DEA-C02 Data Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A tag-based masking policy using the TAG_STRING system function.

  Why it's wrong here

  While tag-based masking policies exist, the TAG_STRING function is not a valid Snowflake function for retrieving tag values in this context. The requirement does not mention tags; it specifies role-based masking. Using a tag-based approach adds unnecessary complexity and does not directly address the need for a role condition on the CREDIT_CARD_NUMBER column.

• ✗

  A row access policy applied to the TRANSACTIONS table.

  Why it's wrong here

  A row access policy filters which rows a user can see based on conditions, but it does not transform column values. It cannot obscure a portion of a column's content; it only includes or excludes entire rows. Since the requirement is to mask the credit card number while still returning the row, a row access policy is not appropriate.

• ✓

  A masking policy applied to the CREDIT_CARD_NUMBER column.

  Why this is correct

  A masking policy is a schema-level object that can be attached to a column and evaluates at query time. It can inspect the user's role and conditionally return a masked value, such as showing only the last four digits, while storing the original data unchanged. This directly satisfies the requirement for dynamic, role-based transformation without altering the underlying table data.

• ✗

  A secure view that selects only the last four digits of the column.

  Why it's wrong here

  A secure view can restrict access and hide the view definition, but it does not provide conditional, role-based masking within the same column for different users. To achieve role-based masking, you would still need a masking policy inside the view. A plain secure view cannot dynamically decide which users see the full value and which see the masked value without additional policy logic.