DAA-C01 Question 237
Single answerUnderstand the effects of row access policies and Dynamic Data MaskingA healthcare analytics team stores patient billing data in a Snowflake table named BILLING.TRANSACTIONS with columns REGION, PATIENT_ID, DIAGNOSIS_CODE, and CHARGE_AMOUNT. To meet compliance requirements, the team applies a row access policy on the table so analysts can see only rows for their assigned REGION, and applies a masking policy on DIAGNOSIS_CODE so only users with the MEDICAL_AUDITOR role can see the unmasked value. An analyst with the ANALYST_EAST role, but not the MEDICAL_AUDITOR role, queries the table. Which outcome should the data analyst expect?
- A
The analyst sees only rows for the EAST region, and DIAGNOSIS_CODE is masked in the returned rows.
- B
The analyst sees all rows, but DIAGNOSIS_CODE is masked for rows outside the EAST region.
- C
The analyst sees only EAST region rows, and DIAGNOSIS_CODE is unmasked because row access policies take precedence over masking policies.
- D
The analyst cannot query the table because Snowflake does not allow row access policies and masking policies on the same table.
Show answer and explanation
Correct answer: A
Explanation
The key concept is that Snowflake can enforce layered governance controls in the same query. A row access policy determines which rows are visible based on the query context, such as the current role. A masking policy independently controls whether a protected column's value is shown in plain text or masked. Therefore, the analyst first sees only the rows allowed by the row access policy, and then masking is applied to protected columns in those returned rows. This reflects Snowflake best practices for combining row-level and column-level protections for sensitive data. See Snowflake documentation on Row Access Policies and Dynamic Data Masking, which describes how these policies can be applied together to enforce fine-grained access control.
- A. Correct.
Correct. Row access policies filter which rows are visible to the querying role, while masking policies determine how protected column values are displayed in the rows that remain visible. In this scenario, the ANALYST_EAST role is limited to EAST rows by the row access policy. Because the user does not have the MEDICAL_AUDITOR role, the masking policy on DIAGNOSIS_CODE still applies, so that column remains masked in the visible EAST rows.
- B. Incorrect.
Incorrect. This confuses row filtering with column masking. A row access policy does not partially mask rows outside the allowed region; it prevents unauthorized rows from being returned at all. The analyst should not see non-EAST rows in the result set.
- C. Incorrect.
Incorrect. Row access policies and masking policies address different controls and both can apply in the same query. A row access policy restricting visible rows does not override a masking policy on a protected column. Even for authorized rows, DIAGNOSIS_CODE remains masked unless the role satisfies the masking policy condition.
- D. Incorrect.
Incorrect. Snowflake supports using row access policies and masking policies together on the same table. This is a common pattern for implementing layered security, where row-level visibility and column-level obfuscation are enforced simultaneously.