ADA-C01 Question 189
Select 3Implement tag-based masking policiesA financial services company wants to standardize data protection across hundreds of tables without attaching masking policies to each column individually. The SECURITYADMIN role created a tag named DATA_CLASSIFICATION and values such as PUBLIC, INTERNAL, and SENSITIVE. The requirement is that any column tagged DATA_CLASSIFICATION='SENSITIVE' should automatically be masked for most users, while analysts with the PII_ANALYST role should see the full value. The administrator also wants newly tagged columns to inherit this behavior with minimal ongoing effort. Which steps should the administrator take to implement this requirement correctly?
- A
Create a masking policy that checks the current role context, and associate that masking policy with the DATA_CLASSIFICATION tag for the SENSITIVE tag value.
- B
Apply the DATA_CLASSIFICATION='SENSITIVE' tag to the relevant columns so the associated masking policy is enforced automatically on those columns.
- C
Grant APPLY MASKING POLICY on each table to analysts so that the masking rule can evaluate whether they should see unmasked data.
- D
Attach the masking policy directly to every existing and future SENSITIVE column, because tag-based masking only documents sensitivity and does not enforce masking.
- E
Ensure the role performing the setup has the privileges required to set the tag and assign the masking policy to the tag.
Show answer and explanation
Correct answers: A, B, E
Explanation
The correct approach is to use Snowflake's tag-based masking capability to centralize policy enforcement. First, create a masking policy with conditional logic that permits cleartext access for approved roles such as PII_ANALYST and masks values for others. Then associate that masking policy with the DATA_CLASSIFICATION tag so the policy is triggered when a column is tagged as SENSITIVE. Finally, apply the SENSITIVE tag value to the relevant columns. This design is scalable because future columns only need the tag assignment to inherit the masking behavior. Administrators must also ensure they hold the necessary privileges to set tags and manage policy associations. This aligns with Snowflake best practices for centralized governance and policy-based data protection using tags and masking policies.
- A. Correct.
Correct. Tag-based masking in Snowflake is implemented by creating a masking policy and associating it with a tag, typically for a specific data type and tag value context. The masking policy logic can use role-based conditions such as CURRENT_ROLE() or IS_ROLE_IN_SESSION() so that privileged roles like PII_ANALYST can view cleartext while other roles receive masked values. This is the core mechanism that allows centralized enforcement without binding the policy to each column manually.
- B. Correct.
Correct. After associating the masking policy to the tag, the administrator must apply the tag with the appropriate value, such as SENSITIVE, to the target columns. Once the tag is applied, Snowflake enforces the associated masking policy on those columns automatically. This supports the requirement that newly tagged columns inherit the behavior with minimal operational overhead.
- C. Incorrect.
Incorrect. Analysts do not need the APPLY MASKING POLICY privilege to have the masking policy evaluate for their queries. The policy logic determines whether data is masked based on runtime conditions such as role context. Privileges like APPLY MASKING POLICY are administrative privileges used when creating or assigning policies, not for end users who are simply querying data.
- D. Incorrect.
Incorrect. This defeats the purpose of tag-based masking. In Snowflake, tags can be associated with masking policies so that policy enforcement is driven by tag assignment. While directly attaching policies to columns is possible, it is not required here and would increase maintenance, especially for future columns. This option reflects the misconception that tags are only descriptive metadata.
- E. Correct.
Correct. Tag-based masking requires appropriate administrative privileges. The implementing role must be able to set the tag on objects and manage the association between the tag and the masking policy. Without the required privileges on the tag, policy, and target objects, the configuration cannot be completed successfully.