SnowPro Advanced: Security Engineer Question 414
Single answerApply CLASSIFY_TEXT() to identify and tag sensitive data categoriesA security engineer is reviewing a free-text column named NOTES in a customer support table. The company wants to identify whether analysts have entered sensitive information such as personal identifiers into this unstructured text, and then use the result to drive downstream governance decisions. The engineer wants the most direct Snowflake-native approach to detect sensitive categories from the text values before applying tags. Which action should the engineer take?
- A
Run CLASSIFY_TEXT() against the NOTES column values to detect sensitive categories in the text, then map the returned categories to the organization’s governance tags.
- B
Run EXTRACT_SEMANTIC_CATEGORIES on the NOTES column because it is the required function for detecting sensitive information in unstructured text before tags can be assigned.
- C
Create a masking policy on the NOTES column first, because CLASSIFY_TEXT() can only evaluate data that is already protected by a masking policy.
- D
Use SYSTEM$CLASSIFY on the entire table, because CLASSIFY_TEXT() is only intended for structured columns such as EMAIL or PHONE_NUMBER and not for free-form text.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use CLASSIFY_TEXT() on the free-text NOTES values. This function is intended to identify sensitive data categories within unstructured text, making it appropriate for scenarios such as support notes, comments, transcripts, or other manually entered text fields. After classification, organizations can map findings to governance tags and use those tags to support masking, auditing, or remediation processes. A key best practice is to separate discovery from enforcement: first identify what sensitive information exists, then apply tags and downstream controls based on the classification results. This aligns with Snowflake’s data governance approach, where classification informs tagging and policy application rather than requiring those controls to exist in advance.
- A. Correct.
Correct. CLASSIFY_TEXT() is designed to analyze unstructured or free-form text and identify sensitive data categories present in the text. In this scenario, the NOTES column contains analyst-entered text, so applying CLASSIFY_TEXT() to the column values is the most direct method to detect sensitive content. Once categories are identified, the organization can use that output to support tagging, review workflows, or downstream protection controls. This matches a practical governance pattern: detect first, then apply tags and policies based on the findings.
- B. Incorrect.
Incorrect. This option references a function name that is not the correct Snowflake-native method for this use case. The exam objective specifically focuses on applying CLASSIFY_TEXT() to identify sensitive data categories in text. A candidate might choose this option if they confuse semantic analysis concepts with Snowflake’s documented sensitive-data classification capability, but for free-text sensitive-data detection, CLASSIFY_TEXT() is the intended feature.
- C. Incorrect.
Incorrect. A masking policy is not a prerequisite for using CLASSIFY_TEXT(). Classification and protection are separate steps in Snowflake governance workflows. You can first analyze text with CLASSIFY_TEXT() to determine whether sensitive content exists, and then decide whether to apply tags, masking policies, or other controls. This distractor reflects the misconception that data must already be governed before it can be classified.
- D. Incorrect.
Incorrect. SYSTEM$CLASSIFY is associated with automated sensitive data classification workflows at the object level, but this option is wrong because it claims CLASSIFY_TEXT() is not for free-form text. In fact, CLASSIFY_TEXT() is specifically used to identify sensitive categories in text content. Someone might pick this if they overgeneralize object-level classification functions and overlook the text-focused purpose of CLASSIFY_TEXT().