DEA-C02 Data Governance — 15 Questions

Question 1

Which TWO of the following are true regarding Snowflake Access History?

Accepted Answer

Access History is stored in the ACCOUNT_USAGE schema and is available for 365 days.. Access History is a critical feature for data governance, providing a granular audit trail of what data was touched and by whom. It captures both direct table accesses and accesses through views or UDFs. Understanding this feature is vital for compliance audits and data lineage tracking, allowing engineers to identify usage patterns, optimize data access, and meet strict regulatory requirements for data accountability and visibility.

Answer

Access History only records queries executed by human users.

Answer

Access History is automatically enabled for all accounts and cannot be disabled.

Answer

Access History includes the results of all queries executed.

Question 2

Which THREE of the following are requirements when using Data Governance with Snowflake's native features?

Accepted Answer

Row Access Policies must be assigned to a table or view using an ALTER statement.. Effective data governance in Snowflake requires a combination of tagging, policy management, and auditability. These features work in tandem to provide a secure and compliant environment. Understanding these requirements is essential for engineers to pass the certification, as they represent the best practices for architecting secure, scalable data platforms that meet modern enterprise security and compliance standards across various regulatory frameworks.

Answer

Tags must be created in the same database where the objects reside.

Answer

Dynamic Data Masking can only be applied to columns containing string data.

Question 3

When considering data lineage, which component is most effective for tracking the movement of data from raw landing tables to curated marts?

Accepted Answer

Access History.. Access History is the primary mechanism for tracking lineage in Snowflake. By recording the source-to-target relationships, it allows engineers to visualize how data flows through stages, views, and tables. This is critical for impact analysis, helping teams understand the downstream effects of changes to source schemas and ensuring that governance reporting remains accurate throughout the entire data pipeline lifecycle.

Answer

Query Profile.

Answer

Snowflake Object Tagging.

Answer

Result Set Caching.

Question 4

Which TWO of the following are true regarding the relationship between Tags and Masking Policies?

Accepted Answer

Tag-based masking is applied when the tag is set on a column.. The integration of tags and masking policies is a powerful governance feature that bridges the gap between data discovery and enforcement. By using tags as the trigger for masking, data engineers can ensure security is applied consistently at scale, even as the schema grows. This approach is fundamental to building a self-documenting and self-protecting data environment that satisfies strict regulatory requirements without relying on manual configuration.

Answer

Masking policies must be manually applied to every column, even if a tag is used.

Answer

A tag can have multiple masking policies associated with it.

Answer

The UNSET command must be used to remove the masking policy from a column.

Question 5

A data engineer needs to ensure that PII data in the 'EMAIL' column is obscured for all non-admin users while allowing analysts to perform aggregate counts. Which approach is most efficient and adheres to least privilege?

Accepted Answer

Apply a masking policy to the EMAIL column and grant APPLY MASKING POLICY privilege.. Dynamic Data Masking (DDM) is the optimal solution because it applies obfuscation rules at query time based on the caller's role. Unlike static masking, which requires creating physical clones of data, DDM maintains a single source of truth while ensuring sensitive information remains hidden from unauthorized users, significantly reducing storage costs and maintaining strict compliance with governance policies across the entire organization.

Answer

Create a secure view with a CASE statement masking the email column.

Answer

Use row-level security to filter rows containing emails for analysts.

Answer

Use data replication to create a separate table for analysts with masked data.

Question 6

Which THREE of the following are required to successfully implement Row-Level Security (RLS) in Snowflake?

Accepted Answer

A mapping table that defines the relationship between users and data.. Row-Level Security relies on a combination of a mapping table to define user-to-data relationships, a secure policy function to perform the row filtering, and the attachment of that policy to a table. This approach is essential for multi-tenant applications or regional data requirements where users should only see rows relevant to their department or geographic territory, ensuring data privacy at the most granular level.

Answer

A Dynamic Data Masking policy on every column.

Answer

A physical copy of the table for each user role.

Question 7

What is the primary function of the 'TAG_REFERENCES' table function in Snowflake?

Accepted Answer

To identify all objects that have a specific tag.. The TAG_REFERENCES function allows users to programmatically view which tags have been assigned to which objects. This is crucial for governance audits, as it allows administrators to verify that all sensitive data assets have been correctly tagged and to identify any orphaned or improperly labeled resources, ensuring the integrity of the overall data governance strategy across the entire Snowflake environment.

Answer

To apply tags to multiple objects at once.

Answer

To calculate the cost associated with a specific tag.

Answer

To enable tag-based access control.

Question 8

Which TWO requirements must be met before a user can successfully apply a Dynamic Masking Policy to a column in a table? (Choose two.)

Accepted Answer

The user must have the APPLY MASKING POLICY privilege on the account.. Dynamic Masking Policies are a core part of Column-level Security. To apply them, Snowflake requires specific administrative privileges to ensure that only authorized roles can alter data visibility. Understanding the relationship between object ownership and policy application is vital for maintaining a secure and functional data platform where sensitive information is protected by default.

Answer

The user must have the ACCOUNTADMIN role assigned to their current session.

Answer

The column being masked must not be part of a primary key constraint.

Answer

The table must be a permanent table rather than a transient or temporary table.

Question 9

A data engineer is using Snowflake's Data Classification feature to identify and protect sensitive information. Which THREE steps are part of the standard workflow for classifying data in Snowflake? (Choose three.)

Accepted Answer

Call the ASSOCIATE_SEMANTIC_CATEGORY_TAGS stored procedure to apply the tags.. Data Classification in Snowflake is a multi-step process designed to automate the discovery of PII. It involves analyzing the data to generate recommendations, reviewing those recommendations for accuracy, and finally applying the tags to the objects. This structured workflow ensures that automation is balanced with human oversight to maintain high data quality and security standards.

Answer

Manually create a custom XML schema to define the PII patterns for the classifier.

Answer

Configure a Snowpipe to continuously monitor the table for new PII data types.

Question 10

A data engineer needs to implement a solution where access to a column containing salary information is restricted based on the user's department. Users in the 'HR' department should see actual salaries, while all others should see a fixed value of 0. The solution must be scalable and not require changes when new departments are added. Which Snowflake feature should be used?

Accepted Answer

Dynamic Data Masking with a mapping table and a masking policy that joins to the mapping table.. Dynamic Data Masking policies can incorporate subqueries or joins to external mapping tables, allowing dynamic evaluation of the user's department at query time. This approach scales because new departments only require updates to the mapping table, not the policy itself. Row access policies and tagging do not provide column-level conditional masking.

Answer

Row Access Policy that filters rows based on the department and salary column.

Answer

Object Tagging with a tag for salary and a policy that enforces access based on the tag.

Answer

Secure Views that join to a department mapping table and conditionally display the salary column.

Question 11

A data engineer needs to ensure that a row access policy on a table enforces that users from the 'HR' department can only see rows where the 'DEPARTMENT' column equals 'HR'. The policy uses a mapping table that is updated frequently. The engineer wants to minimize performance impact and ensure the policy is applied correctly. Which approach should the engineer take?

Accepted Answer

Use a mapping table and join it in the row access policy, ensuring the mapping table is small and clustered on the join key.. Using a mapping table joined in the row access policy is the most efficient and maintainable approach. It allows dynamic updates without policy changes and, when the mapping table is small and clustered, minimizes performance overhead.

Answer

Use a subquery in the row access policy to join the mapping table on the fly.

Answer

Create a secure function that queries the mapping table and use it in the row access policy.

Answer

Embed the mapping logic directly in the policy using a CASE statement with hardcoded values.

Question 12

A data engineer needs to ensure that a row access policy on the SALES table filters rows based on the region of the querying user, but the policy must not filter rows for users with the ACCOUNTADMIN role. The engineer creates a mapping table that maps roles to regions. Which approach correctly implements this requirement?

Accepted Answer

Create a row access policy that returns TRUE for ACCOUNTADMIN and otherwise joins the mapping table on CURRENT_ROLE().. Row access policies are evaluated in the context of the querying role. To exempt ACCOUNTADMIN, the policy must explicitly return TRUE when CURRENT_ROLE() is ACCOUNTADMIN. For other roles, the policy should join a mapping table on CURRENT_ROLE() to determine the allowed region. Using CURRENT_USER() is incorrect because it returns the user name, not the role. Secure views do not prevent direct table access by ACCOUNTADMIN.

Answer

Create a secure view that filters rows based on CURRENT_ROLE() and grant it to all roles except ACCOUNTADMIN.

Answer

Create a row access policy that uses CURRENT_USER() to look up the role in the mapping table and returns the region match.

Answer

Create a row access policy that uses IS_ROLE_IN_SESSION('ACCOUNTADMIN') to bypass filtering and otherwise uses CURRENT_ROLE() with the mapping table.

Question 13

A data engineer is implementing a data governance strategy in Snowflake and needs to ensure that sensitive data is properly protected and auditable. The engineer plans to use a combination of Snowflake features. Which two of the following are required to enable tag-based masking policies? (Choose two.)

Accepted Answer

The column to be masked must have the tag applied to it.. Tag-based masking requires creating a tag and assigning a masking policy to it, then applying that tag to the columns to be masked. These two steps are essential for the feature to enforce masking based on the tag.

Answer

The tag must be a system tag provided by Snowflake.

Answer

The masking policy must be created with the data type matching the column.

Answer

The user must have the APPLY MASKING POLICY privilege on the account.

Question 14

A financial institution stores transaction data in a Snowflake table that includes a column 'ACCOUNT_NUMBER'. The data engineering team wants to prevent analysts from seeing the full account number, but analysts must still be able to join on this column. The security team requires that the masking be applied automatically based on the analyst's role, without modifying existing queries. Which Snowflake feature should be used?

Accepted Answer

Create a masking policy and apply it to the ACCOUNT_NUMBER column, then grant the analysts a role that is not exempt from the policy.. A masking policy applied directly to the ACCOUNT_NUMBER column will automatically mask the data for any role that is not exempt, while still allowing analysts to use the column in joins. This satisfies the requirement to prevent viewing the full account number without altering existing queries or restricting row-level access. The other options either remove the column, filter rows, or introduce unnecessary complexity.

Answer

Create a dynamic data masking policy using the TAG_BASED_MASKING_POLICY function and assign tags to the column.

Answer

Use a secure view that excludes the ACCOUNT_NUMBER column and grant analysts access to the view instead of the table.

Answer

Implement a row access policy that filters out rows where the analyst does not own the account.

Question 15

A data engineer is configuring a masking policy on a column that contains phone numbers. The policy should show the full phone number only to users with the role PII_READER and otherwise show a partially masked value. Which masking policy expression correctly implements this?

Accepted Answer

CASE WHEN CURRENT_ROLE() = 'PII_READER' THEN val ELSE '***-***-****' END. Masking policies use conditional expressions to determine whether to return the original value or a masked value. The condition should check the active role using CURRENT_ROLE(). Using CURRENT_USER() is incorrect because it checks the user name, not the role. IS_ROLE_IN_SESSION is broader and may grant access when the role is not active. Adding ACCOUNTADMIN would exceed the requirement.

Answer

CASE WHEN IS_ROLE_IN_SESSION('PII_READER') THEN val ELSE '***-***-****' END

Answer

CASE WHEN CURRENT_ROLE() IN ('PII_READER', 'ACCOUNTADMIN') THEN val ELSE '***-***-****' END

Answer

CASE WHEN CURRENT_USER() = 'PII_READER' THEN val ELSE '***-***-****' END