SnowPro Advanced: Security Engineer Question 428
Single answerSecurely configure semantic modelsA retail company is exposing curated business metrics through a Snowflake semantic model so analysts can query measures such as revenue, margin, and customer counts without direct access to the underlying transactional tables. The Security Engineer must ensure that analysts only see data for regions they are authorized to view, and that sensitive columns in the base tables remain protected even if those columns are not intended to appear in the semantic model. Which approach best meets these security requirements?
- A
Grant analysts access only to the semantic model object and rely on the semantic model definition to hide unauthorized rows and sensitive columns.
- B
Apply row access policies and masking policies to the underlying tables or secure views used by the semantic model, and grant the semantic model access through roles that enforce those policies.
- C
Clone the underlying tables for each region, remove sensitive columns from each clone, and point separate semantic models to those cloned tables.
- D
Use a network policy and session policy for analyst roles, because semantic models inherit those controls and this prevents exposure of unauthorized data within queries.
Show answer and explanation
Correct answer: B
Explanation
To securely configure semantic models in Snowflake, treat the semantic model as a governed consumption layer, not as the primary enforcement point for data security. The correct approach is to secure the tables or views the semantic model depends on. Snowflake's row access policies provide row-level security, and masking policies provide column-level protection. Secure views are also commonly used to expose only approved fields and logic. This design ensures that policy enforcement remains consistent regardless of whether users access data through a semantic model, SQL, or another governed interface. Best practice is to use role-based access control together with policy-based protections on the underlying objects rather than relying on the semantic layer alone to hide data.
- A. Incorrect.
Incorrect. A semantic model is not a replacement for Snowflake's data access controls. Hiding fields in the semantic layer does not by itself enforce row-level filtering or protect sensitive base-table data from privileged access paths. Security must be enforced on the underlying data objects using Snowflake security features such as row access policies, masking policies, secure views, and appropriate role grants.
- B. Correct.
Correct. The most secure design is to enforce data protection at the underlying data layer used by the semantic model. Row access policies restrict which rows a user can see based on context such as role or mapping tables, and masking policies protect sensitive column values. When the semantic model queries those protected tables or secure views, the policies are evaluated and enforced consistently. This follows Snowflake best practice to apply governance and security controls to the data objects, not merely to the presentation layer.
- C. Incorrect.
Incorrect. Creating cloned tables per region is operationally heavy, increases governance complexity, and is not the preferred Snowflake security pattern for regional segregation. It can also introduce drift and maintenance issues. Native policy-based controls such as row access policies and masking policies are specifically designed to solve this problem in a centralized and auditable way.
- D. Incorrect.
Incorrect. Network policies and session policies can restrict where and how users connect, and can help with session controls, but they do not implement row-level authorization or column-level protection in query results. They are complementary controls, not a substitute for data access enforcement within the semantic model's underlying objects.