SnowPro Advanced: Security Engineer Question 197
Single answerIntegrate data classification into data governance policiesA financial services company stores customer data in Snowflake and must enforce governance policies based on data sensitivity. The security team has already run Snowflake's classification process and verified that columns such as SSN, EMAIL, and CREDIT_CARD_NUMBER have system-applied classification tags. They now want access and masking behavior to be driven consistently by those classifications across multiple schemas without manually assigning a masking policy to each sensitive column. Which approach best meets this requirement?
- A
Create a tag-based masking policy that evaluates the classification tag values and apply it to the relevant tag so columns with matching classifications inherit masking behavior automatically.
- B
Create a row access policy on each table and reference the classification results so sensitive columns are masked based on the current role.
- C
Grant SELECT on the classified columns only to a restricted role and rely on object privileges instead of masking, because classification tags cannot be used with governance policies.
- D
Use dynamic data masking by embedding CASE logic directly in every view that exposes sensitive data, because system classification tags are informational only and cannot drive policy enforcement.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use tag-based masking so that classification results can be translated into enforceable governance controls. In Snowflake, data classification helps identify sensitive columns, and tags provide a governance metadata layer. By associating masking policies with tags, organizations can reduce manual policy assignment and apply controls more consistently as classified data expands across databases and schemas. This is aligned with Snowflake best practices for scalable data governance: use classification to identify sensitivity, tags to represent governance metadata, and masking policies to enforce access rules. Row access policies address row visibility, not column masking. Manual view logic and privilege-only approaches do not meet the requirement for consistent, classification-driven enforcement.
- A. Correct.
Correct. Snowflake supports tag-based masking, which allows a masking policy to be associated with a tag rather than individually with each column. When classification tags identify sensitive data, governance can be operationalized by using tags and masking policies together so newly tagged columns can inherit masking behavior consistently. This is the scalable approach when the goal is to integrate classification into governance policies across many schemas.
- B. Incorrect.
Incorrect. Row access policies control which rows are visible, not how individual column values are masked. They are useful for filtering records by user or role, but they do not solve the requirement to mask sensitive column values based on classification across many columns.
- C. Incorrect.
Incorrect. Restricting SELECT privileges may reduce exposure, but it does not integrate classification into policy-based governance or provide conditional masking for authorized users. Also, the statement that classification tags cannot be used with governance policies is false; Snowflake supports governance patterns that combine tags with masking policies.
- D. Incorrect.
Incorrect. Implementing CASE expressions in every view is manual, hard to scale, and difficult to govern consistently. It also ignores Snowflake's native policy framework. The claim that classification tags are only informational is misleading because classifications can be used as part of a broader tagging and masking strategy to automate governance.