ADA-C01 Question 194
Single answerConfiguring and monitor tagsA Snowflake administrator is implementing governance controls for sensitive data. The security team has created a tag named DATA_CLASSIFICATION and wants it applied automatically to newly created columns that contain names matching patterns such as EMAIL or SSN. The administrator also needs to verify which objects currently have this tag assigned across databases. Which action best satisfies both requirements with the least ongoing manual effort?
- A
Create a masking policy on all schemas, then query ACCOUNT_USAGE.POLICY_REFERENCES to find tagged columns.
- B
Configure automatic sensitive data classification and set a tag mapping so classified columns are automatically assigned the DATA_CLASSIFICATION tag; then query tag references to monitor assignments.
- C
Grant APPLY TAG ON ACCOUNT to all developers so they can tag columns during table creation, then use SHOW COLUMNS to review tag values.
- D
Create an object parameter that defaults DATA_CLASSIFICATION on all new tables, then query INFORMATION_SCHEMA.COLUMNS to identify inherited tags.
Show answer and explanation
Correct answer: B
Explanation
The best solution is to use Snowflake's sensitive data classification capabilities together with tag mapping so tags can be assigned automatically to columns identified as containing sensitive data, such as email addresses or SSNs. This is preferable to relying on developers to tag objects manually. For monitoring, Snowflake provides metadata for tag associations, commonly through account usage views and tag reference metadata, which administrators can use to audit where tags are applied. This aligns with Snowflake governance best practices: automate classification/tagging where possible, centralize privileges, and use metadata views for ongoing monitoring rather than manual inspection.
- A. Incorrect.
Incorrect. Masking policies and tags are related but different governance controls. A masking policy does not automatically assign a tag to columns based on detected sensitivity. Also, POLICY_REFERENCES is used to inspect policy associations, not to comprehensively monitor tag assignments across objects.
- B. Correct.
Correct. Snowflake supports automatic sensitive data classification and tag mapping so detected sensitive columns can be automatically tagged based on classification results. To monitor tag usage, administrators can query metadata views/functions for tag references, such as ACCOUNT_USAGE.TAG_REFERENCES or related tag reference metadata. This approach minimizes manual effort while meeting both the automation and monitoring requirements.
- C. Incorrect.
Incorrect. Granting broad APPLY TAG privileges to developers increases operational overhead and governance risk, and it does not provide automatic tagging based on detected sensitive data patterns. SHOW COLUMNS is also not the best account-wide monitoring method for tracking tag assignments across databases and object types.
- D. Incorrect.
Incorrect. There is no general object parameter that automatically defaults a custom tag value onto all new tables or columns in this manner. In addition, INFORMATION_SCHEMA.COLUMNS is not intended to provide complete account-wide visibility into tag assignments, especially inherited or object-level tag relationships.