SnowPro Advanced: Security Engineer Question 184
Single answer2.5 Configure object tagging and data classification frameworks.A financial services company wants to standardize how sensitive data is identified and labeled across hundreds of Snowflake tables. The security engineer must implement a solution that minimizes manual effort, uses Snowflake-native classification capabilities, and ensures classifications can be stored consistently as metadata for downstream governance reporting. Which approach best meets these requirements?
- A
Create a tag such as DATA_SENSITIVITY, run Snowflake's classification process on target tables, and configure the results to be associated to tags so classified columns can be labeled consistently.
- B
Create a masking policy on every sensitive column first, because Snowflake classification only works after masking policies are already attached to the columns.
- C
Enable row access policies on all tables, then use the policy results to populate tags automatically because row access policies generate classification labels.
- D
Use object comments to store values such as PII or CONFIDENTIAL, because Snowflake's classification framework reads comments and converts them into governed tags automatically.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake's native data classification capabilities together with tags. In Snowflake, classification can inspect table columns for sensitive data patterns and assign results that can be stored using system tags, which provides a governed, queryable metadata model for reporting and policy workflows. This is preferable to relying on comments or trying to infer classifications from access-control objects such as masking or row access policies. In practice, organizations often classify data first, review results, and then use those tag values to drive additional controls such as masking policies. This reflects Snowflake best practices for scalable metadata-driven governance under object tagging and data classification frameworks.
- A. Correct.
Correct. This approach aligns with Snowflake-native data classification and tagging capabilities. Snowflake supports classifying sensitive data and associating classification results with system tags, allowing organizations to standardize sensitivity labels as metadata. This minimizes manual labeling effort and supports downstream governance and reporting use cases.
- B. Incorrect.
Incorrect. Masking policies are commonly applied after sensitive data has been identified, not as a prerequisite for classification. Snowflake's classification process is designed to help discover sensitive data so teams can then decide whether to apply masking, row access, or other controls.
- C. Incorrect.
Incorrect. Row access policies control which rows a role can see; they do not classify data or generate sensitivity labels. A candidate might choose this if they confuse access governance with data discovery and metadata labeling.
- D. Incorrect.
Incorrect. Comments can store descriptive text, but Snowflake's classification framework does not automatically convert object comments into governed tag values. Tags are the proper metadata mechanism for consistent, queryable governance labels.