SnowPro Advanced: Security Engineer Question 192
Single answerImplement data classification:A security engineering team at a healthcare company must identify columns containing sensitive information across hundreds of Snowflake tables before applying masking policies. They need a solution that scales, uses Snowflake-native capabilities, and produces classification metadata that can be reviewed and used for downstream policy decisions. Which approach should they use?
- A
Run Snowflake's built-in sensitive data classification on the relevant tables so Snowflake can inspect columns and write classification results as system tags/metadata for review.
- B
Create row access policies first, because row access policies automatically discover and label sensitive columns during query execution.
- C
Enable Time Travel on all schemas, because Time Travel scans historical micro-partitions and generates sensitivity labels for regulated data.
- D
Grant users the GOVERNANCE_VIEWER database role, because that role performs automatic column classification when users query information schema views.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake's native sensitive data classification capability to inspect table columns and generate classification metadata that can be reviewed and then used for downstream controls such as masking policies and broader governance workflows. This aligns with Snowflake best practices: first discover and classify sensitive data, then apply protection mechanisms such as masking policies, tag-based masking, and monitoring. By contrast, row access policies enforce row-level visibility, Time Travel supports historical data access and recovery, and governance viewer roles provide metadata visibility rather than automatic discovery. In Snowflake documentation, data classification is positioned as a governance feature for identifying sensitive data and leveraging classification/tag metadata as part of a larger security and compliance program.
- A. Correct.
Correct. Snowflake provides native sensitive data classification capabilities intended to discover likely sensitive data in table columns at scale. The classification process analyzes column data and applies classification results as metadata/tags that administrators can review and use to drive governance controls such as masking. This is the Snowflake-native way to identify sensitive columns before attaching enforcement policies.
- B. Incorrect.
Incorrect. Row access policies control which rows a role can see based on policy logic; they do not scan table contents to discover or label sensitive columns. A candidate might choose this option because row access policies are a governance feature, but they address runtime access control, not data discovery or classification.
- C. Incorrect.
Incorrect. Time Travel preserves historical versions of data for recovery and querying past states, but it does not perform content inspection or sensitivity classification. This distractor is plausible because Time Travel interacts with stored data over time, yet it has no role in labeling data types such as PII or PHI.
- D. Incorrect.
Incorrect. GOVERNANCE_VIEWER is useful for visibility into governance-related metadata, but granting a role does not trigger automatic classification. Classification must be executed using the appropriate Snowflake classification capability; viewing metadata and generating metadata are separate tasks.