SnowPro Advanced: Security Engineer Question 288
Single answer3.3 Design and manage data compliance policies.A healthcare company stores patient records in Snowflake and must enforce HIPAA-aligned controls on protected health information (PHI). The security team needs a solution that ensures analysts can query clinical datasets while preventing unauthorized users from seeing raw PHI values such as patient name, SSN, and diagnosis details. They also want the controls to remain effective as new tables and columns are added by data engineering teams. Which approach best meets these requirements with the least ongoing administrative effort?
- A
Create secure views for every clinical table and manually remove PHI columns from each view before granting analyst access.
- B
Apply masking policies to PHI columns and use tag-based masking so that newly tagged sensitive columns automatically inherit the correct masking behavior based on role context.
- C
Enable Time Travel and Fail-safe on the database so that unauthorized PHI exposure can be reversed if an analyst queries sensitive data.
- D
Use network policies to restrict analyst access to the corporate network, which prevents PHI from being exposed to unauthorized users inside Snowflake.
Show answer and explanation
Correct answer: B
Explanation
For Snowflake compliance use cases, the most appropriate control for protecting sensitive column values such as PHI is masking policies. When the goal is to scale protection across many current and future objects, tag-based masking is a best-practice design because it separates data classification from direct per-column policy administration. Administrators can tag columns that contain PHI and map those tags to masking policies so that query-time protection is consistently applied. This is particularly valuable in environments with evolving schemas and decentralized data engineering teams. Secure views can help in some cases, but they require more manual maintenance and are less adaptive. Time Travel, Fail-safe, and network policies serve different security and operational purposes and do not satisfy the core requirement of preventing unauthorized viewing of raw sensitive values. See Snowflake documentation on Dynamic Data Masking, Tag-based Masking Policies, and Data Governance features for the recommended approach.
- A. Incorrect.
This is a possible workaround, but it does not best meet the requirement for scalability and low administrative overhead. Manually maintaining secure views for every table is operationally expensive and error-prone, especially as new tables and columns are added. Secure views help control exposure of underlying data definitions and can limit what users see, but they are not the most efficient compliance control for consistently protecting PHI across evolving schemas.
- B. Correct.
This is the best answer. Dynamic data masking in Snowflake is designed to protect sensitive column values from unauthorized access at query time. Using tag-based masking allows administrators to classify columns with tags such as PHI or PII and centrally associate those tags with masking policies. This improves governance and reduces ongoing effort because newly tagged columns can automatically receive the appropriate masking behavior without redefining controls for each object. Role-aware masking logic supports different visibility for different user groups, which aligns well with compliance requirements.
- C. Incorrect.
This is incorrect because Time Travel and Fail-safe are data recovery features, not preventive compliance controls. They help recover historical data or support disaster recovery scenarios, but they do not stop an analyst from viewing sensitive values during a query. Choosing this option reflects a misconception that recovery capabilities can substitute for data protection mechanisms such as masking or row access policies.
- D. Incorrect.
This is incorrect because network policies control where users can connect from, such as approved IP ranges, but they do not determine what data a user can see after connecting. Restricting access to the corporate network may improve security posture, but it does not enforce PHI masking or role-based redaction inside query results. This option confuses perimeter access control with data-level compliance enforcement.