SnowPro Advanced: Security Engineer Question 292
Select 3Explain how encryption, access controls, masking, and auditing support regulatory requirements (for example, GDPR, HIPAA, CCPA, and PCI DSS)A healthcare analytics company stores patient billing and treatment data in Snowflake. The company must support HIPAA for protected health information (PHI) and PCI DSS for payment card data. Analysts need access to de-identified records for reporting, while a small claims team must view full values for approved business processes. The security engineer must implement controls that reduce exposure of sensitive data and also provide evidence during audits that access to sensitive information is governed and traceable. Which THREE actions best satisfy these requirements in Snowflake?
- A
Apply dynamic data masking policies to PHI and card-related columns so unauthorized roles see masked values, while approved roles can see cleartext when policy conditions are met.
- B
Rely on Snowflake's automatic encryption at rest and in transit as the primary control for analysts, because encrypted data does not need additional role-based restrictions or masking.
- C
Use least-privilege RBAC by granting access to sensitive tables and views only to required roles, and separate analyst roles from claims-processing roles.
- D
Enable and review Snowflake access history and query history to provide an audit trail of who accessed sensitive objects and when, supporting compliance investigations and evidence requests.
- E
Create a secure view that permanently removes all PHI columns for every user, including the claims team, because regulated data should never be exposed inside Snowflake.
Show answer and explanation
Correct answers: A, C, D
Explanation
The best answer is to combine masking, least-privilege access controls, and auditing: options 1, 3, and 4. In Snowflake, encryption at rest and in transit helps meet baseline confidentiality expectations, but it does not replace access governance for users who can query data. For regulated workloads, organizations typically layer controls: encryption protects stored and transmitted data, RBAC restricts who can reach sensitive objects, masking limits exposure of specific sensitive columns, and auditing provides traceability and evidence.
This layered approach aligns with common regulatory themes across HIPAA, PCI DSS, GDPR, and CCPA: restrict access to authorized personnel, minimize unnecessary exposure, and maintain records of access and use. In Snowflake, relevant best practices include using RBAC with least privilege, applying dynamic data masking policies to sensitive columns, and monitoring access through ACCOUNT_USAGE views and ACCESS_HISTORY where available. Snowflake documentation on data protection, dynamic data masking, access control, and governance/auditing supports these practices. The scenario specifically requires both operational access for a privileged team and de-identified analytics for broader users, making masking plus RBAC the most practical design, with auditing to prove compliance and support investigations.
- A. Correct.
Correct. Dynamic data masking is designed to limit exposure of sensitive fields such as PHI, PAN-related values, or other regulated attributes based on the querying role or other context. This supports data minimization and need-to-know access patterns commonly required under HIPAA, PCI DSS, GDPR, and CCPA. It allows analysts to work with de-identified or masked data while still permitting explicitly authorized users, such as a claims team, to view unmasked values when justified.
- B. Incorrect.
Incorrect. Snowflake does provide encryption in transit and at rest by default, which is important for protecting data confidentiality and supporting regulatory expectations. However, encryption alone does not enforce least privilege at query time and does not satisfy the need to limit analyst visibility to de-identified values. Users with table access can still see sensitive cleartext unless additional controls such as RBAC, masking, row access policies, or tokenization outside Snowflake are used where appropriate.
- C. Correct.
Correct. Role-based access control is a core Snowflake security mechanism and is essential for implementing least privilege. Separating analyst roles from claims-processing roles reduces unnecessary access to regulated data and supports compliance requirements around limiting access to the minimum necessary set of users. This is especially relevant to HIPAA's minimum necessary principle and PCI DSS requirements to restrict access by business need to know.
- D. Correct.
Correct. Auditing is necessary not just to protect data, but to demonstrate control effectiveness. Snowflake's account usage views and access history capabilities can help identify which users or roles accessed sensitive objects and when. This supports internal reviews, incident response, and external compliance evidence requests. Query history alone may not show full object-level lineage in all cases, so using access history for governance visibility is especially valuable.
- E. Incorrect.
Incorrect. A secure view can be useful to limit exposure, but this option is too restrictive for the stated business requirement because the claims team legitimately needs access to full values for approved workflows. Also, secure views are not a substitute for a broader access strategy. The misconception is that compliance means eliminating all access, when in practice it means controlling and documenting justified access.