ADA-C01 Question 186
Single answerImplement and manage taggingA Snowflake administrator is implementing a governance standard that requires every new table in the FINANCE schema to inherit a data classification tag from the schema, while allowing analysts with delegated authority to update tag values on individual tables without granting them ownership of those tables. Which approach best meets these requirements?
- A
Set the tag on the FINANCE schema, enable tag propagation so child objects inherit the value, and grant the analysts the APPLY TAG privilege on the tag plus the necessary USAGE privileges.
- B
Set the tag on the FINANCE schema and grant the analysts OWNERSHIP on each table so they can change tag values when needed.
- C
Set the tag on the FINANCE database and grant the analysts MODIFY on the schema, because MODIFY allows changing tag values on all child objects.
- D
Create a masking policy instead of a tag, attach it to the schema, and grant the analysts APPLY MASKING POLICY so they can update the classification value on tables.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use Snowflake tags as intended for metadata governance: define the tag, associate it at the schema level to support inherited classification behavior for newly created child objects, and delegate maintenance through APPLY TAG rather than OWNERSHIP. This aligns with least-privilege best practices and Snowflake's governance model, where tags are separate securable objects with their own privileges. In Snowflake documentation, tag administration focuses on creating tags, assigning them to supported objects, and using APPLY TAG to delegate assignment without handing over ownership of the target data objects. This is the most practical approach for implementing and managing tagging in an enterprise environment.
- A. Correct.
Correct. Snowflake supports setting tags at higher levels such as schemas and using tag propagation/inheritance behavior so descendant objects can receive the tag context. To let delegated users set or update tag assignments without transferring object ownership, the appropriate privilege is APPLY TAG on the tag object, along with required visibility/access privileges such as USAGE on the relevant database and schema. This satisfies both requirements: centralized governance and delegated tag management.
- B. Incorrect.
Incorrect. Granting OWNERSHIP on tables would allow changing tags, but it is far broader than required and violates least-privilege administration. OWNERSHIP transfers control of the object and is not necessary just to assign or update tags.
- C. Incorrect.
Incorrect. MODIFY on a schema does not serve as the delegated privilege for applying or changing tags on objects. Tag assignment is controlled through tag-related privileges, especially APPLY TAG on the tag. Also, while tags can be associated at different object levels, the critical requirement here is delegated tag management without ownership, which MODIFY does not provide.
- D. Incorrect.
Incorrect. Masking policies and tags are different governance features. A masking policy enforces dynamic data masking logic; it does not replace metadata classification tags or allow users to maintain classification values. APPLY MASKING POLICY is unrelated to updating tag values.