ADA-C01 Question 195
Single answerConfiguring and monitor tagsA Snowflake administrator is implementing data governance for a finance domain. The requirement is to classify sensitive columns with a custom tag named SENSITIVITY, automatically assign a masking policy when the tag value is HIGH, and allow auditors to review where the tag is currently applied across the account. Which approach best meets these requirements with the least ongoing administrative effort?
- A
Create the SENSITIVITY tag, set the tag value HIGH on applicable columns, associate the tag with the masking policy, and use ACCOUNT_USAGE.TAG_REFERENCES to review tagged objects.
- B
Create the SENSITIVITY tag and a row access policy, set the tag value HIGH on applicable columns, and use INFORMATION_SCHEMA.COLUMNS to review where the tag is applied.
- C
Create the SENSITIVITY tag, attach a masking policy directly to the tag object, and use SHOW TAGS to review all columns that inherited the tag.
- D
Create the SENSITIVITY tag, set the tag value HIGH on databases and schemas only, rely on automatic propagation to all existing columns, and use ACCOUNT_USAGE.POLICY_REFERENCES to review tag assignments.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a custom tag for classification, apply appropriate tag values such as HIGH to sensitive columns, associate the tag with a masking policy for centralized tag-based masking, and monitor usage through Snowflake metadata views designed for tag auditing. This approach aligns with Snowflake governance best practices by separating classification (tags) from enforcement (masking policies) while minimizing repetitive manual policy assignments. For monitoring, ACCOUNT_USAGE.TAG_REFERENCES is the key view for identifying where tags are applied. Candidates should distinguish between tags, masking policies, and row access policies, and also know that SHOW commands and generic INFORMATION_SCHEMA views are not substitutes for account-level tag reference monitoring. Relevant Snowflake documentation includes guidance on object tagging, tag-based masking, and Account Usage views such as TAG_REFERENCES.
- A. Correct.
Correct. In Snowflake, administrators can create custom tags and set tag values on supported objects such as columns. A masking policy can be associated with a tag so that columns carrying a qualifying tag value can automatically receive the masking policy, reducing manual policy attachment effort. For monitoring and auditing tag usage across the account, ACCOUNT_USAGE.TAG_REFERENCES is the appropriate source because it exposes where tags are associated with objects and columns.
- B. Incorrect.
Incorrect. A row access policy governs row-level visibility, not column masking based on sensitive classifications. The requirement is to mask sensitive column data, so a masking policy is the correct policy type. Also, INFORMATION_SCHEMA.COLUMNS provides column metadata but is not the primary account-wide source for tracking tag references and does not serve as a complete tag-audit mechanism in the same way as tag reference views.
- C. Incorrect.
Incorrect. Snowflake does support tag-based masking, but you do not attach a masking policy directly to the tag object in the simplistic sense implied here. The implementation relies on associating a masking policy with a tag and using tag values appropriately, not merely 'attaching' a policy to a tag without configuration details. In addition, SHOW TAGS lists tag definitions, not all object-level or column-level applications of those tags. It is not sufficient for auditing where a tag is applied.
- D. Incorrect.
Incorrect. Setting a tag only at the database or schema level does not mean all existing columns will automatically receive that tag as if it were fully propagated for governance enforcement in every case. Tag propagation behavior depends on explicit configuration and supported lineage/assignment behavior, and this option overstates what happens automatically. POLICY_REFERENCES is used to inspect where policies are referenced, not to review account-wide tag assignments.