SnowPro Advanced: Security Engineer Question 135
Select 3Utilize aggregation policies, differential privacy policies, and budgetsA healthcare analytics team shares a de-identified claims table with internal analysts. Security requirements state that analysts must only be able to run aggregate queries over patient cohorts, and repeated querying must be controlled so users cannot gradually infer sensitive information from small populations. The security engineer wants a solution enforced inside Snowflake, with a measurable limit on privacy loss over time. Which TWO actions should the engineer take?
- A
Apply an aggregation policy to the shared table so queries must satisfy aggregate-query requirements before returning results.
- B
Create and attach a differential privacy policy to the protected data or query context so noise is added and privacy-loss accounting can be enforced.
- C
Increase the warehouse size used by analysts so aggregation queries complete faster and reduce the chance of inference attacks.
- D
Configure and monitor a privacy budget so repeated differentially private queries consume an allowed budget over time.
- E
Use only dynamic data masking on direct identifiers such as PATIENT_ID, because masked identifiers are sufficient to prevent inference from repeated aggregate queries.
Show answer and explanation
Correct answers: A, B, D
Explanation
The best solution combines aggregation policies with differential privacy policies and privacy budgets. Aggregation policies help ensure that only aggregate-style results are returned from protected datasets, reducing the risk of row-level disclosure. Differential privacy policies add mathematically grounded privacy protection by injecting controlled noise into query outputs, and privacy budgets limit cumulative privacy loss from repeated queries. Together, these controls address both parts of the scenario: restricting analysts to aggregate access and limiting inferential disclosure over time. By contrast, warehouse sizing is operational rather than security-related, and masking alone does not provide protection against differencing or reconstruction attacks from repeated aggregates. This aligns with Snowflake best practices for privacy-preserving analytics using aggregation controls, differential privacy enforcement, and budget management.
- A. Correct.
Correct. Aggregation policies are designed to restrict access to sensitive data by requiring queries to be sufficiently aggregated before results are returned. This helps prevent analysts from issuing row-level or overly granular queries against protected data. In this scenario, the requirement explicitly states that analysts must only run aggregate queries over patient cohorts, which aligns with the purpose of an aggregation policy.
- B. Correct.
Correct. A differential privacy policy is the Snowflake control intended to add privacy protections to aggregate analysis by introducing calibrated noise and supporting formal privacy-loss controls. This directly addresses the requirement to limit what can be inferred from repeated querying of small or sensitive populations.
- C. Incorrect.
Incorrect. Warehouse size affects performance and concurrency, not privacy guarantees. Faster execution does nothing to prevent inference attacks or enforce aggregate-only access. This is a plausible distractor because performance tuning is often used in analytics workloads, but it is unrelated to privacy enforcement.
- D. Correct.
Correct. Differential privacy protections rely on privacy-loss accounting, commonly implemented through a privacy budget. Monitoring and limiting budget consumption is essential to prevent analysts from repeatedly querying the same sensitive population until they can reverse-engineer protected information. This option directly addresses the requirement for a measurable limit on privacy loss over time.
- E. Incorrect.
Incorrect. Dynamic data masking can hide direct identifiers, but it does not by itself prevent inference from aggregate queries, differencing attacks, or repeated probing of small cohorts. Someone might choose this because masking is a common privacy feature, but it is not sufficient for the scenario's requirements around aggregate-only access and controlled privacy loss.