SnowPro Advanced: Security Engineer Question 290
Select 2Outline how Snowflake's security and governance features support regulatory compliance:A healthcare analytics company stores patient and claims data in Snowflake and must demonstrate support for HIPAA and GDPR compliance during an upcoming audit. The security team needs a solution that reduces exposure of sensitive columns, restricts row-level visibility by analyst region, and provides evidence of who accessed regulated data. Which combination of Snowflake features best addresses these requirements?
- A
Apply dynamic data masking to sensitive columns, use row access policies to restrict records by region, and review ACCOUNT_USAGE/ACCESS_HISTORY for audit evidence
- B
Create separate physical tables for each analyst region, duplicate the sensitive columns into redacted tables, and rely on warehouse query history only for audit reporting
- C
Use network policies alone to limit access by corporate IP ranges and treat this as sufficient evidence of compliant data access controls and auditing
- D
Tag regulated columns and use tag-based masking policies where appropriate, combine them with row access policies, and use access history to demonstrate monitoring of data access
- E
Enable Tri-Secret Secure and conclude that column-level protection, regional data segregation, and access auditing requirements are fully covered
Show answer and explanation
Correct answers: A, D
Explanation
The best answers are 1 and 4 because Snowflake's compliance-supporting capabilities are strongest when used in combination: dynamic data masking or tag-based masking policies protect sensitive fields, row access policies enforce fine-grained restrictions on which rows a user can see, and ACCESS_HISTORY provides auditable evidence of data access. This aligns with regulatory expectations around least privilege, data minimization, and auditability. Tags further strengthen governance by identifying regulated data and enabling scalable policy application. By contrast, duplicating physical tables is harder to govern and maintain, network policies only address part of the control plane, and encryption features such as Tri-Secret Secure do not replace logical access controls or auditing. Relevant Snowflake documentation and best practices include guidance on Dynamic Data Masking, Row Access Policies, Object Tagging and Tag-Based Masking, and ACCOUNT_USAGE views such as ACCESS_HISTORY for monitoring and audit support.
- A. Correct.
Correct. Dynamic data masking helps reduce exposure of PHI/PII in sensitive columns by conditionally masking values based on role or context. Row access policies enforce fine-grained row-level restrictions, such as limiting analysts to records from their authorized region. For auditability, Snowflake provides access metadata through views such as ACCESS_HISTORY in ACCOUNT_USAGE, which is commonly used to demonstrate who queried sensitive objects and when. This combination directly addresses the scenario's three requirements: column protection, row-level restriction, and audit evidence.
- B. Incorrect.
Incorrect. Physically duplicating data into region-specific and redacted tables is operationally complex, increases governance risk, and is not the preferred Snowflake-native approach for fine-grained security. It can create synchronization problems and expand the compliance surface area. Also, warehouse query history alone is not the best source for demonstrating object- and column-level data access; ACCESS_HISTORY is more appropriate for auditing regulated data access.
- C. Incorrect.
Incorrect. Network policies are useful for restricting authentication requests from approved IP ranges, but they do not provide column masking, row-level authorization, or sufficient evidence of fine-grained data access controls. Relying on network policies alone reflects a common misconception that perimeter controls satisfy data governance requirements. Regulatory compliance generally requires layered controls and auditable evidence at the data access level.
- D. Correct.
Correct. Tags in Snowflake are governance metadata that can classify regulated data, and tag-based masking allows organizations to apply masking policies consistently across columns marked as sensitive. When combined with row access policies, this supports both scalable governance and least-privilege data access. ACCESS_HISTORY then helps provide evidence for auditors regarding access to protected data. This is a strong compliance-oriented design because it supports discoverability, consistent protection, and monitoring.
- E. Incorrect.
Incorrect. Tri-Secret Secure strengthens key management by combining a customer-managed key with Snowflake-managed encryption controls, which can support certain regulatory and internal security requirements around encryption and key control. However, it does not replace masking policies, row access policies, or audit monitoring. Encryption at rest is important, but it does not by itself satisfy the scenario's requirements for selective visibility and auditable access.