SnowPro Advanced: Security Engineer Question 175
Single answerApply retention settings using DDL and governance tools (for example, tagging and policies)A security engineering team must enforce different data retention periods across Snowflake objects based on data classification. Tables tagged as HIGHLY_CONFIDENTIAL must retain historical data for the shortest period allowed by the edition, while INTERNAL tables can retain historical data longer for operational recovery. The team also wants the enforcement to happen automatically when new tables are created, without relying on developers to remember object-level settings. Which approach best meets these requirements?
- A
Create a masking policy that checks the classification tag and sets DATA_RETENTION_TIME_IN_DAYS on matching tables.
- B
Use tag-based governance by assigning classification tags to tables and implement automation that reads the tag value and issues ALTER TABLE ... SET DATA_RETENTION_TIME_IN_DAYS for each table.
- C
Set DATA_RETENTION_TIME_IN_DAYS only at the account level, because table-level settings cannot override account defaults.
- D
Create a row access policy that filters older rows based on classification so Time Travel retention is effectively reduced for sensitive data.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to combine governance metadata with DDL-based enforcement. In Snowflake, retention is controlled through the DATA_RETENTION_TIME_IN_DAYS parameter, which can be set at account, database, schema, and object levels. Because the requirement is to apply different retention values based on classification and to do so automatically for new tables, tags are useful for expressing the business classification, but tags themselves do not directly change retention. Instead, an automated process, such as a task-driven procedure or external orchestration, should detect the tag value and execute ALTER TABLE ... SET DATA_RETENTION_TIME_IN_DAYS accordingly. This is the practical pattern for applying retention settings using DDL and governance tools. Relevant Snowflake documentation includes object parameters for Time Travel retention, tag-based governance capabilities, and SQL commands such as ALTER TABLE and CREATE/ALTER DATABASE or SCHEMA for inherited defaults.
- A. Incorrect.
Incorrect. Masking policies control query-time data visibility for column values; they do not modify object parameters such as DATA_RETENTION_TIME_IN_DAYS. A common misconception is to treat governance policies as capable of changing storage or Time Travel settings. In Snowflake, masking policies are for dynamic data protection, not retention configuration.
- B. Correct.
Correct. DATA_RETENTION_TIME_IN_DAYS is an object parameter that can be set with DDL, including ALTER TABLE. Tags can be used as governance metadata to classify objects, and automation can inspect tag assignments and apply the appropriate retention setting to each object. This approach aligns with the requirement to automate enforcement for newly created tables, since tags provide the governance signal and DDL applies the actual retention parameter.
- C. Incorrect.
Incorrect. Snowflake allows DATA_RETENTION_TIME_IN_DAYS to be set at multiple levels, including account, database, schema, and object levels, with lower-level settings overriding inherited defaults. Relying only on an account-level setting would not support different retention periods for HIGHLY_CONFIDENTIAL versus INTERNAL tables.
- D. Incorrect.
Incorrect. Row access policies control which rows are visible to a querying role; they do not affect physical retention, Time Travel duration, or Fail-safe behavior. Filtering older rows may hide them from users, but the historical data would still be retained according to the object's retention settings.