SnowPro Advanced: Security Engineer Question 187
Single answerUse automatic tag propagation, including tag inheritance:A financial services company uses Snowflake tags to classify sensitive data. The security team created a tag named DATA_CLASSIFICATION and wants new columns in derived objects to automatically retain the classification of their source columns wherever possible. They also want child objects to receive a tag value from a tagged parent object when no value is set directly on the child. During testing, the team notices that some derived columns are tagged automatically, while other objects receive a tag value from their container hierarchy. Which Snowflake behavior correctly explains these results?
- A
Automatic tag propagation copies tag values through supported data movement and dependency operations, while tag inheritance applies a parent object's tag to child objects in the object hierarchy when the child does not have its own tag value.
- B
Automatic tag propagation and tag inheritance are the same feature; both only work when a tag is manually applied to each target object after object creation.
- C
Tag inheritance automatically propagates tags across CTAS statements and views, while automatic tag propagation only applies from databases to schemas and tables.
- D
Automatic tag propagation applies only to masking policies attached to tagged columns, and tag inheritance applies only to virtual warehouses and users.
Show answer and explanation
Correct answer: A
Explanation
Snowflake provides two distinct automated tag behaviors relevant to security and governance. Automatic tag propagation is used to carry tag values to supported downstream objects or columns based on data lineage-style relationships or supported operations. Tag inheritance applies tag values through the securable object hierarchy, such as parent-to-child relationships, when a tag value is not explicitly assigned at the lower level. For exam purposes, candidates should clearly distinguish propagation across supported derived or dependent objects from inheritance within object hierarchy. This is aligned with Snowflake documentation on object tagging, automatic propagation of tags, and tag inheritance behavior. A practical best practice is to use inheritance for baseline governance at higher container levels and automatic propagation to maintain classifications on downstream data assets where supported.
- A. Correct.
Correct. In Snowflake, automatic tag propagation is intended to carry tag values to supported downstream objects or columns based on data movement or object dependencies, such as certain derived columns. Tag inheritance is different: it applies within the securable object hierarchy, where a child object can inherit a tag value from a tagged parent if the tag is not explicitly set on the child. This distinction explains why some derived columns receive tags through propagation, while other objects receive values from their parent container.
- B. Incorrect.
Incorrect. This option incorrectly treats propagation and inheritance as identical and claims manual application is still required for each target. In reality, Snowflake supports these as separate automated behaviors when configured and supported by the object type and operation. A candidate might choose this if they assume tags behave like static metadata with no automated downstream behavior.
- C. Incorrect.
Incorrect. This reverses the concepts. Tag inheritance is about hierarchy-based assignment from parent to child objects, not about downstream derivation across CTAS or views. Automatic tag propagation is the feature related to carrying tags to supported derived data or dependent objects. The confusion is plausible because both features can result in additional objects appearing tagged without direct manual assignment.
- D. Incorrect.
Incorrect. Automatic tag propagation is not limited to masking policies, and tag inheritance is not restricted to warehouses and users. Tags are a data governance feature that can apply to supported securable objects and columns. This distractor reflects a misunderstanding that tags are merely auxiliary metadata for policy attachment rather than a broader classification and governance mechanism.