COF-C03 Account Management and Data Governance Practice Test 2 — 15 Questions

Question 1

A Snowflake administrator wants to enforce that only users with the role PAYROLL_ADMIN can view unmasked values in the SALARY column of the HR.EMPLOYEES table, while all other users see a fixed value. The administrator creates a masking policy and applies it to the SALARY column. Which statement accurately describes how the masking policy must be written to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy must use CURRENT_ROLE() in a CASE expression to return the unmasked value when CURRENT_ROLE() = 'PAYROLL_ADMIN' and a masked value otherwise.. The correct approach is to embed role-based logic inside the masking policy. Snowflake masking policies evaluate the context of the querying user, so using CURRENT_ROLE() in a CASE expression allows the policy to return the original value for PAYROLL_ADMIN and a masked value for everyone else. This directly enforces the requirement without needing special privileges or separate policy assignments.

Answer

The policy must grant the PAYROLL_ADMIN role the MASKING EXEMPT privilege so that role bypasses all masking policies on the SALARY column.

Answer

The policy must use IS_ROLE_IN_SESSION() to check if PAYROLL_ADMIN is active, returning the unmasked value if true and a masked value otherwise.

Answer

The policy must be applied only to the PAYROLL_ADMIN role using an ALTER MASKING POLICY command, so that only that role sees unmasked data.

Question 2

A security administrator wants to enforce that all new tables created in the database 'SENSITIVE_DB' must have a tag 'DATA_CLASSIFICATION' applied with a value of 'CONFIDENTIAL'. Existing tables should not be affected. Which Snowflake feature should be used to achieve this?

Accepted Answer

Tag-based governance policy. Tag-based governance policies in Snowflake enable administrators to enforce that certain tags are applied to objects when they are created. By defining a policy that requires the 'DATA_CLASSIFICATION' tag with a value of 'CONFIDENTIAL' for tables in 'SENSITIVE_DB', the administrator ensures that all new tables comply. Existing tables are not modified, aligning with the requirement.

Answer

Object tagging with allowed values

Answer

Tag propagation

Answer

Tag-based masking policy

Question 3

A Snowflake administrator needs to grant the privilege to create and manage users and roles to a new security team member. Which role should be granted to this user to provide the necessary privileges while following the principle of least privilege?

Accepted Answer

SECURITYADMIN. SECURITYADMIN is the predefined role that includes the MANAGE GRANTS privilege and can create and manage users and roles. It provides the necessary capabilities without the broad permissions of ACCOUNTADMIN. This aligns with the principle of least privilege, as it limits the user to security administration tasks rather than full account control.

Answer

SYSADMIN

Answer

ACCOUNTADMIN

Answer

USERADMIN

Question 4

A company wants to implement data governance using Snowflake tags. Which two statements are true regarding tag-based masking policies? (Choose two.)

Accepted Answer

Tag-based masking policies require the tag to be assigned to the column before the masking policy can be applied.. Tag-based masking policies leverage tags to apply masking consistently across columns. When a tag is assigned to a column, the associated masking policy is enforced. This allows a single policy to protect many columns with the same tag, and the tag must be present for the policy to apply. These policies operate at the column level and can be configured to exempt certain roles.

Answer

Tag-based masking policies automatically mask data for all users, including those with the ACCOUNTADMIN role.

Answer

A tag-based masking policy can be applied to a table to mask all columns at once.

Answer

Tag-based masking policies can be used to enforce row-level security.

Question 5

A security administrator wants to allow a group of users to query only the columns in the CUSTOMERS table that contain non-sensitive data, while preventing them from seeing the SSN and CREDIT_CARD columns. The users still need to be able to run SELECT * queries. Which Snowflake feature should be used?

Accepted Answer

Secure view with column projection. A secure view that projects only the non-sensitive columns allows users to run SELECT * against the view without exposing SSN or CREDIT_CARD. Because the view is secure, its definition is hidden, and users cannot see the underlying table. Column-level masking would still expose the columns (with masked values), and row access policies filter rows, not columns. Tags alone do not enforce access control.

Answer

Row access policy

Answer

Column-level masking policy

Answer

Object tagging with a sensitivity tag

Question 6

A data steward needs to apply a masking policy to a column so that only users with the role PII_READER see the actual email addresses, while all other users see the string '***'. The masking policy is already created and stored in the database GOVERNANCE_DB, schema POLICIES. The steward has the ACCOUNTADMIN role. Which SQL command correctly applies the masking policy to the EMAIL column of the CUSTOMERS table in SALES_DB.PUBLIC?

Accepted Answer

ALTER TABLE SALES_DB.PUBLIC.CUSTOMERS MODIFY COLUMN EMAIL SET MASKING POLICY GOVERNANCE_DB.POLICIES.EMAIL_MASK;. To enforce column-level security with masking policies, the policy must be attached to the target column using ALTER TABLE ... MODIFY COLUMN ... SET MASKING POLICY. This ensures that any query referencing that column evaluates the policy logic, which can conditionally mask values based on the user's role. The other options either use incorrect syntax, create a policy without applying it, or grant a privilege instead of applying the policy.

Answer

GRANT APPLY MASKING POLICY ON ACCOUNT TO ROLE PII_READER;

Answer

CREATE MASKING POLICY GOVERNANCE_DB.POLICIES.EMAIL_MASK AS (val STRING) RETURNS STRING -> CASE WHEN CURRENT_ROLE() = 'PII_READER' THEN val ELSE '***' END;

Answer

ALTER TABLE SALES_DB.PUBLIC.CUSTOMERS ALTER COLUMN EMAIL SET MASKING POLICY GOVERNANCE_DB.POLICIES.EMAIL_MASK;

Question 7

A data steward needs to classify a table containing sensitive data. They want to apply a tag named 'PII' to the table and ensure that the tag cannot be removed by users with the SYSADMIN role. Which approach should they take?

Accepted Answer

Create the tag and grant the APPLY TAG privilege on the tag only to the data steward's role, not to SYSADMIN.. The APPLY TAG privilege on a tag controls who can set or unset that tag on objects. By granting this privilege only to the data steward's role and not to SYSADMIN, SYSADMIN cannot remove the tag. This enforces the requirement that the tag remains intact unless changed by authorized personnel. It is a best practice to manage tag privileges separately from object privileges.

Answer

Create the tag and assign it to the table using the ACCOUNTADMIN role.

Answer

Create the tag and grant the APPLY TAG privilege on the tag to the SYSADMIN role.

Answer

Create the tag and set the tag's allowed values to 'PII' only.

Question 8

A data steward needs to ensure that a tag named PII is automatically applied to any column that contains personally identifiable information across all tables in the database. The steward wants the tag to be applied at column creation time and to be inherited by any new columns added later. Which Snowflake feature should be used?

Accepted Answer

Automatic tagging using classification. Snowflake's automatic classification feature can scan tables and automatically apply tags to columns that match certain patterns, such as those containing PII. It can be configured to run on a schedule and will tag new columns as they are added, ensuring ongoing compliance. Other options either require manual tagging or do not automatically assign tags to columns.

Answer

Tag-based masking policy

Answer

Column-level security policy

Answer

Object tagging with tag propagation

Question 9

A security administrator needs to grant the role DATA_ANALYST the ability to see all rows in the ORDERS table, but only for rows where the region column is 'North America'. The administrator creates a row access policy with the condition CURRENT_ROLE() = 'DATA_ANALYST' OR region = 'North America'. After applying the policy to the ORDERS table, users with the DATA_ANALYST role still see only North American rows. What is the most likely cause?

Accepted Answer

The policy condition uses CURRENT_ROLE(), which returns the role in use for the session, but the user may have a different role active.. The row access policy condition uses CURRENT_ROLE(), which only reflects the active role in the session. If the user has the DATA_ANALYST role but is not currently using it, the condition fails, and only the region filter applies. To allow all granted roles to satisfy the condition, the policy should use IS_ROLE_IN_SESSION() or check CURRENT_ROLE() after ensuring the role is active. This subtlety often leads to unexpected row filtering.

Answer

The policy must be applied using ALTER VIEW instead of ALTER TABLE because ORDERS is a view.

Answer

Row access policies require the user to have the APPLY ROW ACCESS POLICY privilege on the table.

Answer

The row access policy was applied to the wrong column; it must be applied to the REGION column specifically.

Question 10

A governance team wants a masking policy on a table column to be evaluated dynamically so that it returns unmasked data only when the querying user's role is the role named in the policy, rather than hard-coding a single role name. Which masking policy construct should be used?

Accepted Answer

CURRENT_ROLE() compared against a column value in the policy expression. Masking policy expressions in Snowflake can reference columns in the same row, so comparing CURRENT_ROLE() to a column that stores the authorized role name makes the policy dynamic per row. This avoids hard-coding a single role and lets each row declare which role may see unmasked data. The other options either hard-code a role, change row visibility instead of column values, or only automate policy assignment.

Answer

IS_ROLE_IN_SESSION('ANALYST_ROLE')

Answer

A secure view that filters rows using CURRENT_ROLE()

Answer

A tag-based masking policy assigned with ALTER TAG

Question 11

A company wants to allow external partners to access a set of data without copying it into their own Snowflake accounts. The partners should be able to query the data directly, and the company wants to revoke access at any time. Which Snowflake feature should be used?

Accepted Answer

Data sharing using a share object. Snowflake Data Sharing allows providers to share data with other Snowflake accounts without copying. The provider creates a share, grants privileges on objects, and adds consumer accounts. Consumers can then create databases from the share and query the data. Access can be revoked at any time by revoking privileges or removing the consumer from the share. This is the most efficient and secure method for external data sharing.

Answer

Database replication to the partner's region

Answer

Secure Data Sharing via a reader account

Answer

External tables pointing to cloud storage

Question 12

A Snowflake administrator needs to review all queries executed in the account over the past 30 days for auditing purposes. The administrator has the ACCOUNTADMIN role. Which command should be used to retrieve this information?

Accepted Answer

SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY WHERE START_TIME >= DATEADD(day, -30, CURRENT_TIMESTAMP());. The ACCOUNT_USAGE.QUERY_HISTORY view is the authoritative source for account-level query auditing. It retains up to 365 days of history and includes all queries executed by any user. Filtering by START_TIME ensures that all queries initiated within the 30-day window are captured. The other options either provide limited scope, track different data, or use a less appropriate time filter.

Answer

SELECT * FROM SNOWFLAKE.INFORMATION_SCHEMA.QUERY_HISTORY WHERE START_TIME >= DATEADD(day, -30, CURRENT_TIMESTAMP());

Answer

SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY WHERE QUERY_START_TIME >= DATEADD(day, -30, CURRENT_TIMESTAMP());

Answer

SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY WHERE END_TIME >= DATEADD(day, -30, CURRENT_TIMESTAMP());

Question 13

A security administrator has created a masking policy that replaces values in the 'email' column of the 'customers' table with a fixed string for everyone except users with the 'HR_ANALYST' role. After applying the policy, the administrator notices that the 'HR_ANALYST' role still sees masked email values when querying the table. The role does, however, have SELECT privileges on the table. What is the most likely reason the 'HR_ANALYST' role sees masked data?

Accepted Answer

The masking policy's exemption condition references IS_ROLE_IN_SESSION('HR_ANALYST'), but the HR_ANALYST role is not activated in the user's current session.. Masking policies evaluate their condition at query time using the session context. Using IS_ROLE_IN_SESSION ensures that only users who have the specified role active in their session see unmasked values. If the role is granted but not activated, the condition returns false and masking still applies. The administrator must either activate the role or use a different condition such as IS_ROLE_IN_SESSION with proper role activation.

Answer

The masking policy was created with the 'EXEMPT' property set to 'HR_ANALYST', but that property only works for roles granted at the account level, not at the database level.

Answer

The masking policy was applied to the column using ALTER TABLE ... ALTER COLUMN ... SET MASKING POLICY, but the role was not granted the global APPLY MASKING POLICY privilege.

Answer

The masking policy was applied to the column, but the HR_ANALYST role lacks the USAGE privilege on the masking policy object itself.

Question 14

A Snowflake administrator is implementing data governance using tags. They need to ensure that tags can be used to track and control access to sensitive data. Which two statements are true regarding tag-based masking policies? (Choose two.)

Accepted Answer

A tag-based masking policy can be applied to a column by associating a tag with the column, and the policy is automatically enforced when the tag is set.. Tag-based masking policies enable scalable governance by linking a masking policy to a tag, which can then be applied to many columns. This ensures consistent masking across all tagged columns. The tag must be created normally, and the masking policy is associated with the tag using ALTER TAG. A column cannot have both a direct masking policy and a tag-based one simultaneously, so conflicts must be resolved by removing the existing policy.

Answer

Tag-based masking policies can only be applied to columns of type STRING; other data types require separate policies.

Answer

To use tag-based masking, the tag must be created with the ALLOW_MASKING_POLICY parameter set to TRUE.

Answer

When a tag with an associated masking policy is applied to a column, the policy overrides any existing masking policy on that column.

Question 15

A security administrator needs to audit all login attempts to the Snowflake account, including successful and failed logins, and to retain the audit logs for 90 days. Which TWO Snowflake features or objects should be used to achieve this? (Choose two.)

Accepted Answer

Snowflake audit log export to cloud storage. The ACCOUNT_USAGE.LOGIN_HISTORY view provides account-wide login history with 365-day retention, satisfying the need to audit all login attempts. To retain logs for 90 days, exporting audit logs to cloud storage ensures long-term storage beyond the view's retention. The Information Schema view is limited to 7 days and current user, and query history does not capture logins. Event tables are not for login auditing.

Answer

INFORMATION_SCHEMA.LOGIN_HISTORY view

Answer

ACCOUNT_USAGE.QUERY_HISTORY view

Answer

Event table with login events