ARA-C01 Question 70
Single answerComplianceA global financial services company stores customer data in Snowflake and must satisfy a compliance requirement that personally identifiable information (PII) be protected from most analysts, while a small group of compliance investigators can view unmasked values when needed. The company also needs to ensure that access decisions are enforced consistently across all BI tools and SQL clients without rewriting each reporting query. Which solution best meets these requirements with the least operational overhead?
- A
Create dynamic data masking policies on PII columns and grant an authorized role to compliance investigators that is allowed to see unmasked values.
- B
Encrypt the PII columns in the source files before loading them into Snowflake, and give compliance investigators the decryption key outside Snowflake.
- C
Create secure views for every reporting use case and expose masked expressions in each view, while investigators query the base tables directly.
- D
Use client-side query filters in each BI tool to hide PII columns from most analysts, and provide a separate dashboard for investigators.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake dynamic data masking policies. For compliance-driven protection of PII, Snowflake best practice is to enforce controls as close to the data as possible, using policy-based governance rather than relying on application logic or duplicated SQL patterns. Dynamic masking policies provide centralized, role-aware masking at query time and are applied consistently regardless of whether users connect through Snowsight, JDBC/ODBC, or BI platforms. This directly addresses the requirement that most analysts see masked data while a limited set of compliance investigators can view cleartext values.
Other options are plausible but less appropriate. External encryption shifts complexity to application and key management layers and reduces analytical usability. Secure views can be part of a governance design, but using them as the primary masking mechanism for every reporting path is typically higher overhead and easier to bypass if base-table access is not tightly controlled. Client-side hiding is not sufficient for regulated environments because it is not a data-layer control.
Relevant Snowflake documentation and best practices include Dynamic Data Masking, Access Control and RBAC, and Sensitive Data Governance features. In architect scenarios, policy-based controls are generally preferred when the requirement is centralized, auditable, and tool-independent enforcement.
- A. Correct.
Correct. Dynamic data masking policies are designed for column-level protection of sensitive data such as PII. They allow Snowflake to evaluate the active role or context at query time and return either masked or unmasked values accordingly. This approach centralizes enforcement in Snowflake, so the policy applies consistently across SQL clients, worksheets, and BI tools without requiring each query or dashboard to be rewritten. Granting a privileged role to compliance investigators is a common pattern for controlled exceptions.
- B. Incorrect.
Incorrect. External encryption before loading can protect data at rest or in transit, but it does not provide Snowflake-native, role-based selective reveal of values during query execution. If the data remains encrypted in tables, most analytics use cases become difficult, and key management outside Snowflake increases operational complexity. This does not meet the requirement for transparent, consistent enforcement across tools with low overhead.
- C. Incorrect.
Incorrect. Secure views can help restrict exposure and protect query logic, but creating and maintaining separate views for every reporting use case introduces significant administrative overhead. It also relies on users consistently querying the correct views rather than the underlying tables. Compared with masking policies, this is less centralized and less scalable for broad compliance enforcement.
- D. Incorrect.
Incorrect. Client-side filtering in BI tools is not a strong compliance control because it depends on individual tool configuration and does not protect direct SQL access from other clients. It creates inconsistent enforcement and governance gaps. Compliance controls for sensitive data should be enforced centrally in Snowflake rather than delegated to presentation-layer tools.