DEA-C02 Data Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Implement a Row Access Policy that uses a mapping table to determine the user's department and filters rows accordingly.

  Why this is correct

  A Row Access Policy is a schema-level object that can be added to a table to filter rows based on conditions evaluated at query time. It can reference a mapping table like USER_DEPARTMENT to dynamically determine the user's department and restrict rows. This meets the requirement of dynamic filtering without altering the table structure. It is the correct feature for row-level security in Snowflake.

• ✗

  Create a secure view that joins TRANSACTIONS with USER_DEPARTMENT and filters rows based on the current user's department.

  Why it's wrong here

  A secure view can restrict data, but it requires users to query the view instead of the base table. If users have access to the base table, they can bypass the view. The requirement is to apply the policy dynamically without modifying the table, implying that access to the table itself should be filtered. A row access policy is more appropriate because it attaches directly to the table and enforces filtering regardless of how the table is queried.

• ✗

  Use a Column-level Security policy with a masking policy that returns NULL for rows not belonging to the user's department.

  Why it's wrong here

  Column-level Security and masking policies are designed to mask column values, not to filter rows. They cannot restrict which rows are returned; they only alter the data within columns. Using a masking policy to simulate row filtering would still return all rows, just with some values masked, which does not meet the requirement of restricting access to specific rows. Therefore, this option is incorrect.

• ✗

  Create a dynamic data masking policy that checks the user's department and masks the entire row if the department does not match.

  Why it's wrong here

  Dynamic data masking policies operate on columns and cannot mask entire rows. They can only transform column values. There is no mechanism to mask a row as a whole; masking is column-specific. To restrict rows, a row access policy is needed. This option misunderstands the scope of masking policies and would not achieve the desired row-level filtering.