ADA-C01 Question 171
Single answerUse external tokenizationA healthcare company stores patient support tickets in Snowflake and must ensure that sensitive fields such as patient names and phone numbers are never stored in clear text inside Snowflake. Security policy requires those values to be tokenized by the company's external tokenization service before they are written to tables, while authorized analysts must still be able to detokenize values in controlled workflows. The administrator is designing the Snowflake integration. Which approach best meets these requirements?
- A
Create an external access integration so a user-defined function can call the external tokenization service during tokenization and detokenization workflows, and store only the returned tokens in Snowflake tables.
- B
Use dynamic data masking policies on the sensitive columns so Snowflake automatically replaces clear-text values with masked values at query time, eliminating the need for external tokenization.
- C
Encrypt the sensitive columns with Tri-Secret Secure and store the encrypted values in Snowflake tables; analysts can query the encrypted values directly when needed.
- D
Create a network policy that restricts access to the table by IP address, then use secure views to expose tokenized values to analysts while storing clear text in the base table.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake external tokenization with an external tokenization service so that only tokens are stored in Snowflake. For implementations that need Snowflake code to communicate with external services, external access integrations are used to authorize outbound network access to specific endpoints. This supports tokenization and detokenization workflows while keeping the tokenization logic and sensitive mappings outside Snowflake. By contrast, masking policies, secure views, and network policies govern visibility and access but do not prevent clear-text persistence. Similarly, encryption features such as Snowflake-managed encryption or Tri-Secret Secure protect data at rest but do not replace tokenization requirements where the source value must never be stored in Snowflake. This reflects Snowflake best practice when regulatory or internal security policies require externalized token handling and strict control over detokenization.
- A. Correct.
Correct. External tokenization is designed for scenarios where sensitive data must be transformed by a customer-managed external tokenization service rather than stored in clear text in Snowflake. In practice, Snowflake can use an external access integration to allow handler code such as a UDF or procedure to securely call approved external endpoints. The workflow stores only tokens in Snowflake, and authorized detokenization can be performed through controlled functions or procedures that call the external service. This aligns with the requirement that clear-text values are never persisted in Snowflake.
- B. Incorrect.
Incorrect. Dynamic data masking only changes how data is presented at query time based on role or policy conditions. It does not prevent the underlying clear-text value from being stored in Snowflake. A candidate might choose this because masking is a common control for sensitive data, but it does not satisfy the requirement that clear text must never be stored in Snowflake.
- C. Incorrect.
Incorrect. Tri-Secret Secure enhances key management for encryption at rest, but Snowflake still stores the original data values logically within the platform and decrypts them for authorized processing. It is not a substitute for external tokenization, which replaces the sensitive value with a token before storage. This option confuses encryption at rest with tokenization.
- D. Incorrect.
Incorrect. Network policies and secure views can help limit access and exposure, but they do not change the fact that the underlying clear-text data would still be stored in Snowflake if loaded that way. The requirement is specifically about preventing clear-text storage, which access controls alone cannot achieve.