SnowPro Advanced: Security Engineer Question 289
Select 23.3 Design and manage data compliance policies.A healthcare analytics company stores patient records in Snowflake and must meet two compliance requirements: (1) analysts should only see masked values for columns containing PHI unless they are explicitly authorized, and (2) records for patients from the EU must be retained for 7 years and then removed in a controlled, auditable manner. The security engineer wants a design that is centrally managed and scalable across many tables. Which TWO actions best satisfy these requirements?
- A
Create a tag for PHI classification, associate a masking policy with the tag, and apply the tag to sensitive columns so masking is enforced consistently based on the querying role.
- B
Use a row access policy to mask PHI columns for unauthorized users, and use Time Travel retention to automatically delete EU patient records after 7 years.
- C
Define a projection policy on PHI columns to restrict which roles can query them, and configure Fail-safe to purge EU patient data after the retention period.
- D
Implement a stream and scheduled task (or equivalent orchestration) to identify EU patient records older than 7 years and delete them, while relying on Snowflake access history and query history for auditability.
- E
Encrypt PHI columns with Tri-Secret Secure and then grant analysts access to the encrypted columns, because encryption alone satisfies masking and retention compliance requirements.
Show answer and explanation
Correct answers: A, D
Explanation
The best design combines Snowflake's centralized policy-based governance for data visibility with operational processes for lifecycle enforcement. For requirement (1), dynamic data masking is the appropriate control for showing masked PHI to unauthorized users while allowing authorized roles to see unmasked values. Using tag-based masking scales especially well because administrators can classify columns with a tag and bind a masking policy to that tag, reducing manual per-column policy management. For requirement (2), Snowflake does not provide a native row-level retention policy that automatically deletes records after a 7-year business rule. Instead, organizations typically implement scheduled deletion logic with tasks or external orchestration and rely on Snowflake metadata such as QUERY_HISTORY and ACCESS_HISTORY for audit support. Key Snowflake documentation areas relevant here include Dynamic Data Masking, Tag-based Masking Policies, Row Access Policies, Time Travel and Fail-safe, and Tasks/Streams. A common exam trap is confusing row filtering with column masking, or assuming Time Travel/Fail-safe are compliance retention engines rather than recovery features.
- A. Correct.
Correct. Tag-based masking is a scalable Snowflake design for compliance. A tag can classify PHI columns, and a masking policy can be associated with that tag so the policy is inherited by tagged columns across many tables. The masking policy can evaluate the current role or context to reveal cleartext only to authorized users and masked values to others. This is a central-management approach aligned with Snowflake best practices for broad, policy-driven governance.
- B. Incorrect.
Incorrect. A row access policy controls which rows are visible, not how individual column values are masked. Dynamic data masking is implemented with masking policies, not row access policies. In addition, Time Travel does not function as a compliance retention-and-delete scheduler for specific records after 7 years. Time Travel provides historical access to changed or deleted data for a configured retention period, which is much shorter and serves recovery/audit use cases, not record lifecycle deletion after multi-year business retention requirements.
- C. Incorrect.
Incorrect. Projection policies are not the mechanism used in Snowflake to perform dynamic masking of sensitive values for unauthorized users. Also, Fail-safe is a Snowflake disaster recovery feature managed by Snowflake after Time Travel expires; it is not a customer-controlled data retention or purge workflow for business compliance. Using Fail-safe as a retention-deletion mechanism is a common misconception.
- D. Correct.
Correct. Snowflake does not provide a built-in policy that automatically deletes individual rows after a business retention period such as 7 years. A practical pattern is to identify records meeting the retention threshold and delete them using scheduled automation, such as tasks, often with streams or other orchestration where appropriate. Auditability can be supported through query history, access history, and change management around the task/job. This satisfies the requirement for controlled, auditable removal of expired EU records.
- E. Incorrect.
Incorrect. Encryption at rest, including features such as Tri-Secret Secure, protects data storage keys and strengthens control over encryption, but it does not replace dynamic masking for limiting what analysts see in query results. It also does not implement record retention or deletion workflows. This option confuses infrastructure-level encryption controls with application/query-level compliance controls.