ARA-C01 Question 50
Single answerData GovernanceA financial services company uses a single Snowflake account to store customer data for multiple business units. The security team must ensure that analysts can query a shared CUSTOMER table, but each analyst should only see rows for their own business unit. In addition, the SSN column must be fully visible only to users with a compliance role, while other authorized analysts should see a masked value. The solution must be centrally manageable and apply consistently across future tables with similar requirements. Which approach should the architect recommend?
- A
Implement a row access policy on the CUSTOMER table to filter rows by the analyst's business unit, and implement a masking policy on the SSN column that reveals full values only to the compliance role.
- B
Create separate copies of the CUSTOMER table for each business unit and grant SELECT only on the appropriate copy; use secure views instead of masking policies for SSN.
- C
Use object tags on the CUSTOMER table and SSN column to automatically enforce row-level and column-level security without additional policies.
- D
Grant the compliance role OWNERSHIP on the CUSTOMER table and grant analysts REFERENCES on the SSN column so Snowflake can enforce dynamic masking based on privileges.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a row access policy for row-level filtering and a masking policy for SSN protection. In Snowflake, row access policies are designed to restrict which rows a query returns based on execution context, commonly using functions such as CURRENT_ROLE or mappings to entitlement tables. Masking policies are designed for dynamic data masking at query time and can conditionally reveal or obfuscate sensitive column values based on role or other context. This approach is more maintainable and scalable than creating per-business-unit table copies or relying on views alone. Tags are valuable for classification and can support governance patterns, including tag-based masking in some architectures, but they do not independently provide row-level enforcement. Snowflake documentation and architecture best practices consistently position row access policies and masking policies as the primary native controls for fine-grained data governance.
- A. Correct.
Correct. A row access policy is the native Snowflake mechanism for row-level security, allowing filtering based on context such as the current role or other session/user attributes. A masking policy is the native mechanism for column-level protection and can conditionally expose cleartext only to approved roles such as a compliance role. This combination is centrally governed, reusable, and aligns with Snowflake data governance best practices. It also scales better than duplicating tables and can be extended to future objects.
- B. Incorrect.
Incorrect. Creating separate physical copies of the same table for each business unit increases storage, operational overhead, and risk of inconsistency. Secure views can help with controlled exposure, but they are not the most centralized and reusable governance mechanism for this scenario when Snowflake provides row access policies and masking policies specifically for row-level and column-level controls. This option reflects a legacy pattern rather than the preferred governance-first design.
- C. Incorrect.
Incorrect. Tags in Snowflake are metadata constructs used for classification, discovery, cost attribution, and governance workflows. By themselves, tags do not enforce row-level or column-level security. Snowflake supports tag-based masking in certain designs, but tags alone do not automatically implement row filtering and cannot replace a row access policy for business-unit-based row restrictions.
- D. Incorrect.
Incorrect. OWNERSHIP is a powerful administrative privilege that transfers control of the object and is not appropriate as a mechanism for conditional data visibility. REFERENCES is used in specific contexts such as enabling certain operations involving constraints or policies, but it does not provide dynamic data masking behavior. Snowflake enforces masking through masking policies, not through these grants.