ARA-C01 Question 74
Single answerPayment Card Industry (PCI) Security StandardA retail company processes payment card transactions and wants to centralize analytics in Snowflake. The security team requires that any environment storing, processing, or transmitting cardholder data remain within a PCI DSS-compliant scope. An architect proposes loading raw transaction files that include full PAN values into a dedicated Snowflake account and then exposing only tokenized or masked data to downstream analytics teams. Which approach best aligns with Snowflake best practices for handling PCI-related workloads while minimizing PCI scope for most users?
- A
Load full PAN data into a dedicated Snowflake environment designed for PCI workloads, restrict access using least privilege and role-based controls, and provide downstream consumers only masked or tokenized datasets through controlled sharing or derived tables.
- B
Load full PAN data into the main enterprise Snowflake account, then rely on warehouse suspension policies to reduce the PCI scope because compute is not running when users are idle.
- C
Store full PAN data in Snowflake for all analytics users, but mark the columns as sensitive in documentation so developers know not to query them unless necessary.
- D
Export PAN data from Snowflake into internal BI extracts and spreadsheets so analysts can perform card investigations outside Snowflake without requiring direct database access.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to isolate payment card data in a dedicated Snowflake environment intended for PCI-related workloads and expose only masked or tokenized data to broader analytics consumers. This aligns with core PCI DSS principles such as restricting access to cardholder data by business need to know, minimizing storage and exposure of sensitive data, and reducing the number of systems and users in scope. In Snowflake, architects should combine account-level and object-level controls: strong RBAC, network policies, MFA, auditing through access history and query history, and masking or tokenization strategies before broader consumption. Snowflake supports PCI DSS-compliant deployments, but using Snowflake in a compliant manner remains a customer architectural responsibility under the shared responsibility model. Best practice is not merely to store CHD securely, but to minimize where full PAN exists and who can access it. This is consistent with both PCI DSS scoping guidance and Snowflake security best practices for sensitive regulated data.
- A. Correct.
Correct. This is the strongest architectural approach for PCI-sensitive data in Snowflake. Isolating cardholder data in a dedicated environment helps reduce the number of users, roles, objects, and processes in PCI scope. Applying least privilege, tight RBAC, and exposing only masked or tokenized derivatives to downstream consumers is consistent with minimizing access to CHD and limiting compliance scope. In practice, architects commonly pair this with strong network policies, MFA, auditing, encryption defaults, and dynamic data protection features where appropriate.
- B. Incorrect.
Incorrect. Suspending warehouses saves compute cost but does not reduce PCI DSS scope. PCI scope is driven by systems that store, process, or transmit cardholder data, not by whether compute is currently active. Placing raw PAN in the main enterprise account broadens exposure and generally increases the compliance boundary rather than minimizing it.
- C. Incorrect.
Incorrect. Documentation labels alone are not a security control and do not satisfy PCI expectations for restricting access to cardholder data. If all analytics users can access full PAN, the environment and those users are effectively in scope. This option reflects a common misconception that policy-by-documentation is sufficient without technical enforcement.
- D. Incorrect.
Incorrect. Exporting PAN into BI extracts or spreadsheets usually expands risk and compliance scope because it creates additional copies of cardholder data outside governed controls. PCI programs generally aim to reduce proliferation of CHD, maintain strong access control, and centralize monitoring and auditing rather than distribute sensitive data into unmanaged endpoints or files.