DEA-C02 Data Governance Practice Test 3 — 15 Questions

Question 1

Which governance tool allows an administrator to audit who accessed a specific table and when?

Accepted Answer

ACCESS_HISTORY.. The ACCESS_HISTORY view within the SNOWFLAKE.ACCOUNT_USAGE schema is the definitive source for auditing data access. It captures comprehensive details, including the query ID, the user, the objects queried, and the columns accessed. This level of granularity is essential for compliance reporting and security monitoring, enabling administrators to identify potential data breaches or unauthorized access patterns across the entire account.

Answer

QUERY_HISTORY.

Answer

OBJECT_DEPENDENCIES.

Answer

The Security Dashboard.

Question 2

Which approach is most effective for managing governance policies across a large, multi-schema data warehouse environment?

Accepted Answer

Deploy policies to a centralized database and schema.. Centralizing governance objects in a dedicated 'GOVERNANCE' database is the best practice. By keeping policies, tags, and data classification results in a single, well-controlled schema, organizations ensure consistency and ease of maintenance. This centralized approach simplifies access control for the security team and allows for easier auditing of policy changes compared to scattering governance artifacts across disparate, business-specific databases or schemas.

Answer

Create policies within each individual schema.

Answer

Use a single shared role for all policy management.

Answer

Manually recreate all policies in every environment.

Question 3

What is the primary purpose of the 'SNOWFLAKE.ACCOUNT_USAGE' schema in a governance context?

Accepted Answer

To provide audit-ready metadata on system and user activity.. The ACCOUNT_USAGE schema provides historical metadata about account activity, which is the backbone of governance and auditing. It allows organizations to query past actions to ensure compliance with internal security policies, track data usage, and identify potential risks. Without these views, administrators would lack the necessary visibility to satisfy external regulatory requirements like SOC2 or GDPR, which demand detailed accountability for data access.

Answer

To store backup copies of sensitive data.

Answer

To manage the deployment of data masking policies.

Answer

To increase the performance of analytical queries.

Question 4

An organization wants to track PII data usage across the environment. Which Snowflake feature provides the most comprehensive audit trail of access to objects containing sensitive information?

Accepted Answer

Access History.. Access History is a native Snowflake feature that records granular information about which users accessed which columns in which tables. This is vital for compliance audits and data governance, as it provides a verifiable record of data consumption. By combining Access History with Object Tagging, organizations can effectively monitor sensitive data flows and ensure compliance with regulatory standards like GDPR or CCPA.

Answer

Query History.

Answer

Data Sharing history.

Answer

Login History.

Question 5

Which TWO of the following are true regarding the use of Snowflake Data Classification?

Accepted Answer

The process uses system-defined tags to label sensitive data.. Snowflake Data Classification automatically identifies PII and sensitive data within tables, assigning system tags to columns. This process significantly reduces the manual effort required for governance. It works by scanning sample data and applying semantic labels, which can then be used to trigger automated protection measures like masking policies. Understanding how this automates compliance is essential for any modern data engineer managing large, dynamic datasets.

Answer

Data classification can only be applied to existing tables.

Answer

Classification results are stored in the user's local file system.

Answer

Classification requires the data to be in a flat file format.

Question 6

What is the primary purpose of a 'Secure View' in Snowflake from a governance perspective?

Accepted Answer

To hide the underlying view definition and schema metadata.. A Secure View is designed to prevent users from seeing the underlying logic or source data of the view, even if they have been granted select access. By hiding the view definition and internal metadata, organizations can expose specific data subsets to external partners or internal teams without risking the disclosure of proprietary business rules or underlying table structures that might contain sensitive information.

Answer

To increase the performance of complex joins.

Answer

To automatically mask PII in the output.

Answer

To allow users to modify the base tables.

Question 7

An auditor requests proof of who has accessed a specific table containing sensitive data. Which Snowflake view in the ACCOUNT_USAGE schema provides this data?

Accepted Answer

ACCESS_HISTORY.. The ACCESS_HISTORY view in the ACCOUNT_USAGE schema is the definitive source for auditing data access. It logs every query that touches a column in a table, providing a comprehensive trail that is crucial for regulatory compliance. Understanding how to query the ACCOUNT_USAGE schema is a core skill for data engineers responsible for maintaining an audit-ready environment and documenting data lineage for sensitive assets.

Answer

QUERY_HISTORY.

Answer

TABLE_STORAGE_METRICS.

Answer

OBJECT_PRIVILEGES.

Question 8

What is the primary function of a 'Tag' in Snowflake's governance framework?

Accepted Answer

To classify data and facilitate governance policy application.. Tags are metadata objects that allow you to label other objects, such as tables or columns, to facilitate discovery, cost tracking, and governance policy application. By tagging sensitive data, organizations can automate the application of masking or row access policies, ensuring that security controls scale alongside the data volume and reducing the burden of manual oversight for data engineers.

Answer

To hide data from unauthorized users.

Answer

To store physical data for backup purposes.

Answer

To increase the performance of queries.

Question 9

Which of the following is true when considering the order of operations for policy application in Snowflake?

Accepted Answer

Row Access Policies are evaluated before Masking policies.. Row Access Policies are evaluated before Dynamic Data Masking policies. This ensures that the rows themselves are filtered based on the user's access rights before any masking occurs. This order is critical for security; if masking were applied first, it might leak information about the rows that should have been filtered out, violating the principle of least privilege and strict data boundary enforcement.

Answer

Masking policies are applied before Row Access Policies.

Answer

Policies are applied in a random order.

Answer

The evaluation order is defined by the table owner.

Question 10

What is the primary benefit of using Snowflake's Object Tagging for cost attribution?

Accepted Answer

It allows costs to be associated with specific business projects.. Object Tagging allows organizations to assign costs to specific business units, projects, or applications by labeling the tables and schemas they use. This is critical for internal showback/chargeback models. By tracking resource usage at the tagged object level, finance teams can accurately map Snowflake costs to specific departments, encouraging better resource management and accountability across the organization's data footprint.

Answer

It automatically reduces the storage costs by compressing data.

Answer

It enables query results to be cached more efficiently.

Answer

It replaces the need for Resource Monitors.

Question 11

A data engineer wants to share a subset of data with a third party while ensuring sensitive columns are masked. Which governance combination is best?

Accepted Answer

Create a secure view and apply masking policies to the base table columns.. The best practice is to combine a Secure View with a Dynamic Data Masking policy. The Secure View provides a clean abstraction layer, while the Masking Policy ensures that the data itself remains protected regardless of how the view is queried. This combination allows for precise data sharing while adhering to strict compliance standards, protecting the organization from data leaks during the sharing process.

Answer

Create a standard view with CASE statements for masking.

Answer

Grant direct access to the base table.

Answer

Physically clone the table and remove sensitive rows.

Question 12

A data engineer needs to identify all columns across a multi-database Snowflake account that have been assigned the 'PII_Type' tag to ensure compliance with a new privacy regulation. Which approach provides the most comprehensive and efficient result for this account-level audit?

Accepted Answer

Query the TAG_REFERENCES view within the SNOWFLAKE.ACCOUNT_USAGE schema.. Snowflake object tagging allows for fine-grained metadata management across the account. Using the ACCOUNT_USAGE.TAG_REFERENCES view is the most efficient way to track PII tags globally, as it aggregates data from all databases. This centralized approach ensures that data engineers can maintain compliance and auditability without needing to query individual database schemas, which is crucial for scalable governance strategies.

Answer

Query the INFORMATION_SCHEMA.TAG_REFERENCES table function in every database.

Answer

Use the SYSTEM$GET_TAG function on every table in the account sequentially.

Answer

Execute a SHOW TAGS command and filter for the 'PII_Type' string in the output.

Question 13

A healthcare company implements a Row Access Policy (RAP) on a PATIENTS table to restrict doctor access to only their assigned patients. The RAP references a mapping table. What is the most critical performance consideration when designing this policy for a table with billions of rows?

Accepted Answer

Ensuring the mapping table is small and uses columns that allow for effective pruning.. When Row Access Policies involve joins to mapping tables, Snowflake's optimizer must execute these checks efficiently to avoid full table scans. Using a memoizable function or ensuring the mapping table is small and clustered correctly helps the pruning process. Governance at scale requires balancing strict security logic with the underlying query performance to ensure user experience is maintained.

Answer

Applying the policy to the mapping table itself to prevent circular references.

Answer

Using a CASE statement instead of a WHERE clause within the policy definition.

Answer

Granting the OWNERSHIP privilege of the mapping table to the PUBLIC role.

Question 14

In Snowflake's object tagging hierarchy, if a tag is applied at the Schema level and a different value for the same tag is applied at the Table level, what is the resulting behavior for the Table?

Accepted Answer

The Table-level tag value overrides the Schema-level tag value.. Snowflake utilizes a hierarchy for tag inheritance where the most specific assignment takes precedence. This allows organizations to set broad defaults at the database or schema level while still permitting exceptions at the table or column level. Understanding this precedence is essential for troubleshooting why certain objects may or may not appear in audit reports.

Answer

The Schema-level tag value overrides the Table-level tag value.

Answer

Snowflake returns an error due to a conflict in the tag lineage.

Answer

Both tag values are combined into a comma-separated string for the Table.

Question 15

Refer to the exhibit. A security administrator executes this query to audit access to a sensitive table. What specific information is captured in the 'base_objects_accessed' column regarding the data lineage of this query?

Accepted Answer

It identifies the underlying tables that provided the data, even if the user queried a view.. The ACCESS_HISTORY view is a powerful tool for tracking data movement and consumption. The 'base_objects_accessed' field specifically records the underlying source tables (the 'base' objects) that provided the data, even if the user queried a view or a series of nested views. This is vital for accurate compliance reporting and understanding the ultimate source of truth.

Answer

It lists only the immediate view name that the user referenced in their SELECT statement.

Answer

It displays the metadata of the warehouse used to execute the query for the table.

Answer

It identifies the specific columns and rows that were filtered out by the query optimizer.