SnowPro Advanced: Security Engineer Question 271
Single answer3.2 Implement a strategic security architecture to balance data protection and credit efficiency.A financial services company stores highly sensitive customer PII in Snowflake. The security team wants to prevent broad exposure of raw PII, while the analytics team needs to support hundreds of BI users with minimal ongoing compute cost. Most dashboards only require aggregated results by region and product, and only a small set of compliance analysts should ever see direct identifiers. Which approach BEST balances strong data protection with credit efficiency?
- A
Grant the BI role direct SELECT access to the base tables and rely on warehouse isolation so each team can query securely without affecting other workloads.
- B
Create a secure view that masks direct identifiers for general users, grant BI roles access only to the secure view, and expose aggregated reporting from that governed layer while reserving base-table access for a limited compliance role.
- C
Replicate the sensitive tables into a separate database for BI users and permanently redact the PII columns there so dashboards run faster against a second copy of the data.
- D
Use dynamic data masking on the base table for all columns and let every user query the raw transactional tables directly so no additional views need to be maintained.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to place a governed semantic/access layer between most users and the sensitive base tables. In Snowflake, secure views are commonly used to expose only approved columns and transformations, while RBAC limits raw access to only the users who truly need it. This supports the principle of least privilege and reduces accidental disclosure of sensitive data. From a cost perspective, if most consumers only need aggregated reporting, directing them to a curated layer is more efficient than allowing widespread direct access to detailed transactional tables, which can drive unnecessary compute usage. Snowflake security best practices emphasize RBAC, minimizing direct exposure of sensitive objects, and using governance features such as secure views and masking policies where appropriate. A strategic architecture should protect raw PII at the source, expose only fit-for-purpose datasets to broad audiences, and avoid unnecessary duplication of sensitive data.
- A. Incorrect.
This is incorrect. Warehouse isolation helps with workload separation and can support performance management, but it does not provide a data protection architecture by itself. Granting broad BI access directly to base tables increases the risk of unnecessary exposure of sensitive columns. It also encourages many users to query detailed transactional data when most use cases only need governed, aggregated outputs, which can increase compute consumption.
- B. Correct.
This is correct. A governed access layer using a secure view is a strong architectural choice when most consumers do not need raw PII. Exposing only the necessary columns and logic through a secure view helps enforce least privilege, and reserving base-table access for a narrow compliance role reduces exposure. Because the analytics requirement is primarily aggregated reporting, directing BI users to a curated layer avoids unnecessary scans of sensitive raw data and supports better credit efficiency than broad direct access. This aligns with Snowflake best practices around role-based access control, view-based data governance, and minimizing access to underlying sensitive objects.
- C. Incorrect.
This is incorrect. Creating an additional replicated or duplicated copy of sensitive data for BI increases storage and governance overhead and can introduce consistency and lifecycle management challenges. It may also broaden the attack surface because sensitive data exists in more places. While a redacted copy might appear convenient, it is usually less efficient and less elegant than using governed views and role-based access on a single source of truth.
- D. Incorrect.
This is incorrect. Dynamic data masking is useful, but having all users query raw transactional tables directly is not the best balance of security and cost in this scenario. Even if identifiers are masked, broad access to detailed base tables still increases the risk of exposing non-masked sensitive attributes or enabling inference from detailed records. It also causes BI workloads to repeatedly scan granular data when most users only need aggregated results, which is less credit-efficient than a curated reporting layer.