SnowPro Advanced: Security Engineer Question 121
Single answerUse tag-based masking policiesA financial services company wants to standardize protection of sensitive data across dozens of schemas managed by different teams. The security engineer has created a tag named SENSITIVITY and a masking policy that should reveal full values only to users with the PII_ACCESS role, while masking values for all other roles. The company wants the policy to be applied automatically whenever a column is tagged as SENSITIVITY='HIGH', including on future tables created by application teams. Which approach best meets this requirement with the least ongoing administrative effort?
- A
Attach the masking policy directly to every sensitive column and use the tag only for reporting on classified data.
- B
Associate the masking policy with the SENSITIVITY tag, then set the tag on applicable columns so the policy is enforced wherever that tag is applied.
- C
Create a row access policy that checks whether a column has the SENSITIVITY='HIGH' tag and returns masked values for unauthorized users.
- D
Grant APPLY MASKING POLICY on all schemas to application teams so they can manually bind the masking policy whenever they create a new sensitive column.
Show answer and explanation
Correct answer: B
Explanation
The best solution is to use tag-based masking by associating a masking policy with a tag and then applying that tag to sensitive columns. This supports centralized governance and automatic enforcement when the tag is present, which is especially valuable in environments with many schemas and decentralized development teams. Snowflake supports assigning masking policies to tags so that protected behavior is driven by data classification rather than repeated manual policy bindings. This aligns with Snowflake best practices for scalable data protection and governance: classify data with tags, associate governance policies centrally, and let enforcement follow the metadata. Direct masking policy assignment remains valid but is less scalable. Row access policies solve a different problem, and relying on application teams to manually attach policies increases the chance of missed protection.
- A. Incorrect.
This approach does not meet the requirement with the least administrative effort. Directly assigning a masking policy to each column works, but it is manual and difficult to scale across many schemas and future objects. It also fails to take advantage of centralized tag-based masking, which is specifically designed to reduce repetitive policy bindings.
- B. Correct.
This is correct. In Snowflake, a masking policy can be associated with a tag so that when the tag is set on a supported column, the masking policy is automatically applied based on the tag association. This is the intended pattern for centralized, scalable enforcement across many objects and teams. It reduces operational overhead and supports consistent protection of newly tagged columns.
- C. Incorrect.
This is incorrect because row access policies control which rows are visible, not how column values are transformed or obscured. Masking sensitive values based on role is the purpose of a masking policy, not a row access policy. This option reflects a common confusion between row-level filtering and column-level masking.
- D. Incorrect.
This approach could work operationally, but it does not satisfy the requirement for least ongoing administrative effort. It relies on each team to remember to apply the policy manually, which introduces inconsistency and governance risk. Tag-based masking is preferable because the central security team can define the policy once and enforce it through tag application.