ARA-C01 Question 55
Single answerDynamic Data MaskingA healthcare company stores member data in a Snowflake table named PATIENTS, including a column SSN. Data engineers, analysts, and compliance auditors all query the same table. The company must meet these requirements: analysts should see only masked SSN values, compliance auditors should see full SSN values, and existing analyst queries should continue to work without being rewritten. The architect wants the solution to be centralized and enforced directly in Snowflake. Which approach best meets these requirements?
- A
Create a dynamic data masking policy on the SSN column that returns the full value when the current role is an authorized auditor role, and a masked value for all other roles.
- B
Create a secure view over PATIENTS that omits the SSN column for analysts, and grant auditors access directly to the base table.
- C
Encrypt the SSN column with client-side encryption keys and distribute the decryption keys only to auditor users.
- D
Use row access policies to hide rows containing SSN values from analysts while allowing auditors to see all rows.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to apply a masking policy to the sensitive column. In Snowflake, dynamic data masking provides centralized, column-level protection by evaluating policy logic at query time. A common pattern is to use role-aware expressions, such as checking whether the current role or an authorized role is active, to determine whether to return the original value or a masked substitute. This approach preserves existing table structures and query patterns because users still query the same table and column, but Snowflake returns different results based on policy evaluation. Secure views can sometimes help with data protection, but they are less centralized for this requirement and often require consumers to switch objects. Row access policies govern row visibility rather than column masking. Snowflake documentation and best practices for sensitive data protection distinguish these controls clearly: masking policies are for protecting column values, while row access policies are for restricting row-level visibility.
- A. Correct.
Correct. Dynamic data masking is designed to protect sensitive column values at query time based on the querying context, such as the active role. Applying a masking policy directly to the SSN column centralizes enforcement in Snowflake and allows existing queries to continue working because the column remains available with the same name and type semantics expected by consumers. Auditors can be exempted through role-based logic in the policy, while analysts receive a masked representation.
- B. Incorrect.
Incorrect. A secure view can restrict what analysts see, but it does not meet the requirement as cleanly because it introduces a separate object and may require changing downstream access patterns, grants, or queries to use the view instead of the base table. It also creates parallel access paths that are harder to govern consistently compared with a masking policy directly attached to the column.
- C. Incorrect.
Incorrect. Client-side encryption protects data confidentiality, but it does not provide Snowflake-native, role-aware conditional display of values at query time. It also complicates application design and key management and would likely require query or application changes, which conflicts with the requirement to preserve existing analyst queries.
- D. Incorrect.
Incorrect. Row access policies control which rows are visible, not how individual column values are displayed. In this scenario, analysts still need access to the rows but should see masked SSN values. Hiding rows would solve a different problem and would not satisfy the requirement.