SnowPro Advanced: Security Engineer Question 186
Single answerUse automatic tag propagation, including tag inheritance:A security engineering team uses a tag named DATA_CLASSIFICATION to drive masking policies across analytics objects. They want newly created columns to receive the correct classification tag with minimal manual effort. The team has already tagged the SALES database as INTERNAL and one schema inside it, FINANCE, as CONFIDENTIAL. A new table FINANCE.PAYROLL is created, and no tags are explicitly set on the table or its columns. Which statement best describes how Snowflake applies tag inheritance in this scenario?
- A
The PAYROLL table and its columns inherit the CONFIDENTIAL tag value from the FINANCE schema unless a lower-level object later overrides it.
- B
The PAYROLL table inherits INTERNAL from the SALES database, but the columns inherit CONFIDENTIAL from the FINANCE schema because columns do not inherit from tables.
- C
The PAYROLL table and its columns inherit both INTERNAL and CONFIDENTIAL values for the same tag, and Snowflake evaluates both values at query time.
- D
No tag is inherited automatically because automatic propagation requires the tag to be set directly on the table before columns can inherit it.
Show answer and explanation
Correct answer: A
Explanation
This question tests understanding of tag inheritance rather than propagation by data movement. In Snowflake, tags can be associated with securable objects such as databases, schemas, tables, and columns, and descendant objects can inherit tag values through the hierarchy. If the same tag is assigned at multiple levels, the nearest parent assignment takes precedence over more distant ancestors. Therefore, a schema-level value overrides a database-level value for objects inside that schema unless an even lower-level assignment exists. This is important in security engineering because tag-driven masking and governance depend on the effective tag value seen by downstream controls. Snowflake documentation on object tagging and tag inheritance describes this hierarchical behavior and precedence model, which is a best practice for reducing manual tagging effort while preserving more specific classifications where needed.
- A. Correct.
Correct. Snowflake supports tag inheritance across securable object hierarchies. When the same tag is set at multiple levels, the closest ancestor takes precedence. In this case, the FINANCE schema is closer than the SALES database, so the PAYROLL table inherits CONFIDENTIAL. Its columns also inherit that effective value unless a tag is explicitly set at the table or column level later.
- B. Incorrect.
Incorrect. Columns can inherit tags through the object hierarchy, including from a tagged table or higher-level container. The misconception is that column inheritance skips the table and only looks to the schema. In practice, the effective inherited value comes from the nearest tagged ancestor in the hierarchy, which here is the schema for both the table and the columns.
- C. Incorrect.
Incorrect. A single tag cannot effectively hold two inherited values simultaneously on one object in this manner. When the same tag exists at multiple ancestor levels, Snowflake resolves inheritance by precedence, using the nearest assignment rather than combining values.
- D. Incorrect.
Incorrect. This confuses automatic tag propagation with tag inheritance. Tag inheritance does not require the tag to be manually placed on the table first. Because the schema is tagged, the new table and its columns can inherit the tag value automatically through the hierarchy.