ADA-C01 Question 188
Single answerImplement tag-based masking policiesA financial services company classifies sensitive columns by attaching a tag named DATA_CLASSIFICATION to columns in multiple schemas. The Snowflake administrator needs a solution that automatically masks any column tagged with the value 'PII' so that analysts see partially redacted values, while members of a custom role named PII_FULL_ACCESS can see the full value. The company also wants the masking behavior to apply consistently as new tagged columns are added without manually assigning a masking policy to each column. Which approach should the administrator use?
- A
Create a masking policy that checks CURRENT_ROLE() for PII_FULL_ACCESS, then associate that masking policy with the DATA_CLASSIFICATION tag for the STRING data type and tag value 'PII'.
- B
Create a row access policy that checks whether the querying role is PII_FULL_ACCESS, then attach the row access policy to the DATA_CLASSIFICATION tag so it applies to tagged columns automatically.
- C
Create a masking policy on each existing PII column individually and grant APPLY MASKING POLICY on future schemas so new tagged columns inherit the policy automatically.
- D
Create a projection policy for STRING columns and bind it to the DATA_CLASSIFICATION tag so that only users with PII_FULL_ACCESS can see unmasked values.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to implement tag-based masking by creating a masking policy and associating it with a tag such as DATA_CLASSIFICATION for the relevant data type. When a column is tagged with the matching tag value, Snowflake can automatically enforce the associated masking policy, reducing manual administration and improving consistency across schemas and future objects. The masking policy should contain conditional logic that allows members of the authorized role, such as PII_FULL_ACCESS, to see the cleartext value while returning a masked or partially redacted value for other roles. This aligns with Snowflake best practices for scalable data governance: use tags to classify data and tag-based masking to enforce protections consistently. Row access policies are for row filtering, not masking; manually assigning masking policies to each column does not meet the automatic-governance requirement; and projection policies are not the correct control for this scenario. Relevant Snowflake documentation includes sections on Dynamic Data Masking, Tag-based Masking Policies, and using tags for data governance.
- A. Correct.
Correct. Tag-based masking is designed for this exact use case: centrally define a masking policy and associate it with a tag so that columns with that tag are protected automatically. The masking policy can evaluate the active role context, such as CURRENT_ROLE() or similar role checks, to return full values for authorized roles and masked values for others. By associating the masking policy with the tag for the appropriate data type, newly tagged columns can inherit the masking behavior without needing direct policy assignment per column.
- B. Incorrect.
Incorrect. Row access policies filter rows, not column values. They are used to determine which rows a user can see in a table or view. They do not provide dynamic masking of column contents and are not the mechanism for tag-based masking on sensitive columns.
- C. Incorrect.
Incorrect. Directly assigning masking policies column by column can work, but it does not satisfy the requirement to have masking apply automatically based on tagging. Also, granting privileges on future schemas does not cause a masking policy to be inherited by newly tagged columns. Tag-based masking is specifically intended to avoid this manual maintenance.
- D. Incorrect.
Incorrect. Projection policies are not the feature used to mask sensitive data values based on role access. The relevant feature is masking policies, including conditional masking logic, combined with tag-to-policy association for automatic enforcement on tagged columns.