ADA-C01 Question 193
Single answerManage data governance through SnowsightA Snowflake administrator is using Snowsight to help a data governance team classify sensitive columns and apply access controls across several production tables. The team wants to use built-in governance capabilities available from Snowsight so they can centrally discover tagged columns, review classifications, and enforce different visibility rules for analysts and finance users. Which action should the administrator take in Snowsight to meet this requirement with the least operational overhead?
- A
Use Snowsight Governance features to apply tags to sensitive columns, then attach masking policies to those columns based on role context so authorized users see unmasked values while others see masked results.
- B
Create separate physical copies of each production table for each user group in Snowsight, and hide sensitive columns from non-finance users by granting SELECT only on the copied tables.
- C
Use Snowsight to create row access policies on the sensitive columns so the column values are hidden for analysts but visible for finance users.
- D
Use Snowsight to classify columns, then rely on object comments and schema-level privileges to prevent non-finance users from viewing sensitive values.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowsight governance capabilities to identify sensitive data with tags/classification and then enforce access with masking policies. In Snowflake, dynamic data masking is the native feature for protecting sensitive column values while still allowing broad table access. Snowsight supports governance-focused administration, including visibility into tags and classified data, which helps administrators and stewards manage sensitive data centrally. Row access policies are for row filtering, not column masking. Duplicating tables for each audience is operationally expensive and contrary to Snowflake best practices for centralized governance. Relevant Snowflake documentation areas include Data Governance in Snowsight, Tags, Data Classification, and Dynamic Data Masking.
- A. Correct.
Correct. In Snowflake, Snowsight provides governance workflows for discovering and managing governed data, including tags and data classification visibility. To enforce different visibility rules at the column level, masking policies are the appropriate control. This approach aligns with best practice because it avoids duplicating data and enables centralized governance. Tags help identify and organize sensitive fields, while masking policies enforce who can see actual values based on role or other context.
- B. Incorrect.
Incorrect. Creating separate physical copies of production tables for each audience increases storage, maintenance, and governance complexity. It is not the recommended low-overhead governance pattern in Snowflake when dynamic data masking can enforce column-level visibility on shared tables. This distractor reflects a legacy data-management approach rather than Snowflake-native governance.
- C. Incorrect.
Incorrect. Row access policies control which rows a user can see, not whether specific column values are masked. They are useful for filtering records by user or role, but they do not solve column-level redaction requirements. This option represents a common confusion between row-level and column-level governance controls.
- D. Incorrect.
Incorrect. Classification and comments in Snowsight can help document sensitive data, but comments and schema-level privileges alone do not selectively hide values within a column for different users who can access the table. Privileges can allow or deny access to objects, but they do not provide dynamic per-column masking behavior.