SnowPro Advanced: Security Engineer Question 412
Single answerUse Cortex functions to classify data and detect anomalies:A security engineering team wants to improve monitoring on a Snowflake table that stores customer support interactions. The table contains free-text case notes, and the team needs to do two things with minimal custom code: identify records that may contain sensitive information such as personal data, and flag unusual text patterns that could indicate misuse or unexpected content in the notes. Which approach best meets both requirements using Snowflake Cortex capabilities?
- A
Use a Cortex classification function to infer the type of sensitive information in the text and use a Cortex anomaly-detection function to identify unusual patterns or outliers in the note content or derived metrics.
- B
Create masking policies first, because Cortex functions can only analyze data after a masking policy has already been applied to every sensitive column.
- C
Use only dynamic data masking, because masking policies automatically detect and classify sensitive information in free-text columns and also identify anomalous note content.
- D
Export the data to an external SIEM for NLP analysis, because Cortex functions cannot be used to classify text data stored in Snowflake tables.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake-native Cortex capabilities for both needs: classification for identifying potentially sensitive text content and anomaly detection for surfacing unusual records or behavior. In a real security engineering workflow, classification results may feed downstream controls such as tagging, masking, or review queues, while anomaly detection can help identify suspicious changes in text patterns, spikes in unusual content, or records that differ materially from expected norms. Snowflake best practices emphasize using native governance and AI-assisted capabilities together: first analyze and classify data, then apply controls such as tags, masking policies, or monitoring based on those findings. Options that claim masking policies perform automatic discovery or that Snowflake cannot analyze text natively reflect common misconceptions.
- A. Correct.
Correct. This aligns with the intended use of Snowflake Cortex capabilities for AI-assisted analysis. A Cortex classification function can be used to classify or infer content categories in text, including helping identify sensitive information patterns in unstructured text. For unusual behavior, anomaly-detection capabilities are the appropriate choice to surface outliers or abnormal patterns in text-derived signals or related metrics. This approach keeps analysis in Snowflake and minimizes custom ML/NLP code.
- B. Incorrect.
Incorrect. Masking policies are a protection mechanism, not a prerequisite for Cortex analysis. In practice, classification can help determine what data may be sensitive before or alongside governance controls such as masking. The misconception is assuming that security controls must be applied before analysis can occur; Snowflake allows you to analyze data and then apply policies based on findings.
- C. Incorrect.
Incorrect. Dynamic data masking does not automatically discover or classify sensitive data in free-text content, and it does not perform anomaly detection. Masking policies enforce obfuscation rules at query time based on roles, tags, or conditions. They are often used after classification or tagging decisions have been made, not as a replacement for classification and anomaly detection.
- D. Incorrect.
Incorrect. Snowflake Cortex is designed to enable AI/ML-style inference directly in Snowflake, including analysis of text data. Exporting data to an external SIEM or NLP platform may be a valid architectural choice in some organizations, but it is not required here and does not best satisfy the requirement for minimal custom code using Snowflake-native capabilities.