SnowPro Advanced: Security Engineer Question 293
Select 3Explain how encryption, access controls, masking, and auditing support regulatory requirements (for example, GDPR, HIPAA, CCPA, and PCI DSS)A healthcare analytics company stores patient billing data and partial payment card data in Snowflake. The security team must strengthen controls to better support HIPAA and PCI DSS requirements during an upcoming audit. Analysts should be able to query trends, but only a small compliance team should see full identifiers. The auditors also want evidence showing who accessed sensitive data and confirmation that data is protected at rest. Which THREE actions best address these requirements in Snowflake?
- A
Apply dynamic data masking policies to columns such as patient identifiers and card data so non-privileged roles see masked values while approved roles can view clear text.
- B
Rely on Snowflake's automatic encryption for data at rest and in transit, and use Snowflake access history/account usage views to provide audit evidence of access to sensitive objects.
- C
Grant the ANALYST role OWNERSHIP on the billing schema so analysts can troubleshoot access issues without involving the compliance team.
- D
Use role-based access control to restrict SELECT on sensitive tables/views to only required roles, following least privilege.
- E
Create a network policy by itself to satisfy PCI DSS and HIPAA requirements for column-level protection of card and patient data.
Show answer and explanation
Correct answers: A, B, D
Explanation
The best answer combines multiple Snowflake controls because regulatory compliance is achieved through layered safeguards, not a single feature. Snowflake's built-in encryption protects data at rest and in transit. RBAC enforces least-privilege access to tables and views. Dynamic data masking reduces exposure of sensitive columns to non-approved users while still enabling analytical workloads. Auditing through SNOWFLAKE.ACCOUNT_USAGE views and Access History helps demonstrate who accessed sensitive data, which is essential for compliance evidence and investigations. This aligns with Snowflake security best practices and documentation on data encryption, access control, masking policies, and auditing/account usage. Network restrictions can strengthen a posture, but they are not a substitute for authorization, masking, or auditability. Likewise, granting broad administrative privileges such as OWNERSHIP to analyst roles conflicts with separation of duties and least privilege expected in regulated environments.
- A. Correct.
Correct. Dynamic data masking is a Snowflake-native control for limiting exposure of sensitive fields based on the querying role or context. This supports regulatory goals such as minimum necessary access under HIPAA and limiting exposure of personal data under PCI DSS and privacy regulations. It allows analysts to continue working with datasets while preventing broad access to full identifiers.
- B. Correct.
Correct. Snowflake encrypts data in transit and at rest by default, which helps address core protection requirements expected by frameworks such as HIPAA and PCI DSS. For auditing, Snowflake provides account usage and access history capabilities that can help demonstrate who queried or accessed sensitive data objects. This combination directly supports the auditor's request for both protection and evidence.
- C. Incorrect.
Incorrect. Granting OWNERSHIP is excessive and violates least-privilege principles. OWNERSHIP is the highest privilege on an object and would allow analysts to transfer ownership, alter objects, and manage grants. That increases risk rather than supporting regulated access control requirements.
- D. Correct.
Correct. Restricting access with RBAC is a foundational Snowflake security practice. Limiting SELECT access to only the roles that require it supports least privilege and separation of duties, which are important expectations across HIPAA, PCI DSS, GDPR, and CCPA-oriented control programs. RBAC should be used together with masking where some users need partial access.
- E. Incorrect.
Incorrect. Network policies can restrict where users connect from, which is useful as a supplemental control, but they do not provide column-level protection or replace masking and object-level authorization. They do not by themselves satisfy the need to prevent most users from seeing sensitive fields.