SnowPro Advanced: Security Engineer Question 196
Single answerIntegrate data classification into data governance policiesA financial services company stores customer data in Snowflake and must enforce governance policies based on sensitive data types. The security team wants newly discovered PII columns to be automatically protected without manually reviewing every table. They have already run Snowflake-sensitive data classification on several schemas and want to integrate those results into an enterprise policy framework. Which approach BEST meets this requirement?
- A
Use classification results to apply tags to sensitive columns, then create masking policies that reference those tags so protection can be enforced consistently across objects.
- B
Grant SELECT only through secure views for all schemas and rely on object ownership to determine whether a column contains PII.
- C
Create row access policies on every table because row access policies automatically detect classified columns and mask sensitive values by data type.
- D
Export classification results and maintain a manual spreadsheet that data stewards use to decide which columns should be masked during quarterly reviews.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to integrate classification outputs with Snowflake governance controls using tags and tag-based masking. Snowflake supports sensitive data classification to identify likely sensitive columns, and tags can be used as governance metadata to represent sensitivity or compliance categories. Masking policies can then be associated through tag-based masking so that when sensitive columns are tagged, policy enforcement can scale across schemas and future objects with less manual effort. This is the most practical approach for enterprises that want classification to drive protection.
Why the others are wrong: secure views are useful in some architectures but do not automatically consume classification metadata; row access policies solve a different problem by filtering rows rather than masking column values; manual spreadsheet-based governance does not provide the automation or consistency expected in a mature Snowflake security design.
This aligns with Snowflake best practices around using data classification for discovery, tags for governance metadata, and masking policies for enforcement. Candidates should recognize that classification becomes operationally valuable when it is connected to native governance mechanisms rather than handled as a separate reporting activity.
- A. Correct.
Correct. In Snowflake, data classification can be operationalized by associating classification outcomes with governance metadata such as tags, and then using tag-based masking to enforce masking policies consistently. This is the scalable approach when the goal is to protect newly identified sensitive columns without reviewing each object individually. It aligns classification with governance controls rather than treating classification as a standalone discovery exercise.
- B. Incorrect.
Incorrect. Secure views can help limit exposure, but they do not integrate classification results into a governance model in a scalable way. Object ownership also does not indicate sensitivity level or data classification. This option reflects a common misconception that access model design alone replaces metadata-driven governance.
- C. Incorrect.
Incorrect. Row access policies control which rows a user can see based on conditions; they do not automatically detect classified columns or mask column values. Column masking is handled by masking policies, including tag-based masking approaches. This option confuses row-level security with column-level data protection.
- D. Incorrect.
Incorrect. Exporting results to a manual spreadsheet introduces operational overhead, delay, and inconsistency. It does not satisfy the requirement to automatically protect newly discovered PII columns. This is a plausible but weak governance process that does not leverage Snowflake's native policy automation capabilities.