ARA-C01 Question 54
Single answerExternal tokenizationA healthcare company stores patient records in Snowflake and must ensure that Social Security numbers (SSNs) are never exposed in clear text to Snowflake users or persisted unprotected outside the source application. The security team wants Snowflake analysts to join and filter on SSN values when necessary, but detokenization must be tightly controlled by an external service managed by the company's security platform. The architect is evaluating Snowflake external tokenization. Which approach best meets these requirements?
- A
Store SSNs in clear text in a protected column and use dynamic data masking to reveal full values only to privileged roles; this allows secure joins while avoiding an external service.
- B
Use external tokenization so the source application sends tokenized SSNs to Snowflake, configure Snowflake to call an external tokenization service only when detokenization is authorized, and perform joins on consistently generated tokens.
- C
Encrypt SSNs with Snowflake Tri-Secret Secure and allow analysts to decrypt them through secure UDFs when needed; this keeps Snowflake from ever handling the sensitive values.
- D
Use tag-based masking policies with a custom JavaScript UDF to replace SSNs with reversible values inside Snowflake, and restrict UDF usage to a small set of roles.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use external tokenization with an externally managed detokenization service and deterministic or consistently generated tokens when joinability is required. In Snowflake, external tokenization is intended for organizations that need to minimize exposure of sensitive data inside Snowflake while still enabling analytics on tokenized values. This pattern is especially relevant for regulated data such as SSNs, payment card data, or healthcare identifiers. The key architectural point is that tokenization is performed outside Snowflake or through an approved external tokenization workflow, and detokenization is controlled by the external provider rather than by native Snowflake masking or encryption features. Dynamic data masking, tag-based masking, and encryption features such as Tri-Secret Secure are valuable security capabilities, but they do not replace external tokenization when the requirement is that clear-text sensitive values remain under external control. Snowflake documentation and best practices distinguish tokenization from masking and encryption: masking controls display, encryption protects stored data, and external tokenization reduces direct exposure of sensitive values in the platform while preserving selected analytical use cases such as joins on deterministic tokens.
- A. Incorrect.
Incorrect. Dynamic data masking protects presentation of data in Snowflake, but Snowflake still stores and processes the original clear-text SSNs. That does not satisfy the requirement that SSNs never be exposed in clear text to Snowflake users or persisted unprotected outside the source application. It also does not provide externally managed detokenization control.
- B. Correct.
Correct. External tokenization is designed for scenarios where sensitive values are tokenized before or as they enter Snowflake, with detokenization controlled by an external tokenization provider. If the tokenization is deterministic or consistently generated for the same input, Snowflake can still support joins and filters on token values without exposing the underlying SSNs. This matches the requirement for strict external control over detokenization while preserving analytic usability.
- C. Incorrect.
Incorrect. Tri-Secret Secure strengthens key management for Snowflake encryption at rest, but it does not replace tokenization and does not prevent Snowflake from handling the original sensitive values once ingested. Analysts also do not decrypt data through secure UDFs as a substitute for externally governed detokenization. This option confuses encryption-at-rest controls with application-level tokenization requirements.
- D. Incorrect.
Incorrect. Masking policies and JavaScript UDFs operate inside Snowflake after the data is already stored there. They do not provide true external tokenization or externally controlled detokenization. In addition, implementing reversible transformations in a UDF is not an appropriate substitute for a dedicated tokenization system and would not meet typical compliance expectations for external control of sensitive identifiers.