ARA-C01 Question 56
Single answerDynamic Data MaskingA healthcare company stores patient data in a shared Snowflake table named PATIENTS. The table contains a column SSN that must be fully visible to users with the PII_ADMIN role, partially masked for users with the SUPPORT_ANALYST role, and fully masked for all other roles. The company also wants the masking behavior to remain consistent if the table is exposed through secure views or queried by BI tools. Which solution best meets these requirements with the least ongoing administrative effort?
- A
Create a dynamic data masking policy on PATIENTS.SSN that uses CURRENT_ROLE() in a CASE expression to return the full value for PII_ADMIN, a partially masked value for SUPPORT_ANALYST, and a fully masked value for all other roles; then attach the policy directly to the SSN column.
- B
Create separate secure views for each user group and grant each role access only to its view, implementing masking logic in the SELECT list of each view.
- C
Use row access policies to determine which users can see SSN values and return different masked formats based on role membership.
- D
Encrypt the SSN column with client-side encryption and rely on key distribution so only PII_ADMIN can decrypt the values, while SUPPORT_ANALYST sees partially decrypted data.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a dynamic data masking policy attached directly to the sensitive column. Snowflake masking policies are intended for column-level data protection and can use conditional SQL logic with context functions such as CURRENT_ROLE() to determine what value to return. This makes them well suited for scenarios where one role needs cleartext, another needs partially masked output, and everyone else should see a fully masked value. Applying the policy to the base column provides centralized governance and reduces the need to replicate logic in multiple secure views or applications. Row access policies solve a different problem: filtering rows rather than transforming column values. Encryption is also not a substitute for query-time masking. Snowflake documentation and best practices distinguish these governance controls clearly: masking policies for column obfuscation, row access policies for row filtering, and secure views for controlled presentation rather than primary masking enforcement.
- A. Correct.
Correct. Dynamic data masking is designed for column-level protection and can evaluate context such as CURRENT_ROLE() to return different representations of the same column value. Attaching the masking policy directly to PATIENTS.SSN centralizes enforcement so the masking remains in effect when the column is queried directly, through views, and by downstream tools, assuming the querying role context is preserved. This approach minimizes administrative overhead compared with maintaining multiple views.
- B. Incorrect.
Incorrect. Secure views can hide implementation details and can be part of a governance strategy, but using separate views for each audience duplicates logic and increases maintenance. It also does not provide the most centralized or scalable design when Snowflake masking policies are purpose-built for consistent column-level masking across direct table access and views.
- C. Incorrect.
Incorrect. Row access policies control which rows are visible, not how individual column values are transformed for different roles. A common misconception is that row access policies can be used as a substitute for masking policies. In Snowflake, masking policies are the correct feature for column-level obfuscation based on role or other context.
- D. Incorrect.
Incorrect. Encryption at rest or client-side encryption protects data storage and transmission, but it does not provide native role-based partial masking behavior inside query results. Also, partial decryption for one role and full decryption for another is not how Snowflake dynamic masking requirements are typically implemented. This option adds operational complexity and does not meet the stated need as directly as a masking policy.