DEA-C02 Data Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A masking policy that returns the tag value for authorized roles and NULL for others.

  Why it's wrong here

  Masking policies transform column values at query time; they do not assign or store metadata tags on objects. Using a masking policy to simulate tagging would not create queryable tag metadata, would not integrate with tag-based governance views, and would not provide the APPLY TAG privilege model. The requirement is about metadata categorization and controlled tag assignment, which is the domain of object tagging, not masking.

• ✓

  Object tagging with a tag created via CREATE TAG, assigning tags to columns with ALTER TABLE ... SET TAG, and granting the APPLY TAG privilege only to TAG_ADMIN.

  Why this is correct

  Snowflake's native object tagging allows custom tags to be created with CREATE TAG, applied to columns, tables, and other objects, and governed through the APPLY TAG privilege on the tag. By granting APPLY TAG only to TAG_ADMIN, the engineer ensures only that role can assign or change the tag on objects. This directly satisfies both the categorization and the access-control requirements using a single governance feature.

• ✗

  Snowflake Data Classification, which automatically detects and tags columns with system tags.

  Why it's wrong here

  Data Classification uses system-defined tags such as SNOWFLAKE.CORE.SEMANTIC_CATEGORY and SNOWFLAKE.CORE.PRIVACY_CATEGORY, and it is designed for automatic discovery of sensitive data rather than custom business tags like COST_CENTER or DATA_OWNER. It also does not provide a mechanism to restrict tag modification to a specific role in the way the requirement describes. Custom governance tags require the object tagging feature instead.

• ✗

  Access control policies created with CREATE ACCESS POLICY and bound to the target columns.

  Why it's wrong here

  Snowflake does not have a CREATE ACCESS POLICY object for column-level tagging. Access control in Snowflake is handled through role-based privileges, masking policies, row access policies, and object tagging. There is no native object called an access policy that would categorize columns with custom business tags. This option describes a feature that does not exist in Snowflake, so it cannot meet the requirement.