SnowPro Advanced: Security Engineer Question 120
Single answerUse tag-based masking policiesA financial services company wants to standardize masking for sensitive columns across dozens of schemas and future tables in Snowflake. The security team created a tag named DATA_CLASSIFICATION and wants any column tagged as CONFIDENTIAL to be masked automatically, without assigning a masking policy to each column individually. They also need analysts with the role PII_ADMIN to see full values, while all other roles should see masked values. Which approach should the security engineer implement?
- A
Create a masking policy that checks CURRENT_ROLE() for PII_ADMIN, then use ALTER TAG DATA_CLASSIFICATION SET MASKING POLICY
; and apply the tag value CONFIDENTIAL to the required columns. - B
Create a row access policy that checks CURRENT_ROLE() for PII_ADMIN, then attach it to the DATA_CLASSIFICATION tag so tagged columns are masked automatically.
- C
Create a masking policy on each table using ALTER TABLE ... ALTER COLUMN ... SET MASKING POLICY ..., and then propagate the DATA_CLASSIFICATION tag so the policy inherits to future columns.
- D
Create an object tag on each schema with value CONFIDENTIAL and rely on automatic inheritance so all existing and future column values are masked without defining a masking policy on the tag.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use tag-based masking, which allows a masking policy to be associated with a tag and then enforced wherever that tag is applied to supported objects such as columns. This is a best-practice approach when an organization wants centralized governance and reduced administrative overhead across many tables and schemas. The masking policy should contain logic such as CASE WHEN CURRENT_ROLE() = 'PII_ADMIN' THEN val ELSE 'MASKED' END, adapted to the data type. Then the security engineer should associate that policy to the tag with ALTER TAG ... SET MASKING POLICY and apply the tag/value to the relevant columns. Row access policies are for row filtering, not column masking. Direct per-column masking does not satisfy the requirement for scalable centralized management. Snowflake documentation on dynamic data masking and tag-based masking describes associating masking policies with tags and applying tags to columns so policy enforcement occurs automatically for tagged data.
- A. Correct.
Correct. Tag-based masking is designed for centralized enforcement of masking policies based on tags rather than per-column assignments. The correct pattern is to create a masking policy that returns unmasked values for authorized roles such as PII_ADMIN and masked values for others, then associate that masking policy with the tag using ALTER TAG ... SET MASKING POLICY. After that, applying the tag with the appropriate value to columns causes the masking policy to govern query results for those tagged columns. This is the scalable approach for many schemas and future objects.
- B. Incorrect.
Incorrect. Row access policies control which rows are visible, not how column values are masked. They cannot be attached to a tag to provide tag-based masking of column values. This option reflects a common confusion between row-level security and dynamic data masking.
- C. Incorrect.
Incorrect. Directly assigning masking policies to each column works technically, but it does not meet the requirement to avoid individual column assignments and centrally manage enforcement through tags. Also, tag propagation or inheritance does not convert direct column masking policies into tag-based masking behavior for future columns.
- D. Incorrect.
Incorrect. Tags by themselves do not mask data. A masking policy must be associated with the tag for tag-based masking to occur. In addition, relying on schema-level tagging alone does not automatically guarantee masking of existing and future columns unless the relevant columns are actually tagged in a way Snowflake recognizes for tag-based masking enforcement.