SnowPro Advanced: Security Engineer Question 270
Single answer3.2 Implement a strategic security architecture to balance data protection and credit efficiency.A financial services company stores highly sensitive customer data in Snowflake and serves three groups: data engineers, analysts, and external auditors. The security team must ensure analysts only see masked values for PII, external auditors can access only a subset of rows for their assigned region, and data engineers can troubleshoot pipelines using the same base tables. Leadership also wants to minimize ongoing compute cost caused by security controls. Which architecture best meets the security and credit-efficiency requirements?
- A
Apply dynamic data masking policies to PII columns and row access policies to the base tables, then expose secure views only where a different column projection is required. Grant role-based access to those protected objects.
- B
Create separate physical copies of the sensitive tables for analysts, auditors, and engineers, and enforce access rules by granting each role access only to its dedicated copy.
- C
Use secure views for every consumer group and move all filtering and masking logic into the view definitions, avoiding masking policies and row access policies on the base tables.
- D
Keep unrestricted access to the base tables and require BI tools and downstream applications to implement masking and regional row filtering before presenting data to users.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake's native policy-based governance on shared base tables: dynamic data masking for sensitive columns and row access policies for row-level entitlements, with secure views used selectively when needed. This architecture is both secure and efficient because it avoids creating multiple copies of data for different audiences while enforcing controls consistently inside Snowflake. In real environments, duplicating tables for each consumer group increases storage and maintenance overhead, and delegating security to downstream tools weakens governance. Snowflake documentation and best practices emphasize centralized access control using roles, masking policies, row access policies, and secure objects where appropriate. This supports the exam objective of implementing a strategic security architecture that balances data protection with credit efficiency.
- A. Correct.
Correct. This approach centralizes security enforcement on shared base data by using masking policies for column-level protection and row access policies for row-level filtering, which is a common Snowflake best practice for consistent governance. It allows different roles to query the same protected tables without duplicating data. Secure views should be used selectively when you need to further restrict exposed columns or protect view definitions, rather than as the only mechanism for all controls. This balances strong protection with credit efficiency because it avoids maintaining multiple copies of the same data and keeps policy logic centralized.
- B. Incorrect.
Incorrect. Creating separate physical copies for each audience increases storage, data pipeline complexity, and operational overhead. It also raises the risk of policy drift and inconsistent data protection across copies. While it may seem straightforward from an access-control perspective, it is not credit-efficient or architecturally strategic compared to applying centralized Snowflake policies on shared data objects.
- C. Incorrect.
Incorrect. Secure views can be useful, but using them as the sole mechanism for all row- and column-level controls across every consumer group is typically less maintainable than attaching row access and masking policies directly to protected data. This can lead to duplicated logic across many views and make governance harder to audit and update. Also, secure views do not replace the strategic benefit of centralized policy-based controls on base tables.
- D. Incorrect.
Incorrect. Pushing masking and filtering to BI tools or applications is a common misconception. This creates inconsistent enforcement, increases the chance of accidental exposure, and weakens centralized governance. Snowflake security best practice is to enforce sensitive data controls within Snowflake itself using native features such as masking policies, row access policies, roles, and where appropriate secure views.