SnowPro Advanced: Security Engineer Question 415
Single answerApply CLASSIFY_TEXT() to identify and tag sensitive data categoriesA security engineer needs to quickly assess a newly ingested support_tickets table for sensitive free-form text before broader analyst access is granted. The table contains a TICKET_ID column and a COMMENTS column with unstructured customer messages. The engineer wants to use Snowflake’s built-in text classification capability to identify likely sensitive data categories present in the COMMENTS values and then use those results to drive a tagging workflow. Which approach best meets this requirement?
- A
Run CLASSIFY_TEXT(COMMENTS) in a query against the support_tickets table, review the returned categories for the text values, and use the results to apply appropriate tags to the column or downstream objects.
- B
Run SYSTEM$CLASSIFY('support_tickets.COMMENTS') to permanently label the COMMENTS column with built-in sensitivity tags that Snowflake automatically creates.
- C
Use CLASSIFY_TEXT() only after enabling masking policies on the COMMENTS column, because the function requires an existing governance policy before it can detect sensitive categories.
- D
Use CLASSIFY_TEXT() to encrypt the COMMENTS column in place and then map the encrypted output to tags for governance reporting.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to apply CLASSIFY_TEXT() directly to the free-form COMMENTS data, inspect the detected sensitive categories, and then use those findings in a governance workflow such as applying tags and determining whether masking or other controls are required. This matches the practical use of CLASSIFY_TEXT() for identifying sensitive data patterns in unstructured text. A key exam distinction is that classification identifies likely sensitive content, while tagging, masking, and other governance actions are separate steps. Snowflake documentation for sensitive data classification and text classification emphasizes using built-in classification capabilities to discover sensitive information, then using Snowflake governance features such as tags and masking policies to operationalize protection.
- A. Correct.
Correct. CLASSIFY_TEXT() is intended to analyze text and identify likely sensitive information categories in unstructured or free-form content. In this scenario, applying it to the COMMENTS values is the practical way to inspect customer-entered text for items such as contact details or other sensitive content. The returned classification results can then inform a tagging or remediation workflow. The function identifies categories; it does not itself apply governance tags automatically, so using its output to drive tagging is the appropriate pattern.
- B. Incorrect.
Incorrect. This describes a capability that does not exist as stated. Snowflake does not provide a SYSTEM$CLASSIFY function that permanently labels a column and automatically creates built-in sensitivity tags in this way. A candidate might choose this because Snowflake does have various SYSTEM$ functions and sensitive data discovery features, but CLASSIFY_TEXT() is the relevant built-in function for classifying text content, and tagging remains a separate governance action.
- C. Incorrect.
Incorrect. CLASSIFY_TEXT() does not require a masking policy to be in place before it can analyze text. Masking policies are a downstream control used to protect data after you determine sensitivity and access requirements. This option reflects a common misconception that discovery features depend on governance controls being preconfigured.
- D. Incorrect.
Incorrect. CLASSIFY_TEXT() classifies text; it does not encrypt column data in place. Encryption at rest is handled by Snowflake platform security, and application-level tokenization or external encryption workflows are separate design choices. This option confuses data discovery/classification with data protection mechanisms.