ADA-C01 Question 183
Single answerUse tagging and classification in SnowflakeA financial services company stores customer data in Snowflake across several databases. The security team wants to identify columns that contain sensitive data such as email addresses, phone numbers, and national identifiers, and then consistently label those columns so downstream governance controls can use the labels. The administrator must minimize manual effort and ensure the process can be repeated as new tables are added. Which approach should the administrator use?
- A
Run Snowflake sensitive data classification on the relevant tables or schemas, review the detected results, and apply tags based on the classification output.
- B
Create masking policies first, then Snowflake will automatically infer and assign sensitivity tags to columns protected by those policies.
- C
Use object dependencies in ACCOUNT_USAGE to detect sensitive columns, then Snowflake will automatically propagate built-in classification labels to matching columns.
- D
Grant the GOVERNANCE_VIEWER database role to data stewards, because this role automatically classifies sensitive data and attaches tags to newly created tables.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake's sensitive data classification capabilities to detect likely sensitive columns and then apply tags based on the classification results. This aligns with Snowflake governance best practices: first discover sensitive data systematically, then label it with tags so the labels can drive broader governance workflows. In practice, classification helps reduce manual review effort, while tags provide durable metadata that can be referenced by administrators, stewards, and downstream controls. Masking policies, roles such as GOVERNANCE_VIEWER, and metadata views in ACCOUNT_USAGE are useful in governance programs, but they do not replace the classification-and-tagging workflow. Snowflake documentation on data governance describes using classification to identify sensitive data and tags to organize and manage governance metadata across objects.
- A. Correct.
Correct. Snowflake supports sensitive data classification to discover likely sensitive columns based on built-in system classifiers. After classification results are reviewed, administrators can apply tags to the identified columns to operationalize governance. This is the practical approach when the goal is to discover sensitive data with minimal manual effort and then label it consistently for downstream use such as masking, reporting, or policy enforcement.
- B. Incorrect.
Incorrect. Masking policies do not cause Snowflake to infer or auto-assign tags. Tags and masking policies are separate governance features, although tags can be used together with governance processes. A common misconception is that protecting data with a masking policy also creates metadata labels automatically, but classification and tagging must be handled explicitly.
- C. Incorrect.
Incorrect. ACCOUNT_USAGE views and object dependency metadata can help with lineage and dependency analysis, but they do not classify data values or automatically assign sensitivity labels. This distractor reflects a misunderstanding between metadata relationships and content-aware classification.
- D. Incorrect.
Incorrect. GOVERNANCE_VIEWER is intended for visibility into governance-related metadata, not for performing automatic classification or tagging actions. Granting a viewer role does not initiate scanning or apply tags to objects. Classification requires the appropriate feature usage and execution steps by an authorized role.