COF-C03 Account Management and Data Governance Practice Test 5 — 15 Questions

Question 1

A company requires all data at rest within Snowflake to be encrypted using a customer-provided key. Which feature should they implement?

Accepted Answer

Tri-Secret Secure.. Tri-Secret Secure is the Snowflake feature that allows customers to manage their own encryption keys, providing an extra layer of security beyond Snowflake's standard managed keys. This is critical for highly regulated industries like finance or healthcare that require strict control over data encryption. By using their own keys, customers ensure that even if Snowflake infrastructure were compromised, the data remains inaccessible without the customer-held key materials.

Answer

Always Encrypted.

Answer

Transparent Data Encryption (TDE).

Answer

Client-Side Encryption.

Question 2

Which of the following describes the purpose of 'Time Travel' from a data governance perspective?

Accepted Answer

To provide a mechanism for restoring deleted or altered data.. Time Travel allows for the recovery of data that was accidentally deleted or modified, serving as a critical safety net for data governance. By enabling the retention of historical data, Snowflake empowers administrators to restore states after human error, minimizing data loss and operational downtime. This functionality is essential for maintaining data integrity and business continuity, ensuring that the organization can reliably recover from unintended data lifecycle events without needing to restore from full backups.

Answer

To improve query performance by caching historical results.

Answer

To hide sensitive data from users who do not have access.

Answer

To manage the lifecycle of virtual warehouses automatically.

Question 3

Which administrative role should be used to manage the lifecycle of warehouses and databases, while strictly avoiding the management of users and roles?

Accepted Answer

SYSADMIN. The SYSADMIN role is the standard role for creating and managing data objects such as databases, schemas, tables, and warehouses. It is distinct from the SECURITYADMIN role, which manages user identities and permissions. This separation of duties is a fundamental pillar of Snowflake's security architecture, ensuring that operational and administrative control over data objects is kept separate from the management of user access, thereby mitigating the risk of privilege escalation and internal misuse.

Answer

ACCOUNTADMIN

Answer

USERADMIN

Answer

SECURITYADMIN

Question 4

A data steward needs to ensure that a column containing email addresses is masked for all users except those with the role 'COMPLIANCE_OFFICER'. The masking should show a fixed string '****' for unauthorized users. Which Snowflake feature should be used?

Accepted Answer

Masking policy. A masking policy in Snowflake allows column-level security by dynamically masking data based on the user's role or other conditions. By applying a masking policy to the email column that returns '****' for all roles except 'COMPLIANCE_OFFICER', the data steward ensures that only authorized users see the actual email addresses. This is the correct feature for column-level masking.

Answer

Object tagging

Answer

Secure view

Answer

Row access policy

Question 5

A company's security team wants to ensure that when a user with the role PII_ANALYST queries a table, only rows where the region column equals 'US' are returned, but they do not want to create separate copies of the table for each region. Which Snowflake feature should they implement?

Accepted Answer

Row access policy. A row access policy is designed to filter rows based on a condition evaluated at query time, such as the user's role. By attaching a row access policy to the table, the security team can ensure that PII_ANALYST sees only rows where region equals 'US', while other roles may see different rows or all rows. This avoids data duplication and centralizes access control.

Answer

Object tagging

Answer

Secure view

Answer

Column-level masking policy

Question 6

An administrator needs to grant the role 'ANALYST' the ability to see all queries executed in the account for auditing purposes. Which privilege should be granted to 'ANALYST'?

Accepted Answer

MONITOR USAGE. To allow a role to view all queries executed in the account, the MONITOR USAGE privilege must be granted. This privilege provides access to the ACCOUNT_USAGE schema, including the QUERY_HISTORY view, which contains records of all queries. Other privileges like USAGE on a database or MANAGE GRANTS do not grant account-wide query visibility.

Answer

MANAGE GRANTS

Answer

SELECT on the QUERY_HISTORY view

Answer

USAGE on the database

Question 7

A security administrator needs to ensure that a set of sensitive columns in an existing table are automatically masked for all users except those with the role 'HR_ADMIN'. The masking must be applied without modifying the underlying data. Which Snowflake feature should be used?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking is the correct feature because it applies masking policies to columns, dynamically masking data based on the user's role at query time without altering stored data. It provides fine-grained control and is designed for this exact scenario of protecting sensitive columns from unauthorized users.

Answer

Secure Views

Answer

Object Tagging

Answer

Row Access Policies

Question 8

A user with the role 'SYSADMIN' wants to grant the privilege to create databases to a custom role 'DB_CREATOR'. Which command should the SYSADMIN execute?

Accepted Answer

GRANT CREATE DATABASE ON ACCOUNT TO ROLE DB_CREATOR;. The CREATE DATABASE privilege is an account-level privilege, so it must be granted with the ON ACCOUNT clause. The SYSADMIN role has the authority to grant this privilege. The correct command is GRANT CREATE DATABASE ON ACCOUNT TO ROLE DB_CREATOR;

Answer

GRANT CREATE DATABASE ON DATABASE mydb TO ROLE DB_CREATOR;

Answer

GRANT CREATE DATABASE TO ROLE DB_CREATOR;

Answer

GRANT USAGE ON DATABASE mydb TO ROLE DB_CREATOR;

Question 9

A security team at a healthcare company must guarantee that query results returned from a table named PATIENT_RECORDS are filtered based on the department of the user executing the query, without requiring any changes to existing SQL statements. The policy must evaluate a mapping table that lists each user and their department. Which Snowflake object should be created to meet this requirement?

Accepted Answer

A row access policy attached to the PATIENT_RECORDS table that references a mapping table.. Row access policies are the Snowflake feature designed to filter rows at query time based on the execution context, such as the current user or role. Because the policy is evaluated dynamically and can join against a mapping table, it enforces per-department visibility transparently: existing SQL statements continue to work, and users see only the rows their department is authorized to view.

Answer

A secure view defined over PATIENT_RECORDS that joins the mapping table.

Answer

A masking policy applied to the DEPARTMENT column of the PATIENT_RECORDS table.

Answer

A network policy that limits access to the PATIENT_RECORDS table by department IP ranges.

Question 10

A user with the role 'ANALYST' needs to be able to see the definition of a secure view named 'sales_view' in the 'sales_db' database. The view owner has granted SELECT on the view to ANALYST. However, when ANALYST runs SHOW VIEWS, the view definition is not visible. What is the most likely cause?

Accepted Answer

Secure views do not expose their definition to users who do not have the OWNERSHIP privilege on the view.. Secure views intentionally hide their definition from users who do not own the view. Even with SELECT privilege, non-owners cannot see the view's SQL definition. This is a key security feature of secure views.

Answer

The ANALYST role needs the MONITOR privilege on the view to see its definition.

Answer

The ANALYST role lacks the USAGE privilege on the database and schema.

Answer

The view definition is only visible if the user has the SELECT privilege on all underlying tables.

Question 11

A Snowflake account has a custom role named DATA_ENGINEER. The administrator wants to ensure that DATA_ENGINEER can create databases and warehouses but cannot manage users or roles. Which predefined role should DATA_ENGINEER be granted to achieve this?

Accepted Answer

SYSADMIN. SYSADMIN is the predefined role that provides privileges to create and manage warehouses, databases, and other objects. It does not include user or role management, which is handled by SECURITYADMIN and USERADMIN. By granting SYSADMIN to DATA_ENGINEER, the administrator ensures the role can perform its intended tasks without over-privileging it.

Answer

ACCOUNTADMIN

Answer

USERADMIN

Answer

SECURITYADMIN

Question 12

A data governance lead is configuring tag-based masking so that columns tagged with a PII classification are automatically protected. The lead creates a tag named PII_CLASSIFICATION and a masking policy, then applies the tag to several columns. Later, an analyst queries a tagged column and sees unmasked values. The masking policy was attached to the tag using ALTER TAG ... SET MASKING POLICY. What is the most likely cause?

Accepted Answer

The masking policy was attached to the tag but the tag was not applied to the specific column at the column level.. Tag-based masking requires two conditions to be satisfied: the masking policy must be associated with the tag, and the tag must be applied to the target column. If the tag was only created or applied at the table level rather than the column level, Snowflake has no tagged column to protect, so queries return the original values. Verifying the column's tag assignment resolves the issue.

Answer

Tag-based masking requires the tag to be a system tag rather than a user-defined tag.

Answer

The masking policy must be attached to the tag before the tag is created on the column, and the order was reversed.

Answer

The analyst's role has the ACCOUNTADMIN role granted, which bypasses all masking policies.

Question 13

A security administrator has created a masking policy that replaces the value of a column with a SHA2 hash for users without the role 'HR_ROLE'. The policy is applied to the 'SSN' column of the 'EMPLOYEES' table. A user with the role 'ANALYST_ROLE' queries the table and sees the hashed values. However, when the same user runs a query that includes the 'SSN' column in a WHERE clause, the query returns no results even though matching records exist. What is the most likely cause of this behavior?

Accepted Answer

The masking policy is applied to the column, but the user does not have the privilege to see the original values, so the WHERE clause is evaluated against the masked values, which do not match the search condition.. The correct answer is that the WHERE clause is evaluated against masked values. Masking policies transform data at query time, so any filtering or joining on the masked column uses the masked representation. This is a critical concept: masking does not prevent the column from being used in predicates, but it changes the data used for those predicates, which can lead to unexpected results if the user expects to filter on original values.

Answer

The user lacks the SELECT privilege on the table, so the query returns no rows.

Answer

The masking policy is not applied to the WHERE clause, so the original values are used for filtering, but the user cannot see them, resulting in an error.

Answer

The user's role has not been granted the USAGE privilege on the masking policy, so the policy is bypassed and the original values are used, but the user cannot see them due to column-level security.

Question 14

A governance team needs to implement data classification and access control for a new table containing sensitive data. They want to (1) tag columns with a sensitivity level, and (2) enforce that only users with a specific role can see the unmasked data. Which two Snowflake features should they use together to achieve these goals? (Choose two.)

Accepted Answer

Object tagging. Object tagging is used to classify columns with sensitivity levels, providing metadata for governance. Masking policies enforce column-level access control by dynamically masking data based on the user's role. Together, they satisfy both requirements: tagging for classification and masking for access enforcement. Other features like row access policies or secure views do not provide the needed column-level masking and tagging combination.

Answer

Network policy

Answer

Row access policy

Answer

Secure view

Question 15

An administrator discovers that a former employee's user account still exists and is still granted the ANALYST_ROLE. The administrator needs to immediately prevent the account from authenticating while preserving the account and its historical query metadata for an ongoing audit. Which action should the administrator take?

Accepted Answer

Run ALTER USER ... SET DISABLED = TRUE.. Disabling a user with ALTER USER ... SET DISABLED = TRUE immediately blocks authentication while keeping the account, its grants, and its metadata available for audit. Dropping the user or altering credentials does not preserve the account in the desired state, and revoking a role only removes one privilege path rather than blocking sign-in.

Answer

Run DROP USER on the former employee's account.

Answer

Run ALTER USER ... SET PASSWORD = NULL.

Answer

Run REVOKE ROLE ANALYST_ROLE FROM USER on the former employee's account.