SnowPro Advanced: Security Engineer Question 429
Select 2Securely configure semantic modelsA retail company is rolling out a Snowflake semantic model for self-service analytics. The model maps business-friendly dimensions and metrics to underlying tables in a governed analytics schema. Some source tables contain sensitive columns such as customer email and loyalty ID, and analysts will query the model through BI tools using their own Snowflake roles. The security engineer must ensure the semantic model exposes only approved business attributes and that existing Snowflake data protections continue to be enforced when users query through the model. Which TWO actions should the engineer take?
- A
Define the semantic model to include only approved dimensions, facts, and metrics, excluding sensitive base-table columns that should not be exposed to analysts.
- B
Grant analysts direct SELECT privileges on all base tables referenced by the semantic model so the BI tool can resolve joins and calculations.
- C
Apply or retain Snowflake governance controls such as masking policies, row access policies, and object privileges on the underlying objects used by the semantic model.
- D
Create a separate copy of each protected table without masking or row access policies, and point the semantic model to those copies to improve query performance.
- E
Rely on the semantic model definition alone to block access to sensitive data, because policies on underlying tables are not evaluated when queries are generated through the model.
Show answer and explanation
Correct answers: A, C
Explanation
The best answer is to combine secure model design with Snowflake-native governance. In practice, securely configuring a semantic model means exposing only approved business entities and metrics while continuing to enforce security on the underlying data objects. Snowflake security is fundamentally enforced through roles, privileges, and governance policies such as masking policies and row access policies. A semantic layer helps standardize business meaning, but it should not be treated as the sole enforcement point for sensitive data. Following least privilege, data minimization, and centralized policy enforcement are consistent with Snowflake security best practices: restrict what is modeled, avoid unnecessary direct table access, and preserve governance on the referenced tables or views.
- A. Correct.
Correct. A secure semantic model should expose only the business concepts users are intended to analyze. If sensitive columns are not needed for analytics, they should not be modeled as dimensions, attributes, or measures. This reduces accidental disclosure and follows least-privilege and data minimization principles. Even if underlying protections exist, excluding unnecessary sensitive fields from the model is an important first layer of defense.
- B. Incorrect.
Incorrect. Granting broad direct SELECT on all base tables is not a security best practice and expands the attack surface. Access should be granted only as needed, typically through governed schemas, views, or other controlled objects. Analysts do not need unrestricted access simply because a semantic model references those tables. This option reflects the misconception that semantic-layer usability requires broad underlying table access.
- C. Correct.
Correct. The semantic model does not replace Snowflake's native security model. Existing controls on underlying objects, including object privileges, masking policies, and row access policies, should remain in place so that protection continues when queries are executed. This is essential because security enforcement occurs at the data object level, and a semantic abstraction should be aligned with those controls rather than treated as a substitute.
- D. Incorrect.
Incorrect. Creating unprotected copies of sensitive tables weakens security and introduces governance drift. It bypasses masking and row-level restrictions rather than preserving them. Although teams sometimes consider copies for performance or simplicity, doing so for protected data undermines centralized policy enforcement and increases the risk of exposure.
- E. Incorrect.
Incorrect. This is the key misconception. A semantic model is a logical business abstraction, not a replacement for Snowflake's access-control and governance mechanisms. Protections applied to underlying tables and views still matter and should be preserved. Assuming the semantic model alone is sufficient could expose data if underlying privileges or policies are too permissive.