ADA-C01 Question 534
Select 2Policies (masking and row access) and tagsA Snowflake administrator is implementing data governance for a CUSTOMER table used by analysts in multiple regions. The table contains columns CUSTOMER_ID, EMAIL, PHONE, COUNTRY, and REGION_CODE. Requirements are: (1) analysts should only see rows for their own region, based on their active role; (2) EMAIL and PHONE must be masked for most analyst roles, but visible to a small group of compliance roles; and (3) the company wants a scalable way to identify sensitive columns so policies can be applied consistently across many tables in the future. Which combination of actions best meets these requirements with the least ongoing administrative effort?
- A
Create a row access policy on the CUSTOMER table that evaluates CURRENT_ROLE() against an authorized role-to-region mapping, create a masking policy for EMAIL and PHONE that reveals values only for approved compliance roles, and use a tag such as SENSITIVITY='PII' on sensitive columns to standardize governance.
- B
Create a secure view per region and grant each analyst role access only to its regional view, then manually revoke SELECT on EMAIL and PHONE from analyst roles while granting direct access to compliance roles; tags are optional because they do not help with governance at scale.
- C
Apply a row access policy directly to the REGION_CODE column so Snowflake filters rows before table access, and attach a tag-based masking policy to the CUSTOMER table so all columns in the table inherit the same masking behavior automatically.
- D
Use a row access policy on the CUSTOMER table to filter rows by role and region, assign a tag to EMAIL and PHONE, and associate a masking policy with that tag so tagged columns can be protected consistently across tables.
- E
Rely on object tags alone to identify PII columns and query TAG_REFERENCES at runtime to suppress restricted rows and mask EMAIL and PHONE dynamically without creating row access or masking policies.
Show answer and explanation
Correct answers: A, D
Explanation
The best answer is the combination of Snowflake policy-based governance features designed for these distinct control points: row access policies for row-level filtering, masking policies for column-level redaction, and tags for scalable classification and policy administration. In practice, a row access policy is attached to a table or view and can evaluate context functions such as CURRENT_ROLE() along with lookup data to determine whether a row should be visible. A masking policy is attached to a column, or applied through tag-based masking, to determine whether to reveal or mask a value based on role or other session context. Tags are not enforcement controls by themselves, but they are a best practice for classifying sensitive data and can be used with tag-based masking so the same masking logic can be applied consistently across many columns and objects. This approach minimizes operational overhead compared with maintaining many secure views or manual grants. Snowflake documentation on row access policies, dynamic data masking, and tag-based masking supports these patterns as the standard governance model.
- A. Correct.
Correct. A row access policy is the appropriate feature for filtering which rows are visible based on context such as the current role, often using a mapping table or lookup logic. A masking policy is the correct feature for conditional redaction of column values such as EMAIL and PHONE based on role. Using tags like SENSITIVITY='PII' is a scalable governance practice because it classifies sensitive columns consistently and supports broader administrative visibility and automation. This option satisfies all three requirements directly using Snowflake governance features.
- B. Incorrect.
Incorrect. Secure views can enforce row filtering, but creating one view per region does not scale well and increases maintenance overhead compared with a single row access policy. Also, revoking SELECT on specific columns is not how Snowflake implements conditional masking for some roles while allowing others to see unmasked values. Tags do help at scale for data classification, discovery, and when used with tag-based masking, so dismissing them is a misconception.
- C. Incorrect.
Incorrect. Row access policies are applied to tables or views and reference one or more columns in their signature; they are not applied directly to a single column in the same way masking policies are. Also, tag-based masking policies are associated with tags on columns, not with a table in a way that causes all table columns to inherit identical masking behavior automatically. This reflects a misunderstanding of both row access policy scope and tag-based masking behavior.
- D. Correct.
Correct. This is the most scalable Snowflake-native approach. A row access policy on the table can restrict visible rows by evaluating the active role and region. Tagging EMAIL and PHONE identifies them as sensitive, and associating a masking policy with that tag enables consistent protection wherever the tag is applied across schemas and tables. This reduces future administrative effort because new PII columns can inherit the masking behavior by applying the tag rather than manually attaching policies column by column.
- E. Incorrect.
Incorrect. Tags by themselves are metadata and do not enforce security controls. Querying tag metadata at runtime does not replace row access policies or masking policies for governed data access. Snowflake enforces row-level filtering with row access policies and column-level redaction with masking policies. This option confuses data classification metadata with policy enforcement mechanisms.