SnowPro Advanced: Security Engineer Question 193
Single answerImplement data classification:A financial services company stores customer data in Snowflake and must quickly identify columns that contain sensitive information such as email addresses, phone numbers, and national identifiers before applying masking policies. The security team wants a solution that uses Snowflake-native capabilities, minimizes manual review, and provides repeatable results as new tables are added to the environment. Which approach should the security engineer recommend?
- A
Run Snowflake Sensitive Data Classification on the relevant schemas or tables, review the generated system tags, and use those tags to drive subsequent masking policy assignment.
- B
Create row access policies on all tables first, because row access policies automatically discover and label sensitive columns for later masking.
- C
Query ACCOUNT_USAGE.ACCESS_HISTORY to infer which columns are sensitive based on how frequently they are accessed, then manually create custom tags for those columns.
- D
Enable Tri-Secret Secure and Network Policies, because these features classify regulated data and make additional column-level tagging unnecessary.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake Sensitive Data Classification, which is designed specifically to help identify sensitive data in Snowflake objects using built-in classification logic. In practice, organizations run classification against target databases, schemas, or tables, review the results, and then use the resulting system tags to support downstream controls such as masking policies or governance workflows. This aligns with Snowflake best practices for reducing manual effort and improving consistency as new data is onboarded. By contrast, row access policies, network policies, and encryption features are important security capabilities but do not classify data. Likewise, audit views such as ACCOUNT_USAGE.ACCESS_HISTORY help with monitoring and investigation, not with determining the semantic sensitivity of a column.
- A. Correct.
Correct. Snowflake provides native Sensitive Data Classification to scan supported objects and identify likely sensitive data types such as emails, phone numbers, and other regulated data patterns. The process applies system tags with classification results, which can then be reviewed and used as an input to governance controls such as masking. This is the most direct Snowflake-native approach for scalable, repeatable data classification.
- B. Incorrect.
Incorrect. Row access policies control which rows a role can see; they do not discover, classify, or label sensitive columns. A candidate might choose this option because row access is a security control, but it solves a different problem than identifying and classifying column sensitivity.
- C. Incorrect.
Incorrect. ACCESS_HISTORY is useful for auditing data access patterns, lineage investigation, and impact analysis, but access frequency does not determine whether a column contains PII or other sensitive data. Manual tagging based on usage is not a reliable or scalable classification method.
- D. Incorrect.
Incorrect. Tri-Secret Secure and Network Policies address encryption key management and network access restrictions, respectively. They are valuable security features, but they do not perform data discovery or column classification. This option mixes unrelated security controls with classification requirements.