SnowPro Advanced: Security Engineer Question 116
Single answerMonitor the impact of policy changes on data visibilityA Snowflake security engineer updates a row access policy on the SALES.ORDERS table to further restrict which regional managers can see order records. Before promoting the change to production, the engineer must verify how the updated policy affects data visibility for several roles and compare the results with the current policy behavior. The company wants a repeatable approach that does not require repeatedly logging in as each end user. Which approach best meets this requirement?
- A
Use a test environment or cloned objects, apply the revised row access policy there, and validate results by executing queries under different roles with policy context simulation such as POLICY_CONTEXT where applicable.
- B
Review ACCESS_HISTORY after changing the production policy, because it will show which rows would have been visible to each role before and after the change without requiring test queries.
- C
Use DESCRIBE ROW ACCESS POLICY to determine exactly which rows each role will lose access to after the policy change, then compare the output with the current policy definition.
- D
Grant the engineer role OWNERSHIP on the table and query the table directly, because object owners can see the effective result set for all consuming roles without additional testing.
Show answer and explanation
Correct answer: A
Explanation
For monitoring the impact of row access policy changes on data visibility, Snowflake best practice is to test policy revisions in a controlled environment before production rollout. Zero-copy cloning is especially useful because it allows realistic validation against current data without duplicating storage. The engineer should compare current and proposed behavior by running representative queries under the roles that will consume the data, or by using supported policy context simulation functions such as POLICY_CONTEXT where applicable. Metadata commands like DESCRIBE ROW ACCESS POLICY help inspect definitions, but they do not reveal the actual filtered result set. Audit views such as ACCESS_HISTORY are valuable for post-execution analysis, not pre-change visibility simulation. This aligns with Snowflake guidance on governance testing, access policy validation, and least-risk deployment of security controls.
- A. Correct.
Correct. To monitor the impact of policy changes on data visibility, the safest and most practical method is to test in a non-production environment, often using clones for realistic data and metadata. The engineer can apply the revised row access policy to the cloned object and run validation queries using the relevant roles. Snowflake also provides policy context simulation capabilities, such as POLICY_CONTEXT, to help evaluate policy behavior without having to log in as each business user individually. This supports repeatable testing and side-by-side comparison of current versus proposed visibility outcomes.
- B. Incorrect.
Incorrect. ACCESS_HISTORY is useful for auditing which objects and columns were accessed by executed queries, but it does not provide a hypothetical comparison of which rows would have been visible under an unimplemented policy change. It is retrospective, not a what-if analysis tool for row-level visibility under a proposed policy definition.
- C. Incorrect.
Incorrect. DESCRIBE ROW ACCESS POLICY returns metadata about the policy, such as signature and body, but it does not evaluate the policy against table data to show which specific rows each role can or cannot see. A common misconception is that policy metadata commands provide impact analysis; in reality, query-based validation is still required.
- D. Incorrect.
Incorrect. OWNERSHIP gives administrative control over the object, but it does not automatically show the effective row-level results that other roles will experience. Row access policies are evaluated in query context, and testing must be performed with the relevant role or simulated context. Administrative privileges alone are not a substitute for validating policy behavior from the consumer perspective.