ADA-C01 Question 182
Single answerUse tagging and classification in SnowflakeA financial services company wants to identify and govern sensitive data in a Snowflake database used by multiple analytics teams. The security administrator has already created governance tags such as PII_CLASSIFICATION and DATA_OWNER. The administrator must now quickly discover likely sensitive columns across hundreds of existing tables and then use the results to support consistent tagging and downstream masking policies. Which approach should the administrator take?
- A
Run Snowflake's sensitive data classification on the existing tables, review the classification results, and then apply governance tags to the identified columns based on those results.
- B
Create a masking policy first; Snowflake will automatically classify all columns referenced by that policy and populate governance tags on matching columns.
- C
Assign the PII_CLASSIFICATION tag at the database level; Snowflake will automatically infer and propagate sensitive classifications to all child schemas, tables, and columns.
- D
Use SEARCH OPTIMIZATION on the database to detect columns containing sensitive values, then convert the optimization metadata into tags.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake's sensitive data classification capability to scan existing tables and identify columns that likely contain regulated or confidential data, then use those findings to apply governance tags such as PII classification or ownership. This reflects a common enterprise workflow: discover sensitive data first, then enforce governance consistently with tags, masking policies, and auditing. A common misconception is that masking policies or parent-level tags automatically discover or infer sensitivity, but they do not. Another misconception is confusing performance features such as SEARCH OPTIMIZATION with governance capabilities. Snowflake documentation on data classification and object tagging describes these as complementary but distinct features: classification helps identify sensitive data, while tags provide metadata-based governance and can be used with policy frameworks.
- A. Correct.
Correct. Snowflake supports sensitive data classification to help identify likely sensitive columns in existing data. In practice, administrators can run classification against tables, inspect the generated recommendations/results, and then apply governance tags to columns to drive governance controls such as masking and discovery. This is the appropriate workflow when the goal is to discover sensitive data at scale and then standardize tagging.
- B. Incorrect.
Incorrect. Masking policies do not trigger automatic sensitive data classification, nor do they automatically populate tags on referenced columns. Masking policies and tags are related governance features, but classification is a separate capability used to identify likely sensitive data before or alongside policy assignment.
- C. Incorrect.
Incorrect. Applying a tag at the database level can be useful for broad metadata labeling, but it does not cause Snowflake to infer which specific child columns contain sensitive data. Classification is not automatically derived from a parent-level tag assignment. Sensitive-data identification requires classification or explicit governance decisions at the appropriate object level.
- D. Incorrect.
Incorrect. SEARCH OPTIMIZATION is a performance feature used to improve selective query performance; it is not a data discovery or classification tool. It does not analyze columns for PII or generate tagging recommendations.