SnowPro Advanced: Security Engineer Question 94
Single answerGeneric stringsA security engineer is reviewing a Snowflake account after a penetration test found that developers had hard-coded credentials and API keys in SQL objects. The engineer wants to identify likely secrets stored in free-text columns across several databases without exposing the actual values to analysts who will review the findings. Which approach is the MOST appropriate for detecting these values while minimizing unnecessary exposure of the underlying sensitive strings?
- A
Use a custom data classification scan with user-defined classification functions that detect generic secret patterns (for example, API keys, tokens, and passwords), then expose only the classification tags or findings to reviewers instead of the raw column values.
- B
Create a masking policy that replaces every VARCHAR column with NULL and ask analysts to inspect query history to determine which columns probably contain secrets.
- C
Enable Tri-Secret Secure so Snowflake automatically identifies generic strings such as credentials and annotates them as secrets across all databases.
- D
Use row access policies on the affected tables because row-level filtering is designed to detect and classify generic secret strings before users query the data.
Show answer and explanation
Correct answer: A
Explanation
This scenario is about discovering sensitive values embedded in generic strings, not merely restricting access after the fact. In Snowflake, the practical security pattern is to use sensitive data discovery/classification capabilities, including custom classification logic where needed, to identify columns containing secret-like patterns in free-text data. After discovery, organizations typically apply tags, governance workflows, masking, or remediation processes while limiting raw-value exposure to only privileged users.
The key distinction is between: (1) discovery/classification of sensitive content, and (2) enforcement controls such as masking policies or row access policies. Masking and row access are valuable, but they do not natively scan data to find secrets. Likewise, encryption features such as Tri-Secret Secure protect stored data cryptographically but do not inspect content semantics.
This aligns with Snowflake security best practices: use automated sensitive data discovery/classification for identification, and then apply access-control and protection mechanisms based on those findings.
- A. Correct.
Correct. For broad free-text discovery of likely secrets, the best fit is a classification-based approach that uses user-defined classification capabilities to identify patterns in generic strings, such as tokens, passwords, or API keys. This allows the organization to flag columns or findings for remediation without broadly exposing the underlying text to reviewers. In practice, security teams pair discovery/classification with governance controls so analysts can review metadata, tags, or reports rather than raw sensitive content.
- B. Incorrect.
Incorrect. Masking policies protect data at query time, but they do not perform discovery or classification of which columns contain secrets. Replacing every VARCHAR with NULL is also operationally disruptive and does not help systematically identify where sensitive generic strings exist. Query history is not a reliable discovery mechanism for scanning stored data values.
- C. Incorrect.
Incorrect. Tri-Secret Secure is related to encryption key management and protection of data at rest through a customer-managed key in addition to Snowflake-managed keys. It does not classify data contents or detect generic secret strings such as passwords or API keys.
- D. Incorrect.
Incorrect. Row access policies control which rows a role can see based on policy logic. They are not a content-scanning or data-classification feature and do not inspect free-text values to determine whether they resemble secrets.