DEA-C02 Data Governance Practice Question
A financial services firm stores account balances in a Snowflake table ACCOUNTS. A row access policy is defined so that analysts see only rows where REGION = CURRENT_REGION(). The firm also attaches a masking policy to the BALANCE column that returns NULL for users without the FINANCE role. An analyst with the ANALYST role queries SELECT REGION, BALANCE FROM ACCOUNTS. What will the analyst see?
⚠ Common exam trap
The trap here is believing that one policy type overrides the other, when in fact row filtering and column masking are applied independently and combine in the result.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Only rows matching the analyst's region, with BALANCE values returned as NULL because the analyst lacks the FINANCE role.
Row access policies and masking policies are complementary and both are enforced at query time. The row access policy constrains which rows are visible based on the region predicate, while the masking policy rewrites the BALANCE value for roles not granted the FINANCE role. The analyst therefore sees a region-filtered result set in which BALANCE is NULL, demonstrating defense in depth.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An error is raised because a table cannot have both a row access policy and a masking policy attached.
Why it's wrong here
Snowflake explicitly supports attaching both row access policies and masking policies to the same table, and they are designed to work together. There is no restriction preventing the combination. The query will execute successfully and return the filtered rows with masked values. The error scenario described here does not exist in Snowflake's policy framework, so this option is incorrect.
- ✓
Only rows matching the analyst's region, with BALANCE values returned as NULL because the analyst lacks the FINANCE role.
Why this is correct
Row access policies and masking policies operate independently and both are enforced. The row access policy filters the result set to rows where REGION matches CURRENT_REGION(), while the masking policy on BALANCE transforms the value to NULL for roles outside FINANCE. The analyst therefore sees only their region's rows, and every BALANCE in those rows is NULL. This is the expected combined behavior when both policy types are attached.
- ✗
All rows in ACCOUNTS, but BALANCE values are NULL for every row.
Why it's wrong here
The row access policy is still active even though a masking policy is also present. Masking policies do not disable row access policies, so the analyst will not see rows outside their region. The combination filters rows first and then masks values, meaning the analyst sees a restricted row set with NULL balances, not the full table. Assuming masking overrides row filtering is a common misconception.
- ✗
Only rows matching the analyst's region, with actual BALANCE values visible because row access policies take precedence.
Why it's wrong here
Row access policies and masking policies have no precedence relationship that would disable one another. The masking policy on BALANCE is evaluated for every returned row regardless of how the row set was filtered. Because the analyst lacks the FINANCE role, the masking policy returns NULL. The analyst will not see actual balances, so this option misstates how the two policy types interact.
About these practice questions
Courseiva writes every DEA-C02 question from scratch — 229 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Snowflake exam blueprint
This DEA-C02 practice question is part of Courseiva's free Snowflake certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C02 exam.