ADA-C01 Question 159
Single answerDescribe encryption key rotation and periodic rekeying configurationA financial services company uses Tri-Secret Secure in Snowflake and stores highly sensitive customer data in several permanent tables. During a security review, the administrators are asked to explain how Snowflake handles encryption key changes over time and what they can configure to reduce the amount of data protected by older keys. Which statement should the administrator provide?
- A
Snowflake supports periodic rekeying, which rewrites encrypted data using newer keys over time, while key rotation changes the active encryption keys used to protect data and key hierarchy components.
- B
Once data is encrypted in Snowflake, existing micro-partitions remain permanently encrypted with their original keys unless the table is recreated with a CREATE OR REPLACE statement.
- C
Administrators can configure a custom SQL schedule to rotate Snowflake-managed encryption keys at the table level for permanent tables that contain regulated data.
- D
Key rotation in Snowflake immediately decrypts and re-encrypts all historical data files in a single transaction, so periodic rekeying does not provide any additional benefit.
Show answer and explanation
Correct answer: A
Explanation
In Snowflake, encryption uses a hierarchical key model. Key rotation refers to changing keys in the encryption hierarchy, while periodic rekeying refers to re-encrypting existing stored data over time so older keys protect a smaller amount of data. This distinction is important in regulated environments and in architectures such as Tri-Secret Secure, where organizations want confidence that older keys are phased out from active protection of long-lived data. Administrators should understand that Snowflake manages encryption operations as a platform capability; customers do not typically configure table-level SQL jobs to rotate encryption keys. Snowflake documentation on data encryption and key management describes the use of hierarchical keys, key rotation, and rekeying behavior as part of the service's security design and best practices.
- A. Correct.
Correct. This best reflects Snowflake's encryption behavior. Snowflake uses hierarchical key management and rotates keys within that hierarchy. Periodic rekeying is the process of re-encrypting data over time with newer keys so that less data remains protected by older keys. This is the practical distinction security teams often need to understand during audits.
- B. Incorrect.
Incorrect. This is a common misconception. Snowflake does not require administrators to recreate tables just to move data to newer encryption keys. Periodic rekeying is specifically intended to re-encrypt previously stored data over time without requiring manual table recreation.
- C. Incorrect.
Incorrect. Snowflake does not expose customer-controlled SQL scheduling for rotating Snowflake-managed encryption keys at the table level. Encryption key management and rotation are handled by Snowflake as part of its platform security architecture, rather than through per-table SQL commands.
- D. Incorrect.
Incorrect. Key rotation does not mean all historical encrypted data is instantly rewritten in one immediate transaction. That is why periodic rekeying matters: it gradually re-encrypts existing data with newer keys over time instead of requiring a single massive rewrite event.