DEA-C02 Data Governance Practice Test 4 — 15 Questions

Question 1

A data engineer needs to prevent any future column additions to a critical ORDERS table from containing unprotected PII. The goal is to automatically classify new columns and receive alerts when sensitive data is detected. Which Snowflake feature should be configured to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Classification with automatic tagging and notifications. Data Classification is designed to automatically scan and classify columns containing sensitive data, including PII. It can be configured to send notifications when new sensitive columns are detected, providing ongoing governance without manual effort. This directly addresses the need to protect future column additions.

Answer

Object Tagging with manual tag assignment

Answer

Dynamic Data Masking policies on the table

Answer

Row Access Policies on the table

Question 2

A data engineer is implementing a data governance strategy and needs to ensure that all tables containing sensitive data are automatically identified and tagged. The engineer wants to use Snowflake's native classification capabilities and then apply masking policies based on those tags. Which sequence of steps should the engineer follow?

Accepted Answer

Run Data Classification, review results, then create and attach masking policies to tagged columns.. Data Classification is the native feature that automatically scans and tags sensitive columns. Once tagged, the engineer can review the tags and then create masking policies attached to those columns. This ensures that policies are applied to the correct columns without manual discovery.

Answer

Manually apply tags, then create masking policies that reference those tags.

Answer

Create masking policies first, then run Data Classification to tag columns.

Answer

Use Access History to identify sensitive columns, then manually tag them.

Question 3

A financial services company stores transaction records in a Snowflake table that includes a column named 'SSN'. The data engineering team has been asked to implement a governance control that automatically detects and tags any column containing Social Security Numbers across the entire account, without manually inspecting every table. Which Snowflake feature should the team use to achieve this requirement?

Accepted Answer

Data Classification with a custom classification profile. Data Classification is designed to automatically scan and classify columns based on sensitive data patterns. By using a custom classification profile, the team can ensure SSNs are detected and tagged with system tags across the account, meeting the governance requirement without manual effort.

Answer

Object tagging with manual tag assignments

Answer

Access History view in ACCOUNT_USAGE

Answer

Dynamic Data Masking with a masking policy

Question 4

A Snowflake account has a tag-based masking policy on column CUSTOMER.SSN. An analyst runs a query that applies the SYSTEM$GET_TAG function to that column. The analyst has been granted the APPLY MASKING POLICY privilege on the tag, but not the USAGE privilege on the tag. What does the analyst see for the SSN column value?

Accepted Answer

The masked SSN value, because the masking policy is enforced regardless of tag privileges.. Masking policies attached to tags are enforced regardless of whether the querying user can read the tag. A user without USAGE on the tag cannot see tag metadata but still receives masked data because the policy is evaluated at query time against the column. APPLY MASKING POLICY is an administrative privilege for managing tag-policy associations, not for bypassing enforcement.

Answer

NULL, because the masking policy cannot be resolved without tag access.

Answer

An error, because the analyst lacks USAGE on the tag required to evaluate the masking policy.

Answer

The unmasked SSN value, because APPLY MASKING POLICY overrides tag visibility.

Question 5

A Snowflake data engineer has been tasked with implementing dynamic data masking on a CUSTOMERS table so that the SSN column is fully redacted for all users except those with the role PII_ADMIN. The engineer wants the masking to apply automatically whenever the column is queried, without changing any application SQL. Which Snowflake object should the engineer create and attach to the SSN column?

Accepted Answer

A masking policy created with CREATE MASKING POLICY and applied to the SSN column using ALTER TABLE ... MODIFY COLUMN ... SET MASKING POLICY.. Dynamic column redaction in Snowflake is implemented with masking policies, which are schema-level objects attached directly to a column. Once attached, the policy expression evaluates on every query, returning the original value to authorized roles and a masked value to others, with no application changes required. This satisfies both the automatic enforcement requirement and the role-based exception for PII_ADMIN.

Answer

A row access policy created with CREATE ROW ACCESS POLICY and attached to the CUSTOMERS table.

Answer

A secure view that selects all columns from CUSTOMERS but replaces SSN with a constant for non-admins.

Answer

A tag-based classification using ALTER TABLE ... SET TAG on the SSN column.

Question 6

A data engineer needs to audit all grants of the 'SYSADMIN' role to users across the Snowflake account. The engineer has access to the ACCOUNTADMIN role and wants to retrieve this information efficiently. Which Snowflake view should be queried?

Accepted Answer

SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_USERS. To audit which users have been granted the SYSADMIN role, the GRANTS_TO_USERS view in the ACCOUNT_USAGE schema is the correct source. It records all role-to-user grants, including the role name and grantee. Filtering on the ROLE column for 'SYSADMIN' yields the required list. Other views either lack grant information or focus on different objects.

Answer

SNOWFLAKE.ACCOUNT_USAGE.USERS

Answer

SNOWFLAKE.ACCOUNT_USAGE.ROLES

Answer

SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_ROLES

Question 7

A financial services firm stores account balances in a Snowflake table ACCOUNTS. A row access policy is defined so that analysts see only rows where REGION = CURRENT_REGION(). The firm also attaches a masking policy to the BALANCE column that returns NULL for users without the FINANCE role. An analyst with the ANALYST role queries SELECT REGION, BALANCE FROM ACCOUNTS. What will the analyst see?

Accepted Answer

Only rows matching the analyst's region, with BALANCE values returned as NULL because the analyst lacks the FINANCE role.. Row access policies and masking policies are complementary and both are enforced at query time. The row access policy constrains which rows are visible based on the region predicate, while the masking policy rewrites the BALANCE value for roles not granted the FINANCE role. The analyst therefore sees a region-filtered result set in which BALANCE is NULL, demonstrating defense in depth.

Answer

An error is raised because a table cannot have both a row access policy and a masking policy attached.

Answer

All rows in ACCOUNTS, but BALANCE values are NULL for every row.

Answer

Only rows matching the analyst's region, with actual BALANCE values visible because row access policies take precedence.

Question 8

A data engineer is tasked with implementing a data governance strategy that includes classifying sensitive data and applying tags. The engineer plans to use Snowflake's Data Classification and tag-based masking. Which two statements are true regarding the interaction between Data Classification and tags? (Choose two.)

Accepted Answer

Tag-based masking policies can be applied to system tags created by Data Classification.. Data Classification automatically assigns system tags to columns based on its analysis, and these system tags can have masking policies attached to them. This integration allows for automatic masking of sensitive data identified by classification. Manual tag creation is not required, and system tags are indeed used and can support masking.

Answer

Tag-based masking policies cannot be applied to system tags; only user-defined tags support masking.

Answer

Data Classification can only tag columns with user-defined tags, not system tags.

Answer

Data Classification requires that all tags be manually created before classification can run.

Question 9

A data engineer needs to categorize columns across multiple databases with custom business tags such as COST_CENTER and DATA_OWNER, and then enforce that only users with the TAG_ADMIN role can modify those tags. Which Snowflake feature should the engineer use to meet this requirement?

Accepted Answer

Object tagging with a tag created via CREATE TAG, assigning tags to columns with ALTER TABLE ... SET TAG, and granting the APPLY TAG privilege only to TAG_ADMIN.. Object tagging is Snowflake's mechanism for attaching custom metadata labels to columns and other objects. Tags are created with CREATE TAG, applied with ALTER TABLE ... SET TAG, and their modification is governed by the APPLY TAG privilege on the tag itself. Granting APPLY TAG only to TAG_ADMIN restricts who can change the tags, satisfying both categorization and access-control needs.

Answer

A masking policy that returns the tag value for authorized roles and NULL for others.

Answer

Snowflake Data Classification, which automatically detects and tags columns with system tags.

Answer

Access control policies created with CREATE ACCESS POLICY and bound to the target columns.

Question 10

A data engineer needs to audit all tag assignments across the account to ensure that no sensitive columns are missing required tags. Which Snowflake view should the engineer query to retrieve a list of all tags applied to columns, including the tag name, value, and the object it is applied to?

Accepted Answer

SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES. To audit tag assignments, the TAG_REFERENCES view is the correct choice. It provides a comprehensive list of all tag references, including the tag name, value, and the object (e.g., column) it is applied to. The TAGS view only provides tag metadata, while COLUMNS and POLICY_REFERENCES do not include tag assignments.

Answer

SNOWFLAKE.ACCOUNT_USAGE.TAGS

Answer

SNOWFLAKE.ACCOUNT_USAGE.POLICY_REFERENCES

Answer

SNOWFLAKE.ACCOUNT_USAGE.COLUMNS

Question 11

A financial services firm must enforce a policy that only users with the role 'COMPLIANCE_OFFICER' can view rows where the 'ACCOUNT_STATUS' column equals 'DELINQUENT' in the 'LOANS' table. All other users should see only non-delinquent rows. Which Snowflake feature should the data engineer implement to meet this requirement?

Accepted Answer

A row access policy on the LOANS table that checks the current role and filters rows accordingly.. Row access policies are the correct Snowflake feature for row-level security. They evaluate conditions such as CURRENT_ROLE() and filter rows accordingly. Masking policies only obfuscate column values, secure views can be bypassed if base table access exists, and network policies operate at the network layer. Only a row access policy attached to the table enforces the required filtering for all queries.

Answer

A network policy that restricts access to the LOANS table based on IP address.

Answer

A secure view that joins the LOANS table with a role-mapping table and filters rows.

Answer

A masking policy on the ACCOUNT_STATUS column that returns NULL for non-compliance roles.

Question 12

A retail company has a Snowflake account with many databases and schemas. The data governance team needs to discover all columns that contain personal data such as names, email addresses, and phone numbers, and automatically assign a system tag so that a masking policy can be applied later. They want to minimize manual effort and ensure the classification is consistent. Which Snowflake feature should they use to achieve this?

Accepted Answer

Use Snowflake Data Classification to automatically scan and tag columns with system tags like SNOWFLAKE.CORE.PRIVACY_CATEGORY.. Snowflake Data Classification is designed to automatically scan and classify data, applying system tags that indicate privacy categories. This reduces manual effort and ensures consistent tagging across the account. The other options either require manual work, rely on incomplete methods, or use auditing features that do not detect sensitive data content. Thus, Data Classification is the correct choice.

Answer

Manually run SHOW COLUMNS in each database and schema, then apply tags using ALTER TABLE ... SET TAG.

Answer

Enable Access History and then use the ACCESS_HISTORY view to identify columns containing personal data.

Answer

Create a stored procedure that queries INFORMATION_SCHEMA.COLUMNS and uses pattern matching to assign tags.

Question 13

A data engineer needs to ensure that all queries against a table containing sensitive data are logged for compliance purposes. Which Snowflake feature should the engineer use to capture the query text and the user who executed it?

Accepted Answer

Query History in the ACCOUNT_USAGE schema.. Query History in ACCOUNT_USAGE is the correct feature to log query text and user information for compliance. It provides a complete record of all queries executed in the account. Access History is for column-level access, Login History is for authentication events, and Warehouse Metering History is for cost tracking. Only Query History captures the necessary details.

Answer

Login History in the ACCOUNT_USAGE schema.

Answer

Access History in the ACCOUNT_USAGE schema.

Answer

Warehouse Metering History in the ACCOUNT_USAGE schema.

Question 14

A financial institution uses Snowflake to store customer transactions. A data engineer needs to implement a policy that restricts access to rows in the TRANSACTIONS table based on the department of the user. The department information is stored in a lookup table named USER_DEPARTMENT. The policy must be applied dynamically without modifying the TRANSACTIONS table. Which Snowflake feature should the engineer use?

Accepted Answer

Implement a Row Access Policy that uses a mapping table to determine the user's department and filters rows accordingly.. Row Access Policies are designed to filter rows based on user attributes or mapping tables. They attach to tables and enforce filtering at query time, making them ideal for dynamic row-level security. Secure views can be bypassed if base table access is granted, and masking policies only affect column values, not row visibility. Thus, a Row Access Policy is the correct solution.

Answer

Create a secure view that joins TRANSACTIONS with USER_DEPARTMENT and filters rows based on the current user's department.

Answer

Use a Column-level Security policy with a masking policy that returns NULL for rows not belonging to the user's department.

Answer

Create a dynamic data masking policy that checks the user's department and masks the entire row if the department does not match.

Question 15

A data steward at a financial services company needs to automatically detect and tag columns containing Social Security numbers across all schemas in the PROD database. The steward wants the tagging to be applied without manually inspecting each table and to leverage Snowflake's built-in classifiers. Which approach should the steward use?

Accepted Answer

Use Snowflake Data Classification with a system-defined SSN semantic category and apply it to the PROD database.. Snowflake Data Classification automatically scans tables and views to identify sensitive data using system-defined semantic categories, including SSN. Applying it to a database scans all contained schemas and tables, tagging columns that match the SSN pattern. This meets the requirement for automatic detection and tagging without manual intervention, leveraging native governance features.

Answer

Enable Snowflake Access History and use it to identify columns that have been queried with SSN patterns.

Answer

Write a stored procedure that queries INFORMATION_SCHEMA.COLUMNS for column names containing 'SSN' and applies a tag.

Answer

Create a custom tag called SSN_TAG and manually apply it to every column that appears to contain SSN data.