DAA-C01 Question 236
Single answerUnderstand the effects of row access policies and Dynamic Data MaskingA healthcare analytics team stores patient encounter data in a Snowflake table named PATIENT_VISITS. The table includes REGION, DIAGNOSIS_CODE, and SSN columns. To support multiple business units, the security team applies a row access policy to REGION so users only see rows for their assigned region, and a masking policy to SSN so only users with a privileged role can view the full value. An analyst with a non-privileged role runs a query against PATIENT_VISITS and notices that some rows are not returned at all, while the SSN values in returned rows appear partially obscured. Which statement best explains this behavior?
- A
The row access policy filters out rows before they are returned to the user, while the masking policy transforms protected column values in rows the user is allowed to see.
- B
The masking policy is evaluated first, and if the SSN is masked, Snowflake automatically removes rows that contain masked values from the result set.
- C
Row access policies and masking policies cannot be used on the same table, so the missing rows indicate a policy configuration error.
- D
The row access policy masks the REGION column and the masking policy filters SSN values, so both policies are changing the same result set in different ways.
Show answer and explanation
Correct answer: A
Explanation
This scenario tests the distinction between two core Snowflake data protection features. Row access policies enforce row-level security by evaluating a policy expression and limiting which rows are visible in query results. Dynamic Data Masking enforces column-level security by returning either the original value or a masked/transformed value based on role, user, or other context. When both are applied, they work together: first, only authorized rows are exposed to the user, and then protected columns in those visible rows may be masked. This is aligned with Snowflake best practices for layered access control, where row access policies protect dataset scope and masking policies protect sensitive attributes such as SSN or PII. Refer to Snowflake documentation on Row Access Policies and Dynamic Data Masking for policy evaluation behavior and supported combinations.
- A. Correct.
Correct. In Snowflake, a row access policy determines which rows are visible to the querying role or user, effectively filtering the result set. A masking policy does not remove rows; it changes how the protected column value is presented in rows that are already visible. This matches the scenario where some rows are absent and SSN is obscured in the remaining rows.
- B. Incorrect.
Incorrect. This reflects a common misconception that masking can suppress entire rows. Dynamic Data Masking affects column values, not row visibility. If a row is returned, the masked column may show a redacted or transformed value, but the row itself is not removed because of masking.
- C. Incorrect.
Incorrect. Snowflake supports using row access policies and masking policies together on the same table. In practice, this is a common pattern for layered security: row-level filtering for entitlements and column-level protection for sensitive data.
- D. Incorrect.
Incorrect. This reverses the responsibilities of the two policy types. Row access policies control row visibility through a Boolean expression, while masking policies return an alternate column value based on the executing context. They do not swap behaviors.