SnowPro Advanced: Security Engineer Question 278
Single answerOperational-overhead implicationsA global financial services company runs hundreds of Snowflake databases across multiple business units. The security team must let application service accounts decrypt sensitive columns, while ensuring Snowflake administrators cannot view plaintext. The current design uses Tri-Secret Secure and customer-managed keys at the account level, but auditors note that application teams still want finer-grained control over who can decrypt specific fields. The CISO asks for a solution that minimizes ongoing operational overhead for key rotation, policy maintenance, and application changes while preserving centralized governance. Which approach should the security engineer recommend?
- A
Implement external tokenization for all sensitive fields so every application team manages its own detokenization service and keys outside Snowflake
- B
Use column-level security with masking policies only, because masking policies eliminate the need for any key lifecycle management
- C
Implement client-side encryption for each sensitive column in every application, with each team rotating and distributing its own encryption keys
- D
Use Snowflake's SQL functions with an external function integration to a centralized cloud key management or secrets service for decrypt operations, combined with masking or role-based controls to govern who can invoke decryption
Show answer and explanation
Correct answer: D
Explanation
The key issue is operational overhead, not just raw security strength. Tri-Secret Secure and customer-managed keys protect data at rest at the account level, but they do not provide field-level business logic for deciding which users or services can decrypt particular columns. For that requirement, teams often compare client-side encryption, tokenization, masking, and externalized decryption services.
From an operational perspective, per-application client-side encryption and decentralized tokenization create substantial lifecycle burden: key rotation, service maintenance, integration testing, and inconsistent controls. Masking policies are valuable for role-based redaction and centralized governance, but they do not replace cryptographic decryption workflows or key management.
The most balanced recommendation is to centralize sensitive decryption logic through Snowflake integrations such as external functions that call a governed external service backed by a cloud KMS or secrets platform, then control invocation using Snowflake roles and policies. This reduces duplicated engineering effort and concentrates key operations in one managed place. In Snowflake best practices, security engineers should prefer centralized, policy-driven controls where possible and avoid designs that multiply key and application maintenance across teams. Relevant Snowflake concepts include Tri-Secret Secure, masking policies, external functions, and the distinction between encryption-at-rest controls versus query-time access controls.
- A. Incorrect.
Incorrect. External tokenization can protect data, but pushing detokenization services and key ownership to every application team significantly increases operational overhead. Each team must manage service availability, key rotation, integration patterns, and audit controls. This conflicts with the requirement to minimize ongoing overhead and preserve centralized governance.
- B. Incorrect.
Incorrect. Masking policies are useful for dynamic data protection and centralized governance, but they do not themselves perform cryptographic key management or true decryption. They can control visibility, yet they do not replace encryption key lifecycle processes. Choosing masking alone reflects a common misconception that obfuscation and encryption solve the same problem.
- C. Incorrect.
Incorrect. Client-side encryption can ensure Snowflake never sees plaintext or keys, but implementing it per application and per sensitive field creates high operational overhead. Application teams must handle encryption libraries, key distribution, rotation, backward compatibility, and testing. This approach also increases the risk of inconsistent implementations across business units.
- D. Correct.
Correct. A centralized pattern using Snowflake SQL in combination with external functions to call a managed external service for decryption can reduce operational overhead compared to per-application cryptography. Central security teams can govern access using roles, policies, and controlled function invocation, while cloud-native key or secrets platforms handle rotation and lifecycle management. This aligns with the requirement for centralized governance and reduced application changes, while still allowing finer-grained control than account-level encryption such as Tri-Secret Secure.