SnowPro Advanced: Security Engineer Question 291
Select 2Outline how Snowflake's security and governance features support regulatory compliance:A global healthcare analytics company stores patient and claims data in Snowflake and must demonstrate support for regulatory compliance during an external audit. Auditors require evidence that the company can: (1) restrict access to PHI based on business need, (2) prevent analysts from viewing sensitive values in non-production environments, and (3) produce a record of who accessed or changed protected data. The security engineer wants to use native Snowflake capabilities with minimal custom code. Which TWO features best address these requirements?
- A
Apply role-based access control with least-privilege grants, and use Dynamic Data Masking policies on PHI columns in lower environments
- B
Use Access History and Query History views to review who accessed objects and what statements were executed against protected data
- C
Create secure views only, because secure views by themselves replace the need for column-level protections and auditability
- D
Rely on Tri-Secret Secure alone, because customer-controlled key protection also enforces row- and column-level access restrictions
- E
Enable Time Travel retention on all databases, because historical table versions provide a complete compliance audit trail of user access
Show answer and explanation
Correct answers: A, B
Explanation
The best answer is to combine preventive controls with detective controls. For preventive controls, Snowflake supports regulatory compliance through role-based access control (RBAC), which enables least-privilege design, and Dynamic Data Masking, which restricts exposure of sensitive values such as PHI based on role or context. For detective controls, Snowflake provides auditing and governance visibility through usage views such as QUERY_HISTORY and ACCESS_HISTORY, which help organizations investigate access to regulated data and demonstrate oversight during audits.
This reflects Snowflake best practices for compliance-oriented architectures: use RBAC for entitlement management, apply policy-based protections such as masking for sensitive columns, and use native monitoring/account usage views for auditing. Secure views, encryption features such as Tri-Secret Secure, and Time Travel all have important roles, but they do not independently satisfy the full set of requirements in this scenario. Relevant Snowflake documentation includes topics on Access Control Overview, Dynamic Data Masking, Access History, Query History, and Security/Audit monitoring through ACCOUNT_USAGE views.
- A. Correct.
Correct. RBAC is the core Snowflake mechanism for enforcing least-privilege access based on job function, which supports compliance requirements for restricting access to regulated data. Dynamic Data Masking is a native column-level protection feature that can obfuscate sensitive values for unauthorized roles, making it well suited for allowing broader analytical access in non-production or mixed-access scenarios without exposing PHI. Together, these controls address the first two audit requirements.
- B. Correct.
Correct. Snowflake's ACCOUNT_USAGE and organization-level monitoring capabilities include Query History and Access History, which help security teams determine what statements were run and which data objects were accessed. This supports compliance and audit investigations by providing evidence of access patterns and data usage. While not every compliance framework has identical logging requirements, these native histories are specifically used to support auditing and governance use cases.
- C. Incorrect.
Incorrect. Secure views are useful for limiting exposure of underlying table definitions and can help with controlled data sharing, but they do not replace masking policies or other fine-grained protections. Secure views also do not by themselves provide a full audit trail of who accessed or changed protected data. A candidate might choose this because secure views sound like a comprehensive security control, but they are only one part of a broader governance strategy.
- D. Incorrect.
Incorrect. Tri-Secret Secure enhances encryption key control by combining Snowflake-managed keys with a customer-managed key, which can support stringent encryption and key management requirements. However, encryption key management does not enforce business-role-based visibility of rows or columns. It is not a substitute for RBAC, masking, or auditing. This option reflects the common misconception that stronger encryption alone satisfies all compliance controls.
- E. Incorrect.
Incorrect. Time Travel is designed for data recovery and historical data access within retention limits, not for auditing who accessed data. It can help recover from accidental changes or examine prior data states, but it does not provide a user activity audit trail. Someone might select this because historical retention sounds audit-related, but compliance audits for access typically require activity monitoring, not just historical data versions.