SnowPro Advanced: Security Engineer Question 144
Select 3Apply the principles of secure multi-party computationTwo healthcare organizations want to collaborate in Snowflake to measure overlap and trends across patient populations for fraud detection, but neither organization is allowed to expose raw patient records, direct identifiers, or unrestricted row-level access to the other party. The security engineer must design an approach that supports joint analysis while minimizing data exposure and enforcing each party's governance controls. Which TWO actions best align with secure multi-party computation principles in Snowflake for this scenario?
- A
Use Snowflake clean rooms so both organizations can analyze combined data through approved templates and policies without directly sharing underlying raw records.
- B
Replicate each organization's patient tables into a shared database and rely on analyst agreements not to query identifying columns.
- C
Tokenize or hash agreed join keys using a consistent privacy-preserving method before collaboration, then restrict analysis to approved queries and aggregate outputs.
- D
Grant imported privileges on a data share containing detailed patient-level rows, and use masking policies only after the consumer has query access.
- E
Design the collaboration so only aggregated or policy-controlled results are exposed, with row access, masking, and query controls limiting what each participant can see.
Show answer and explanation
Correct answers: A, C, E
Explanation
The best answer is to use privacy-preserving collaboration patterns that let both organizations compute joint insights without exposing raw records. In Snowflake, clean rooms are the most directly relevant capability for this type of use case because they support governed collaboration through templates and policies rather than unrestricted data sharing. Supporting techniques such as hashed or tokenized join keys can further reduce exposure of direct identifiers when record linkage is needed. Finally, outputs should be constrained to approved aggregates or otherwise policy-controlled results, consistent with least privilege and data minimization principles.
The incorrect choices fail because they expose detailed shared data too broadly and rely on weak procedural controls rather than enforceable technical safeguards. Replicating full patient tables or granting broad access to detailed rows contradicts secure multi-party computation objectives.
Relevant Snowflake best-practice areas include Snowflake clean rooms for secure collaboration, data sharing governance, dynamic data masking, row access policies, and privacy-by-design approaches that minimize access to sensitive data while still enabling analytics.
- A. Correct.
Correct. Snowflake clean rooms are designed for privacy-enhancing collaboration where multiple parties can analyze data together without broadly exposing raw underlying datasets. This is closely aligned with secure multi-party computation goals in practice: enabling joint computation while reducing direct data disclosure. Clean rooms use policy and template-based controls so participants can collaborate on approved analyses instead of unrestricted table access.
- B. Incorrect.
Incorrect. Copying or replicating raw patient tables into a shared database materially increases exposure and does not enforce the principle of minimizing disclosure. Relying on analyst behavior or contractual agreements is not a sufficient technical control. Secure collaboration should be implemented with enforceable governance and privacy controls, not trust alone.
- C. Correct.
Correct. A common privacy-preserving design pattern is to transform join keys consistently across parties so matching can occur without exchanging plain-text identifiers. While hashing or tokenization is not a full substitute for all privacy controls, in combination with strict query templates and aggregate-only outputs it supports secure collaboration principles by reducing exposure of direct identifiers.
- D. Incorrect.
Incorrect. Granting access to detailed patient-level data and then depending on masking afterward is the wrong order of control and creates unnecessary exposure risk. Imported privileges on shares do not by themselves implement secure multi-party computation. The design should prevent unrestricted access in the first place and avoid broad sharing of row-level sensitive data.
- E. Correct.
Correct. Secure multi-party computation principles emphasize computing useful results while limiting what each party can learn about the other's underlying data. In Snowflake, this is operationalized through policy-controlled outputs, aggregation requirements, and governance mechanisms such as row access policies, masking policies, and restricted query patterns. This approach is more appropriate than direct table sharing for sensitive regulated data.