates both compartmentalization and cryptographic hygiene through layered key protection.
- D. Incorrect.
Incorrect. Tri-Secret Secure is an optional enhancement that adds a customer-managed key component on top of Snowflake's standard encryption model. Snowflake already encrypts customer data at rest by default, even when Tri-Secret Secure is not enabled. Choosing this option reflects confusion between default encryption and advanced customer-controlled key features.
- E. Incorrect.
Incorrect. Snowflake encrypts customer data both in transit and at rest by default. Customers do not need to separately enable encryption at rest for standard Snowflake storage. This option reflects a misconception carried over from some infrastructure platforms where storage encryption may require explicit customer configuration.