ARA-C01 Question 259
Single answerData at restA financial services company is migrating highly sensitive customer data into Snowflake. Internal policy requires that data stored in Snowflake remain encrypted at rest, and the security team wants to reduce reliance on cloud-provider-managed key material by maintaining control over an additional encryption layer. The architects also want a design that does not require application changes for querying data already loaded into Snowflake tables. Which Snowflake capability best meets these requirements?
- A
Enable Tri-Secret Secure so Snowflake data at rest is protected by Snowflake-managed keys, cloud-provider-managed keys, and a customer-managed key
- B
Configure client-side encryption for all Snowflake tables so data remains encrypted in micro-partitions after loading
- C
Use Dynamic Data Masking to ensure stored table data is encrypted with customer-controlled policies at rest
- D
Create secure views on top of sensitive tables so the underlying table storage uses customer-managed encryption keys
Show answer and explanation
Correct answer: A
Explanation
Snowflake encrypts all customer data at rest by default, including table storage and staged files managed by Snowflake. For organizations with stricter key-control requirements, Tri-Secret Secure extends the standard encryption model by incorporating a customer-managed key, providing an additional layer of control for data at rest. This is the best fit when the goal is stronger governance over encryption keys without changing how users and applications query Snowflake tables. By contrast, client-side encryption is used primarily for staged files and file transfer workflows, not for changing the encryption model of persisted table data. Dynamic Data Masking and secure views are governance and access-control features, not encryption-at-rest solutions. This aligns with Snowflake documentation on data encryption, key management, and Tri-Secret Secure best practices.
- A. Correct.
Correct. Tri-Secret Secure is designed for customers who want additional control over encryption for data at rest in Snowflake. Snowflake already encrypts data at rest by default using hierarchical key management, and Tri-Secret Secure adds a customer-managed key to the protection model alongside Snowflake and cloud-provider controls. This approach addresses the requirement to reduce reliance on cloud-provider-managed key material while remaining transparent to query workloads and without requiring application changes to query existing Snowflake tables.
- B. Incorrect.
Incorrect. Client-side encryption is relevant when encrypting files before loading or unloading data, typically for stage operations. It does not change how Snowflake stores and manages encryption for table data in micro-partitions after ingestion. Also, requiring client-side encryption for all data flows would likely introduce operational and application changes, which the scenario explicitly wants to avoid.
- C. Incorrect.
Incorrect. Dynamic Data Masking protects sensitive data from unauthorized viewing at query time by masking values based on policy conditions. It is not a data-at-rest encryption mechanism and does not provide customer-managed encryption key control over Snowflake storage.
- D. Incorrect.
Incorrect. Secure views help protect data exposure by limiting access to underlying logic and preventing certain optimizations that could leak information, but they do not alter Snowflake's encryption-at-rest architecture or introduce customer-managed encryption keys for stored table data.