DEA-C02 Data Governance — 10 Questions

Question 1

Which TWO of the following are true regarding Snowflake Access History?

Accepted Answer

Access History is stored in the ACCOUNT_USAGE schema and is available for 365 days.. Access History is a critical feature for data governance, providing a granular audit trail of what data was touched and by whom. It captures both direct table accesses and accesses through views or UDFs. Understanding this feature is vital for compliance audits and data lineage tracking, allowing engineers to identify usage patterns, optimize data access, and meet strict regulatory requirements for data accountability and visibility.

Answer

Access History only records queries executed by human users.

Answer

Access History is automatically enabled for all accounts and cannot be disabled.

Answer

Access History includes the results of all queries executed.

Question 2

Which THREE of the following are requirements when using Data Governance with Snowflake's native features?

Accepted Answer

Row Access Policies must be assigned to a table or view using an ALTER statement.. Effective data governance in Snowflake requires a combination of tagging, policy management, and auditability. These features work in tandem to provide a secure and compliant environment. Understanding these requirements is essential for engineers to pass the certification, as they represent the best practices for architecting secure, scalable data platforms that meet modern enterprise security and compliance standards across various regulatory frameworks.

Answer

Tags must be created in the same database where the objects reside.

Answer

Dynamic Data Masking can only be applied to columns containing string data.

Question 3

When considering data lineage, which component is most effective for tracking the movement of data from raw landing tables to curated marts?

Accepted Answer

Access History.. Access History is the primary mechanism for tracking lineage in Snowflake. By recording the source-to-target relationships, it allows engineers to visualize how data flows through stages, views, and tables. This is critical for impact analysis, helping teams understand the downstream effects of changes to source schemas and ensuring that governance reporting remains accurate throughout the entire data pipeline lifecycle.

Answer

Query Profile.

Answer

Snowflake Object Tagging.

Answer

Result Set Caching.

Question 4

Which TWO of the following are true regarding the relationship between Tags and Masking Policies?

Accepted Answer

Tag-based masking is applied when the tag is set on a column.. The integration of tags and masking policies is a powerful governance feature that bridges the gap between data discovery and enforcement. By using tags as the trigger for masking, data engineers can ensure security is applied consistently at scale, even as the schema grows. This approach is fundamental to building a self-documenting and self-protecting data environment that satisfies strict regulatory requirements without relying on manual configuration.

Answer

Masking policies must be manually applied to every column, even if a tag is used.

Answer

A tag can have multiple masking policies associated with it.

Answer

The UNSET command must be used to remove the masking policy from a column.

Question 5

A data engineer needs to ensure that PII data in the 'EMAIL' column is obscured for all non-admin users while allowing analysts to perform aggregate counts. Which approach is most efficient and adheres to least privilege?

Accepted Answer

Apply a masking policy to the EMAIL column and grant APPLY MASKING POLICY privilege.. Dynamic Data Masking (DDM) is the optimal solution because it applies obfuscation rules at query time based on the caller's role. Unlike static masking, which requires creating physical clones of data, DDM maintains a single source of truth while ensuring sensitive information remains hidden from unauthorized users, significantly reducing storage costs and maintaining strict compliance with governance policies across the entire organization.

Answer

Create a secure view with a CASE statement masking the email column.

Answer

Use row-level security to filter rows containing emails for analysts.

Answer

Use data replication to create a separate table for analysts with masked data.

Question 6

Which THREE of the following are required to successfully implement Row-Level Security (RLS) in Snowflake?

Accepted Answer

A mapping table that defines the relationship between users and data.. Row-Level Security relies on a combination of a mapping table to define user-to-data relationships, a secure policy function to perform the row filtering, and the attachment of that policy to a table. This approach is essential for multi-tenant applications or regional data requirements where users should only see rows relevant to their department or geographic territory, ensuring data privacy at the most granular level.

Answer

A Dynamic Data Masking policy on every column.

Answer

A physical copy of the table for each user role.

Question 7

What is the primary function of the 'TAG_REFERENCES' table function in Snowflake?

Accepted Answer

To identify all objects that have a specific tag.. The TAG_REFERENCES function allows users to programmatically view which tags have been assigned to which objects. This is crucial for governance audits, as it allows administrators to verify that all sensitive data assets have been correctly tagged and to identify any orphaned or improperly labeled resources, ensuring the integrity of the overall data governance strategy across the entire Snowflake environment.

Answer

To apply tags to multiple objects at once.

Answer

To calculate the cost associated with a specific tag.

Answer

To enable tag-based access control.

Question 8

Which TWO requirements must be met before a user can successfully apply a Dynamic Masking Policy to a column in a table? (Choose two.)

Accepted Answer

The user must have the APPLY MASKING POLICY privilege on the account.. Dynamic Masking Policies are a core part of Column-level Security. To apply them, Snowflake requires specific administrative privileges to ensure that only authorized roles can alter data visibility. Understanding the relationship between object ownership and policy application is vital for maintaining a secure and functional data platform where sensitive information is protected by default.

Answer

The user must have the ACCOUNTADMIN role assigned to their current session.

Answer

The column being masked must not be part of a primary key constraint.

Answer

The table must be a permanent table rather than a transient or temporary table.

Question 9

A data engineer is using Snowflake's Data Classification feature to identify and protect sensitive information. Which THREE steps are part of the standard workflow for classifying data in Snowflake? (Choose three.)

Accepted Answer

Call the ASSOCIATE_SEMANTIC_CATEGORY_TAGS stored procedure to apply the tags.. Data Classification in Snowflake is a multi-step process designed to automate the discovery of PII. It involves analyzing the data to generate recommendations, reviewing those recommendations for accuracy, and finally applying the tags to the objects. This structured workflow ensures that automation is balanced with human oversight to maintain high data quality and security standards.

Answer

Manually create a custom XML schema to define the PII patterns for the classifier.

Answer

Configure a Snowpipe to continuously monitor the table for new PII data types.

Question 10

A data engineer needs to implement a solution where access to a column containing salary information is restricted based on the user's department. Users in the 'HR' department should see actual salaries, while all others should see a fixed value of 0. The solution must be scalable and not require changes when new departments are added. Which Snowflake feature should be used?

Accepted Answer

Dynamic Data Masking with a mapping table and a masking policy that joins to the mapping table.. Dynamic Data Masking policies can incorporate subqueries or joins to external mapping tables, allowing dynamic evaluation of the user's department at query time. This approach scales because new departments only require updates to the mapping table, not the policy itself. Row access policies and tagging do not provide column-level conditional masking.

Answer

Row Access Policy that filters rows based on the department and salary column.

Answer

Object Tagging with a tag for salary and a policy that enforces access based on the tag.

Answer

Secure Views that join to a department mapping table and conditionally display the salary column.