ADA-C01 Question 158
Select 3Describe how Snowflake encrypts customer dataA financial services company is onboarding to Snowflake and must document how customer data is protected to satisfy an internal security review. The security team asks the Snowflake administrator to identify which statements accurately describe Snowflake's native encryption of customer data at rest and in transit. Which TWO statements should the administrator include?
- A
Snowflake encrypts data in transit using TLS and encrypts data at rest using a hierarchical key model with multiple levels of keys.
- B
Snowflake requires administrators to manually rotate table-level encryption keys on a fixed schedule to keep stored data encrypted.
- C
Snowflake uses per-file encryption keys protected by higher-level keys, which helps limit exposure and supports key rotation practices.
- D
Snowflake stores customer data unencrypted inside the virtual warehouse cache because compute-layer storage is considered temporary.
- E
Snowflake's Tri-Secret Secure model can add a customer-managed key component to the protection of data at rest, in addition to Snowflake-managed key material.
Show answer and explanation
Correct answers: A, C, E
Explanation
The best answers are 1, 3, and 5. Snowflake protects customer data both in transit and at rest. In transit, Snowflake uses TLS for secure network communications. At rest, Snowflake uses a hierarchical key model rather than a single static encryption key. This model includes lower-level data or file keys wrapped by higher-level keys, which aligns with Snowflake's documented end-to-end encryption architecture and supports operational practices such as key rotation and separation of duties. Tri-Secret Secure is also a valid description of how Snowflake can protect data at rest for customers that want an additional customer-controlled key component through an external key management integration. Options 2 and 4 are incorrect because Snowflake does not require customers to manually rotate table-level encryption keys for native encryption, and Snowflake does not intentionally leave customer data unencrypted just because it is temporary or associated with compute. These points align with Snowflake security documentation on end-to-end encryption, key hierarchy, and Tri-Secret Secure best practices.
- A. Correct.
Correct. Snowflake encrypts data in transit with TLS and encrypts data at rest by using strong encryption and a hierarchical key model. In Snowflake documentation, customer data is protected with end-to-end encryption, including transport-layer encryption for network traffic and layered key management for stored data.
- B. Incorrect.
Incorrect. A common misconception is that customers must directly manage low-level encryption keys for Snowflake storage objects. Snowflake handles native encryption and key management operations for its platform-managed encryption model. Administrators do not manually rotate table-level keys as part of standard Snowflake encryption operations.
- C. Correct.
Correct. Snowflake's encryption design includes file-level or object-level data encryption keys that are themselves encrypted by higher-level keys in a hierarchy. This layered approach supports compartmentalization and operational key rotation without requiring customers to re-engineer application logic.
- D. Incorrect.
Incorrect. Snowflake does not leave customer data unencrypted simply because storage is temporary or associated with compute. Snowflake's security model is built around encryption of customer data, and this option reflects a misunderstanding that ephemeral or cached data is exempt from encryption requirements.
- E. Correct.
Correct. Tri-Secret Secure is a Snowflake capability that combines Snowflake-managed encryption controls with an additional customer-managed key in an external key management service, strengthening control over data at rest. This is relevant when organizations need extra governance over encryption key participation.