SnowPro Advanced: Security Engineer Question 195
Select 2Configure automatic, custom, and manual classificationsA financial services company stores customer records in a Snowflake table named PROD.CUSTOMER.PII_DATA. The security team wants to classify sensitive data before applying masking policies. They have three requirements: (1) quickly identify standard sensitive data types such as email addresses and phone numbers across existing columns, (2) ensure a proprietary customer identifier format unique to the company is also recognized in future scans, and (3) explicitly mark one free-text notes column as sensitive even though pattern-based detection is unreliable for that column. Which combination of actions should the security engineer take to meet these requirements?
- A
Run automatic sensitive data classification on the table to detect built-in semantic categories, create a custom classification profile for the proprietary identifier, and manually assign a classification tag to the notes column.
- B
Create a row access policy on the table for all columns, because row access policies automatically classify standard, custom, and manually designated sensitive data in one step.
- C
Use only manual classification for every column in the table, because automatic classification cannot be combined with custom classification in the same implementation.
- D
Define a custom classification rule for the proprietary identifier and run classification using that custom profile alongside Snowflake's built-in system classification, then manually set the notes column's classification/tag since it may not be reliably inferred.
- E
Create masking policies first and then run automatic classification, because classification in Snowflake requires an existing masking policy on each candidate column.
Show answer and explanation
Correct answers: A, D
Explanation
The correct approach is to combine Snowflake's automatic classification, custom classification, and manual classification/tagging capabilities based on the nature of the data. Automatic classification is appropriate for common built-in semantic categories such as email addresses and phone numbers. When an organization needs to detect proprietary or domain-specific formats, a custom classification profile should be created so future scans can identify those values consistently. For columns like free-text notes, where content may be sensitive but not reliably discoverable through pattern-based detection, a manual classification/tag assignment is the safest option.
This reflects Snowflake best practices: first classify sensitive data, then use the resulting tags/metadata to drive downstream controls such as masking. It is also important to distinguish classification from enforcement mechanisms like masking policies and row access policies. Classification identifies and labels sensitive data; enforcement policies control access or obfuscation after that identification step. Candidates should know that these approaches are complementary and can be used together in a realistic governance workflow.
- A. Correct.
Correct. This directly maps to the three requirements. Automatic classification is used for built-in detections such as email addresses and phone numbers. A custom classification profile addresses organization-specific patterns, such as a proprietary customer identifier. Manual classification or manual assignment of the appropriate sensitive-data tag is appropriate for a column like free-text notes where automated inference may be inconsistent. This reflects how Snowflake supports automatic, custom, and manual classification approaches together.
- B. Incorrect.
Incorrect. Row access policies control which rows a role can see; they do not perform data classification. This option reflects a common confusion between governance controls and discovery/classification features. Classification is a separate capability used to identify and tag sensitive columns before policies such as masking are applied.
- C. Incorrect.
Incorrect. Manual classification is possible, but it is not the best solution here and Snowflake does allow combining automatic and custom classification. Choosing only manual classification would be operationally inefficient for standard data types already detectable by Snowflake and would not meet the requirement to recognize the proprietary identifier in future scans through reusable custom logic.
- D. Correct.
Correct. This is the most precise implementation-oriented answer. Snowflake supports custom classification through a custom classification profile for organization-specific patterns, and this can be used with built-in system classification to detect both standard and proprietary sensitive data. For a free-text column that should be treated as sensitive regardless of pattern matching quality, manually setting the classification/tag is the appropriate step.
- E. Incorrect.
Incorrect. Classification does not require masking policies to exist first. In practice, classification is often performed before policy assignment so that teams know which columns need protection. This option reverses the typical workflow and incorrectly states a dependency that does not exist.