ADA-C01 Question 187
Single answerImplement and manage taggingA financial services company uses Snowflake tags to classify data sensitivity across databases, schemas, tables, and columns. The security team created a tag named DATA_CLASSIFICATION and wants only a centralized governance role to assign or update tag values. Data engineers should still be able to create tables in their own schemas, but they must not be able to set or change tag values during object creation or later. Which action should the Snowflake administrator take to meet this requirement with the least ongoing administration?
- A
Grant APPLY TAG ON ACCOUNT to the centralized governance role only, and do not grant APPLY TAG on the tag or account to the data engineer roles.
- B
Grant OWNERSHIP on the DATA_CLASSIFICATION tag to all data engineer roles so they can create tagged objects, but restrict future tag updates through schema privileges.
- C
Grant USAGE on the DATA_CLASSIFICATION tag to the data engineer roles, because USAGE allows object creation but prevents changing tag values.
- D
Create a masking policy that references the DATA_CLASSIFICATION tag, and rely on the masking policy to prevent data engineers from setting tag values.
Show answer and explanation
Correct answer: A
Explanation
The key requirement is separation of duties: data engineers need to create objects, but only a governance team should classify them with tags. In Snowflake, assigning a tag requires the APPLY TAG privilege, granted either on a specific tag or at the account level. Therefore, the correct design is to grant object creation privileges to engineers as needed, while restricting APPLY TAG to the centralized governance role. This minimizes administrative overhead because you do not need custom controls per schema or object owner; you simply control tag assignment through Snowflake privileges. Snowflake documentation on tag administration and access control explains that APPLY TAG is required to set tags on supported objects, while OWNERSHIP is administrative control over the tag object itself and USAGE alone is insufficient for tag application. This pattern aligns with least-privilege and centralized data governance best practices.
- A. Correct.
Correct. In Snowflake, setting a tag on an object requires the APPLY TAG privilege, which can be granted at the account level or on a specific tag. If only the centralized governance role has APPLY TAG and the engineers do not, engineers can still create tables if they have the normal schema/object creation privileges, but they cannot assign or modify tag values either during CREATE/ALTER statements or afterward. This is the cleanest governance model because it centralizes tag assignment without taking away object creation privileges.
- B. Incorrect.
Incorrect. Granting OWNERSHIP on a tag gives broad control over the tag itself, including managing grants, which is far more privilege than required and directly conflicts with the requirement that only a centralized governance role manage tag values. Also, schema privileges do not override the ability of a role with sufficient tag privileges to set tag values.
- C. Incorrect.
Incorrect. USAGE on a tag is not the privilege that authorizes assigning a tag to an object. Snowflake requires APPLY TAG to set a tag. This option reflects a common misconception that USAGE on governance objects is sufficient for applying them.
- D. Incorrect.
Incorrect. Masking policies and tags are related but distinct governance features. A masking policy can reference a tag or be associated through tag-based masking, but it does not control who is allowed to assign tag values. Preventing engineers from setting tags is a privilege-management task, not something enforced by creating a masking policy alone.