SnowPro Advanced: Security Engineer Question 413
Single answerUse Cortex functions to classify data and detect anomalies:A security engineering team at a healthcare company is reviewing a Snowflake environment that stores support tickets, claim notes, and free-text intake forms. They need to quickly identify columns likely to contain sensitive information such as personal identifiers in unstructured text, and they also want to monitor for unusual query behavior that could indicate data exfiltration. The team wants to use native Snowflake capabilities with minimal custom model development. Which approach best meets both requirements?
- A
Use Cortex functions to classify text-based content for sensitive data discovery, and use anomaly detection on account usage or access-history-derived metrics to flag abnormal query patterns.
- B
Use Dynamic Data Masking policies alone to discover sensitive columns and automatically detect anomalous user behavior in query history.
- C
Use row access policies to classify unstructured text into sensitivity labels, and use network policies to detect spikes in result-set volume.
- D
Use tags without any classification process to identify sensitive free-text fields, and use resource monitors to detect suspicious reads of protected tables.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to combine Cortex-based text analysis for sensitive data discovery with anomaly detection over operational telemetry. In Snowflake, security teams commonly use native AI functions to inspect unstructured text and support classification workflows, then apply governance controls such as tags, masking policies, and row access policies after classification. For behavioral monitoring, anomaly detection is better suited to metrics built from sources like ACCOUNT_USAGE views or access history, such as unusual query counts, result sizes, access frequency, or off-hours activity.
The key distinction is between discovery, protection, and detection:
- Discovery/classification: identify likely sensitive content in text using native AI/Cortex capabilities.
- Protection: enforce masking or access policies after data has been classified.
- Detection: identify unusual access patterns using anomaly detection against historical telemetry.
This mirrors Snowflake security best practices: use metadata and governance features such as tags and masking for enforcement, and use analytical or ML-based approaches for content inspection and anomaly identification rather than expecting policy objects alone to perform those tasks.
- A. Correct.
Correct. This aligns with the scenario and with Snowflake-native patterns. Cortex functions can be used to analyze text and help classify or extract sensitive content from unstructured or semi-structured fields with minimal custom ML work. Separately, anomaly detection is appropriate for identifying unusual access or query behavior by modeling metrics derived from views such as ACCOUNT_USAGE or access history. This combination addresses both data classification and behavioral anomaly detection using native capabilities.
- B. Incorrect.
Incorrect. Dynamic Data Masking protects data at query time after sensitive data is already identified, but it does not itself discover sensitive columns or classify free text. It also is not a behavioral analytics feature for anomaly detection in query history. A common misconception is treating masking as a discovery tool rather than a protection control.
- C. Incorrect.
Incorrect. Row access policies control which rows a role can see; they do not perform AI-based classification of unstructured text. Network policies restrict allowed client IP addresses or network rules, but they do not analyze workload telemetry to detect anomalous result volumes or query behavior. This option confuses preventive access controls with analytical detection capabilities.
- D. Incorrect.
Incorrect. Tags are metadata labels and can store sensitivity labels once classification has been performed, but tags alone do not inspect free-text content to determine whether it contains PII or PHI. Resource monitors track credit consumption and can suspend warehouses based on usage thresholds, but they are not intended to detect suspicious table reads or exfiltration behavior. This reflects a common mistake of using cost-governance features as security analytics controls.