COF-C03 Account Management and Data Governance Practice Test 4 — 15 Questions

Question 1

Which of the following describes the purpose of 'Object Tagging' in Snowflake?

Accepted Answer

To logically group objects for discovery and compliance reporting.. Object tagging allows administrators to assign metadata to objects (like tables, columns, or warehouses) to facilitate discovery, tracking, and governance. Tags are useful for identifying sensitive data, tracking costs, or enforcing compliance. This is a crucial feature for large organizations that need to report on data usage, lifecycle, and sensitivity across thousands of objects, making it easier to manage and audit data at scale.

Answer

To encrypt sensitive data at the column level.

Answer

To restrict user access based on their network location.

Answer

To automatically optimize query performance.

Question 2

A data administrator wants to ensure that all data access is audited. Where can they find a list of all tables accessed by a specific user?

Accepted Answer

ACCESS_HISTORY.. The ACCESS_HISTORY view, introduced to enhance Snowflake's governance capabilities, provides a comprehensive log of every object access event. It records which columns were queried and which tables were accessed by specific users. This tool is essential for compliance, allowing administrators to audit who accessed sensitive data and when, fulfilling regulatory requirements like GDPR or HIPAA that demand strict tracking of data usage.

Answer

QUERY_HISTORY.

Answer

INFORMATION_SCHEMA.TABLES.

Answer

LOGIN_HISTORY.

Question 3

An organization requires that specific sensitive columns in a table be masked for all users except those in the 'DATA_STEWARD' role. Which mechanism should the architect implement to enforce this policy efficiently?

Accepted Answer

Apply a masking policy using the IS_ROLE_IN_SESSION function.. Dynamic Data Masking (DDM) provides a centralized way to protect sensitive data by applying masking policies to columns. By using the IS_ROLE_IN_SESSION function within the policy, the system evaluates the user's active role dynamically during query execution. This ensures that only members of the DATA_STEWARD role see unmasked data, while others see the masked output, maintaining governance consistency without needing to physically alter the underlying data storage or create multiple filtered views.

Answer

Apply a row-level security policy to the table.

Answer

Create secure views that use a CASE statement to filter columns.

Answer

Use data replication to create a separate table for stewards.

Question 4

Which object type in Snowflake is required to store a compiled masking policy before it can be applied to a table column?

Accepted Answer

A masking policy object.. In Snowflake, masking policies are independent, schema-level objects. Before a policy can be enforced on a column, it must be created using the 'CREATE MASKING POLICY' command. This object encapsulates the logic for transformation and the conditional access rules. Once defined, the policy is then mapped to one or more columns via an 'ALTER TABLE' statement or during table creation, providing a modular approach to data governance.

Answer

A stored procedure.

Answer

A data masking role.

Answer

A secure function.

Question 5

An administrator needs to restrict access to sensitive PII data. Which TWO of the following are valid approaches to implement governance in Snowflake?

Accepted Answer

Apply a Row Access Policy to the table.. Snowflake provides several layers of defense-in-depth to secure sensitive information. Row Access Policies filter which rows a user can see, while Dynamic Data Masking transforms column data based on user privileges. Using these in combination allows architects to build a highly restrictive environment where users only interact with the exact data subsets and column values they are authorized to access, complying with strict regulatory data privacy standards.

Answer

Use physical data partitioning to store PII in separate tables.

Answer

Assign the ACCOUNTADMIN role to all data stewards.

Answer

Export data to an encrypted S3 bucket for security.

Question 6

When designing a role-based access control (RBAC) model, which THREE of the following are recommended best practices?

Accepted Answer

Grant privileges to roles, not directly to users.. A robust RBAC model relies on hierarchical structures to simplify management and minimize errors. By granting privileges to roles rather than users, and nesting roles logically, you create a scalable security architecture. These best practices ensure that permissions are easy to audit, follow the principle of least privilege, and prevent 'privilege creep,' where users accumulate excess access rights that are never revoked over time as their roles change.

Answer

Use the ACCOUNTADMIN role for daily data analysis.

Answer

Assign all users the same 'PUBLIC' role for simplicity.

Question 7

What is the primary purpose of a 'Tag' in Snowflake from a data governance perspective?

Accepted Answer

To identify and track sensitive data for compliance.. Tags in Snowflake are used to label and categorize data objects for governance, reporting, and cost allocation. By applying a tag to a table or column, an administrator can track sensitive data across the entire account. This allows for automated reporting on data lineage and compliance, enabling teams to quickly identify where PII or other critical information resides for regulatory auditing and risk management purposes.

Answer

To increase query performance for joins.

Answer

To define the access level of a user.

Answer

To compress data for storage savings.

Question 8

What is the consequence of applying a Row Access Policy to a table that already contains existing data?

Accepted Answer

The policy is applied immediately to all subsequent queries.. When a Row Access Policy is applied to an existing table, the policy immediately takes effect for all subsequent queries. Any user who runs a query against the table will only see the rows allowed by the policy logic. This is critical for governance because it provides an immediate, retroactive enforcement of security rules without needing to migrate or transform the existing data in the table, ensuring compliance from the moment the policy is activated.

Answer

The data must be reloaded to apply the policy.

Answer

Existing queries will continue to return all rows.

Answer

The table must be dropped and recreated.

Question 9

What is the primary role of the 'ORGANIZATIONADMIN' role in Snowflake?

Accepted Answer

To perform account-level management across the organization.. The ORGANIZATIONADMIN (ORGADMIN) role is responsible for managing tasks at the account-level across the entire organization. This includes creating and managing multiple accounts, monitoring organizational usage, and configuring global replication. This role is highly privileged and exists above the ACCOUNTADMIN level, allowing for centralized control over the enterprise's Snowflake footprint while maintaining segregation between different business units or environments within the same organization.

Answer

To manage data access within a single account.

Answer

To query all data across the entire organization.

Answer

To assign roles to users within a single database.

Question 10

A data engineer needs to ensure that sensitive PII columns are masked for all users except for a specific group of HR analysts. Which Snowflake feature is the most efficient and scalable solution to implement this requirement?

Accepted Answer

Implement Dynamic Data Masking policies on the sensitive columns.. Dynamic Data Masking (DDM) allows centralized management of data access policies based on the user's role. By attaching a masking policy to a column, Snowflake automatically evaluates the user's role at query runtime. This approach is superior to static masking or manual view management because it centralizes governance, minimizes data duplication, and ensures that security policies remain consistent regardless of how the user accesses the underlying table.

Answer

Create secure views for every user role in the account.

Answer

Use the UNMASK function in every query selecting sensitive data.

Answer

Apply Row-Level Security to hide rows containing sensitive PII.

Question 11

An organization wants to restrict access to Snowflake based on the source IP address of the client application. Which object should the administrator configure to enforce this network-level security?

Accepted Answer

Network Policy. Network policies are the primary mechanism for restricting access to Snowflake based on IP addresses. By defining allowed and blocked IP ranges, administrators can protect the account from unauthorized access attempts originating from outside the corporate network. This is a foundational governance task that ensures only trusted traffic can reach the Snowflake service, effectively mitigating risks associated with stolen credentials or external malicious activity.

Answer

Authentication Policy

Answer

Access Control Policy

Answer

Session Policy

Question 12

Which of the following describes the correct order of precedence for role inheritance in Snowflake?

Accepted Answer

Parent roles inherit all privileges granted to their child roles.. Snowflake utilizes a hierarchical RBAC model where privileges are additive. When a role is granted to another role, the parent role inherits all privileges assigned to the child role. This design allows for the creation of functional roles that map to business units or job tasks, ensuring that permissions are managed efficiently and transparently throughout the entire organizational structure of the account.

Answer

Object-level privileges override role-level inheritance.

Answer

Privileges are inherited only from the ACCOUNTADMIN role.

Answer

Child roles always inherit the privileges of the parent role.

Question 13

Refer to the exhibit. A user with the role 'ANALYST_ROLE' cannot see tables inside the 'sales_db.public' schema despite having 'USAGE' on the database. What is the most likely reason for this access issue?

Accepted Answer

The user lacks the 'USAGE' privilege on the schema.. In Snowflake, the USAGE privilege on a database is insufficient to view objects within schemas; the user must also be granted USAGE on the schema and SELECT on the specific tables or views. This multi-layered privilege requirement is a core component of Snowflake's security model, preventing accidental data exposure by requiring explicit grants at every level of the object hierarchy, from the database down to the individual object.

Answer

The user needs the 'OWNERSHIP' privilege on the schema.

Answer

The database is not set as the default database for the user.

Answer

The user is missing the 'MANAGE GRANTS' privilege.

Question 14

What is the primary function of the 'SECURITYADMIN' role in Snowflake's RBAC model?

Accepted Answer

Managing access control, including users and roles.. The SECURITYADMIN role is dedicated to the management of users, roles, and grants. By separating administrative duties into distinct roles like SECURITYADMIN (for access) and SYSADMIN (for objects), Snowflake enables a clear separation of concerns. This is a critical governance practice that prevents a single individual from having both the ability to create objects and the ability to assign permissions to those objects, thereby reducing the risk of unauthorized access.

Answer

Creating and managing virtual warehouses.

Answer

Granting ownership of data objects to users.

Answer

Monitoring account-level credit consumption.

Question 15

Refer to the exhibit. What happens if a user with the 'ANALYST' role queries the 'ssn' column protected by this policy?

Accepted Answer

The column value is replaced with the masked output.. When a masking policy is applied, Snowflake evaluates the condition at query runtime. If the condition evaluates to FALSE for the current user's role, Snowflake replaces the data with the masked value defined in the policy. This ensures that sensitive data is only revealed to authorized users, protecting the organization from unauthorized data exposure while allowing the schema and query logic to remain unchanged for all users.

Answer

The query fails with an 'Access Denied' error.

Answer

The query returns NULL for all rows.

Answer

The user sees the unmasked ssn data.