ARA-C01 Question 73
Single answerPayment Card Industry (PCI) Security StandardA retail company processes card payments and wants to load daily payment transaction files into Snowflake for analytics. The files contain full PAN values and other cardholder data. The company's compliance team requires that the Snowflake environment used for this workload be eligible for PCI DSS workloads and that access to raw cardholder data be tightly controlled. Which approach should the Snowflake architect recommend?
- A
Use a Snowflake account on Business Critical Edition, restrict access to cardholder data with role-based access controls and masking/tokenization where appropriate, and coordinate with Snowflake and the organization's QSA on PCI DSS scope and responsibilities.
- B
Use any Snowflake edition, because PCI DSS compliance depends only on encrypting data at rest and Snowflake encrypts all customer data by default.
- C
Use Standard Edition and enable Tri-Secret Secure, because customer-managed key control alone makes the account suitable for storing unmasked PAN data for PCI DSS workloads.
- D
Store the raw PAN data in an external stage only and query it through Snowflake external tables, because data outside Snowflake storage is automatically out of PCI DSS scope for Snowflake.
- E
Load the data into Snowflake and rely only on network policies to satisfy PCI DSS requirements, since restricting source IP addresses is the primary control for cardholder data protection.
Show answer and explanation
Correct answer: A
Explanation
The best recommendation is to use Snowflake Business Critical Edition for workloads that must align with stricter security and compliance expectations, including PCI-related workloads, and then implement layered controls such as least-privilege RBAC, masking or tokenization, and formal compliance validation with the organization's security/compliance team and QSA. Snowflake security and compliance documentation emphasizes that certifications and attestations support customer compliance efforts but do not automatically make every implementation compliant. In practice, architects should minimize storage of full PAN whenever possible, prefer tokenization upstream if feasible, tightly restrict access to sensitive columns, and validate shared-responsibility boundaries. Relevant Snowflake documentation includes the editions/features documentation, security best practices, data protection features such as dynamic data masking, and Snowflake compliance documentation describing PCI DSS support under appropriate account configurations.
- A. Correct.
Correct. For PCI-sensitive workloads, Snowflake Business Critical Edition is the relevant edition for regulated workloads that may require PCI DSS alignment. However, edition selection alone is not sufficient. The architect should also apply least-privilege access using roles, use masking or tokenization where appropriate to reduce exposure of PAN data, and work with Snowflake documentation plus the organization's Qualified Security Assessor (QSA) to confirm shared-responsibility boundaries and whether the intended implementation meets PCI DSS obligations. This reflects both platform capability and compliance process requirements.
- B. Incorrect.
Incorrect. Snowflake does encrypt data at rest and in transit, but PCI DSS eligibility is not determined solely by encryption. The Snowflake edition and deployed controls matter, and PCI DSS is a shared-responsibility model that includes customer-side governance, access control, monitoring, and data handling processes. Assuming any edition is acceptable is a common but incorrect oversimplification.
- C. Incorrect.
Incorrect. Tri-Secret Secure is available only with Business Critical Edition and is an optional key-management feature, not a substitute for the broader set of PCI DSS requirements. Customer-managed key involvement does not by itself make an environment suitable for storing raw PAN data. This option combines a factual error about edition availability with a misunderstanding of compliance scope.
- D. Incorrect.
Incorrect. Keeping files in an external stage or exposing them through external tables does not automatically remove the workload from PCI DSS scope. If Snowflake users can access cardholder data through Snowflake-managed metadata, query interfaces, integrations, or governed access paths, the architecture still needs to be assessed for PCI DSS implications. Externalizing storage is not a compliance shortcut.
- E. Incorrect.
Incorrect. Network policies are useful for reducing attack surface by restricting allowed client IP addresses, but they are only one control. PCI DSS requires a much broader control set, including data protection, identity and access management, monitoring, and operational processes. Relying only on network policies would be insufficient for protecting raw PAN data.