SnowPro Advanced: Security Engineer Question 326
Single answerUse Snowflake Horizon Catalog to enable security best practices and complianceA financial services company is preparing for an internal audit of regulated customer data stored in Snowflake. The security team wants a centralized way to discover sensitive data, understand where it is used, and help data stewards apply governance controls consistently across databases and schemas. They decide to use Snowflake Horizon Catalog as part of their compliance program. Which action would BEST support this goal?
- A
Use Horizon Catalog to view data classification and lineage information so stewards can identify sensitive columns and trace downstream usage before applying governance controls such as tags and masking policies.
- B
Use Horizon Catalog to automatically encrypt only columns marked as sensitive, replacing the need for Snowflake encryption and key management features.
- C
Use Horizon Catalog to enforce network policies and MFA settings for all users who access regulated tables.
- D
Use Horizon Catalog to replicate sensitive objects to a separate compliance account where governance policies are inherited automatically across accounts.
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1 because Snowflake Horizon Catalog helps organizations discover, classify, and understand their data estate, including lineage and metadata context that are critical for governance and compliance workflows. In practice, security and data governance teams use this visibility to find sensitive data, assess where it flows, and then apply appropriate controls such as tags, masking policies, row access policies, and other governance mechanisms available in Snowflake. Horizon Catalog supports security best practices by improving data awareness and stewardship rather than directly enforcing unrelated controls like MFA, network policies, or encryption behavior. Relevant Snowflake documentation and best practices emphasize Horizon Catalog for data discovery, classification, and lineage, while enforcement of access and protection controls remains the responsibility of specific Snowflake security features such as masking policies, row access policies, tags, account security settings, and built-in encryption.
- A. Correct.
Correct. Horizon Catalog is designed to improve visibility and governance by helping users discover data assets, view metadata, understand sensitivity through classification, and analyze lineage. In a compliance scenario, this supports identifying regulated data and understanding downstream impact before applying controls such as tags, masking policies, and other Snowflake governance features. This aligns with security best practices because discovery and context are prerequisites for consistent policy application.
- B. Incorrect.
Incorrect. Snowflake provides encryption for data at rest and in transit as part of the platform, but Horizon Catalog is not a feature that selectively encrypts sensitive columns or replaces Snowflake's encryption architecture. This option reflects a common misconception that catalog/governance tooling directly performs cryptographic enforcement.
- C. Incorrect.
Incorrect. Network policies and MFA are access security controls managed through account security configuration, authentication, and session/network policy settings, not through Horizon Catalog. Horizon Catalog improves visibility into data and metadata, but it is not the tool used to enforce identity or network authentication controls.
- D. Incorrect.
Incorrect. Replication and cross-account data movement are separate Snowflake capabilities. Horizon Catalog does not replicate objects for compliance purposes, nor does it automatically cause governance policies to be inherited across accounts in the manner described. This distractor mixes governance visibility with data replication and policy deployment concepts.