ARA-C01 Question 80
Single answerEncryptionA financial services company is migrating highly sensitive customer data to Snowflake. Its security policy requires the company to control and rotate the root encryption keys used to protect data at rest, while minimizing application changes and preserving Snowflake-managed performance and functionality. The architecture team is evaluating options for meeting this requirement in Snowflake. Which approach should the architect recommend?
- A
Enable Tri-Secret Secure so Snowflake encryption keys are combined with a customer-managed key from the organization's cloud key management service.
- B
Use client-side encryption for all tables so Snowflake does not manage any encryption keys for stored data.
- C
Configure end-to-end encryption by storing all data in external stages only and querying it in place without loading it into Snowflake-managed storage.
- D
Rely on Snowflake's default encryption at rest because Snowflake automatically rotates all customer-controlled master keys on the customer's behalf.
Show answer and explanation
Correct answer: A
Explanation
For this scenario, the best answer is Tri-Secret Secure. Snowflake encrypts data at rest by default using a hierarchical key model and strong encryption, but some regulated organizations require direct control over a key component in the encryption chain. Tri-Secret Secure addresses this by incorporating a customer-managed key from the cloud provider's key management service along with Snowflake-managed keys. This lets the customer manage and rotate their own key while continuing to use Snowflake normally.
The other options are common misconceptions. Client-side encryption is relevant for files before or during staging, not for replacing Snowflake's internal table storage encryption. Keeping data only in external stages is a storage design choice, not a substitute for Snowflake-native encrypted storage with customer key control. Finally, default Snowflake encryption is strong and automatic, but it does not by itself satisfy requirements for customer-controlled root key material.
Relevant Snowflake documentation and best practices include Snowflake security documentation on encryption at rest, key hierarchy, and Tri-Secret Secure, which explains how customer-managed keys integrate with Snowflake's encryption model for enhanced control in regulated environments.
- A. Correct.
Correct. Tri-Secret Secure is designed for organizations that need additional control over encryption for data at rest in Snowflake. It combines Snowflake-managed keys with a customer-managed key maintained in the cloud provider's key management service, giving the customer control over a critical part of the key hierarchy while retaining native Snowflake functionality and operational model. This aligns with the requirement to control and rotate root key material with minimal application change.
- B. Incorrect.
Incorrect. Client-side encryption can be used for staged files before they are loaded, but it is not the mechanism for controlling Snowflake's internal encryption of data stored in Snowflake tables. Once data is loaded into Snowflake-managed storage, Snowflake still uses its own encryption architecture. Choosing this option reflects the misconception that client-side encryption replaces Snowflake's at-rest encryption model for table data.
- C. Incorrect.
Incorrect. External stages can be used for storing and accessing files outside Snowflake-managed storage, but this does not satisfy the requirement for Snowflake-resident protected data with customer control of root encryption keys. It also changes the architecture significantly and may not preserve expected Snowflake performance, governance, and feature behavior for managed table storage. This option confuses storage location choices with Snowflake's encryption key control capabilities.
- D. Incorrect.
Incorrect. Snowflake does encrypt data at rest by default and manages key rotation within its encryption framework, but default encryption does not provide customer control over the root key material. The statement that Snowflake rotates all customer-controlled master keys on the customer's behalf is inaccurate because customer-managed control is specifically addressed through features such as Tri-Secret Secure.