SnowPro Advanced: Security Engineer Question 190
Single answerVisualize data lineageA security engineering team must investigate whether a masked PII column from a source table has propagated into downstream analytics objects before granting a new role access. The team wants to visually trace how data moved from the source table into derived tables and views, including column-level relationships where possible, using native Snowflake capabilities. Which approach should they use?
- A
Use Snowsight Lineage to visualize upstream and downstream dependencies for the relevant object and inspect column-level lineage where available.
- B
Query ACCESS_HISTORY only, because it provides a complete visual lineage graph of all downstream objects and column dependencies.
- C
Use SHOW GRANTS on the source table, because role grants reveal every table and view that inherited data from that source.
- D
Query TAG_REFERENCES on the masked column, because tag inheritance automatically maps all transformations and downstream lineage paths.
Show answer and explanation
Correct answer: A
Explanation
The key requirement is to visually trace how sensitive data moved through Snowflake objects. The best native capability for that is Snowsight Lineage, which is designed to show upstream and downstream dependencies and can expose column-level lineage in supported scenarios. This is especially relevant for security engineers assessing blast radius, downstream exposure of masked or sensitive fields, and governance impacts before granting access. ACCESS_HISTORY and related account usage views are valuable for auditing and forensic analysis, but they are not the primary visual lineage feature. Similarly, SHOW GRANTS and TAG_REFERENCES provide security and governance metadata, not end-to-end transformation lineage. This aligns with Snowflake guidance to use Snowsight lineage features for dependency visualization and impact analysis, while using account usage views for complementary auditing and governance workflows.
- A. Correct.
Correct. Snowsight provides a native Lineage experience that allows teams to visualize upstream and downstream object relationships and, for supported cases, inspect column-level lineage. This is the most appropriate native method for visually determining whether sensitive data from a source object has flowed into downstream tables or views before authorizing access.
- B. Incorrect.
Incorrect. ACCESS_HISTORY is useful for auditing query activity and can help analyze what columns were accessed by queries, but it is not itself a complete visual lineage tool. A candidate might choose this because access history is commonly used in security investigations, but it does not directly provide the native visual lineage graph requested in the scenario.
- C. Incorrect.
Incorrect. SHOW GRANTS reveals privileges assigned on objects; it does not describe data flow or transformation lineage. This distractor targets the common misconception that access control metadata can be used to infer where data has been copied or derived.
- D. Incorrect.
Incorrect. TAG_REFERENCES helps identify where tags are applied or inherited, which is useful for governance and sensitive data classification, but it does not provide a full transformation-based lineage map of downstream data movement. Someone might pick this because tags are often used with masking policies and classification, but tags do not replace lineage visualization.