SnowPro Advanced: Security Engineer Question 299
Single answerSnowflake Compliance CenterA security engineering team is preparing for an internal audit and wants to use Snowflake Compliance Center to identify columns that may contain regulated data and then prioritize remediation. The team needs a solution that helps them discover sensitive data patterns across existing tables and use those findings to drive follow-up governance actions such as tagging and access review. Which approach best meets this requirement?
- A
Use Snowflake Compliance Center to run data classification across relevant databases and schemas, review the discovered sensitive data categories, and use the results to support tagging and downstream governance decisions.
- B
Use Snowflake Compliance Center to automatically encrypt only the columns it detects as sensitive, because classification in Compliance Center directly changes physical protection settings on the table.
- C
Use Snowflake Compliance Center to replace masking policies, since detected classifications are automatically enforced as runtime access controls for all users.
- D
Use Snowflake Compliance Center to scan query history and infer which users should retain access to sensitive columns, because Compliance Center is primarily an entitlement recommendation engine.
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1 because Snowflake Compliance Center is intended to improve compliance visibility by helping organizations assess their data security and privacy posture, including discovery of potentially sensitive data. In practice, security teams use classification and related metadata to identify high-risk objects, validate whether tags and controls are present, and then apply governance features such as masking policies, tag-based governance, and privilege reviews. The key exam distinction is that Compliance Center supports discovery and assessment; it does not automatically enforce masking, redesign encryption behavior, or act as a full entitlement recommendation system. This aligns with Snowflake best practices of separating data discovery/classification from enforcement controls and access governance workflows.
- A. Correct.
Correct. Compliance Center is used to help discover and assess sensitive data posture, including identifying likely sensitive data in Snowflake objects through classification-related capabilities. Those findings can then inform governance work such as applying tags, validating policy coverage, and reviewing who should have access. This matches a realistic compliance workflow: discover, assess, and remediate using governance controls.
- B. Incorrect.
Incorrect. Compliance Center does not automatically encrypt only detected sensitive columns as a result of classification. Snowflake provides encryption by default for data at rest and in transit, but classification findings are not a mechanism that directly reconfigures column-level encryption behavior. This option confuses data discovery with storage protection controls.
- C. Incorrect.
Incorrect. Compliance Center does not replace masking policies, nor do classification results become automatically enforced runtime controls on their own. Dynamic data masking and similar access protections must still be explicitly configured through Snowflake governance features such as masking policies, row access policies, and tags where appropriate. A common misconception is assuming discovery equals enforcement.
- D. Incorrect.
Incorrect. Compliance Center is not primarily an entitlement recommendation engine based on query history. While access review is a valid downstream activity after sensitive data is identified, Compliance Center's role is centered on compliance visibility and posture assessment rather than automatically inferring least-privilege access recommendations from usage patterns.