CCNA Sf De Data Governance Questions

Data Classification samples a limited number of rows to infer the semantic category. If the sample does not contain a sufficient number of email addresses (e.g., due to low frequency or sampling randomness), the column may not be classified as EMAIL. This is a common reason for missed classifications. The engineer can adjust the sampling or manually tag the column. This option correctly identifies the sampling limitation as the likely cause.

Data Classification scans tables and views to identify PII and other sensitive data. When enabled on a table, it automatically tags columns and can send notifications via email or integration when new sensitive columns are detected, ensuring ongoing protection.

Secure views provide a layer of obfuscation where the view definition and internal query structure are hidden from all users except those with specific ownership privileges. This prevents users from reverse-engineering the logic used to create the view, which is a key requirement for secure multi-tenant or external data sharing.

Query History captures all queries executed, including the user, role, and SQL text. It can be used to attribute data usage to specific users and roles. While it does not directly record column-level access, it provides a comprehensive audit trail of query activity. Combined with other features, it helps meet the requirement for auditable access.

The 'base_objects_accessed' column performs a recursive look-through of views to identify the original source tables. This ensures that even if sensitive data is hidden behind multiple layers of views, the security administrator can still track exactly which underlying physical tables were accessed by the user.

Row access policies and masking policies operate independently and both are enforced. The row access policy filters the result set to rows where REGION matches CURRENT_REGION(), while the masking policy on BALANCE transforms the value to NULL for roles outside FINANCE. The analyst therefore sees only their region's rows, and every BALANCE in those rows is NULL. This is the expected combined behavior when both policy types are attached.

Snowflake Data Classification is designed to discover and classify sensitive data like PII. It utilizes built-in system tags to label columns, which can then be used to trigger automated security controls, ensuring that sensitive data is protected according to organizational compliance standards without requiring extensive manual effort.

ACCESS_HISTORY provides a detailed, audit-ready log of data access. It tracks which users accessed which tables, views, and columns. This is the standard tool for governance teams to verify compliance with data privacy regulations and ensure that only authorized roles are interacting with protected data assets.

TAG_REFERENCES is the account usage view that lists all tag references, including the tag name, tag value, and the object (such as a column) to which the tag is applied. It is the correct source for auditing tag assignments across the account.

To run Data Classification, the role must have USAGE privileges on the database and schema, as well as SELECT on the table. Without USAGE, the role cannot access the objects to perform the classification. This privilege is a prerequisite and is typically granted to the role that will execute the classification process. Therefore, this action is required.

A masking policy is the native Snowflake column-level security object designed for this exact scenario. Creating it with CREATE MASKING POLICY and attaching it via ALTER TABLE ... MODIFY COLUMN ... SET MASKING POLICY makes the policy evaluate on every query of the SSN column, returning the raw value only to roles listed in the policy body (such as PII_ADMIN) and a redacted value to everyone else. No application SQL changes are needed.

ACCOUNT_USAGE contains views that track every query, access event, and configuration change. This data is essential for governance audits, as it provides a transparent and immutable history of what happened in the account, allowing for detailed investigation and reporting required by modern data compliance standards.

Data Classification automatically scans tables and identifies sensitive columns, applying system tags. After reviewing the results, the engineer can create masking policies and attach them to the tagged columns. This sequence leverages automation and ensures policies are applied where needed.

A Row Access Policy is a schema-level object that can be added to a table to filter rows based on conditions evaluated at query time. It can reference a mapping table like USER_DEPARTMENT to dynamically determine the user's department and restrict rows. This meets the requirement of dynamic filtering without altering the table structure. It is the correct feature for row-level security in Snowflake.

The GRANTS_TO_USERS view in the ACCOUNT_USAGE schema contains a record of all role grants to users, including the role name, grantee name, and grant date. Querying this view with a filter on the ROLE column for 'SYSADMIN' will return the required audit information. It is the correct and efficient source for this data.

ACCESS_HISTORY is specifically designed for auditing data access at the column level. It records the relationships between users, the queries they run, and the tables or columns those queries accessed. This is the primary tool for governance teams to generate compliance reports and prove data security.

Query History in the ACCOUNT_USAGE schema captures detailed information about every query executed, including the query text, the user who ran it, and the execution time. This is the standard Snowflake feature for auditing query activity and meets the requirement to log queries against the sensitive table.

Tag-based masking policies allow you to define a masking policy and associate it with a specific tag. When the tag is applied to a column, the masking policy is automatically applied. This streamlines governance, reduces maintenance, and ensures consistency across large, evolving datasets in the enterprise.

Tag-based masking policies are enforced based on the tag assignment and the masking policy's conditions, independent of the user's privileges on the tag itself. The analyst lacks USAGE on the tag, so they cannot see the tag metadata, but the masking policy still applies to the column when queried. Thus the SSN appears masked.

A masking policy is a schema-level object that can be attached to a column and evaluates at query time. It can inspect the user's role and conditionally return a masked value, such as showing only the last four digits, while storing the original data unchanged. This directly satisfies the requirement for dynamic, role-based transformation without altering the underlying table data.

A masking policy is applied to a column and can conditionally mask its values based on the user's role. By creating a masking policy that returns the actual salary for FINANCE_ANALYST and a masked value for others, the engineer can meet the requirement. This is the standard Snowflake feature for column-level security and dynamic data masking.

Snowflake follows a 'bottom-up' precedence rule for object tagging. A tag explicitly applied to a lower-level object, such as a table, will always take precedence over the same tag inherited from a higher-level container like a schema or database, allowing for specific overrides of general governance policies.

Data Classification scans table columns and applies system tags like SNOWFLAKE.CORE.SSN based on semantic and pattern matching. By creating a custom classification profile that includes SSN detection, the team can automatically tag all relevant columns account-wide. This satisfies the requirement for automatic detection and tagging without manual intervention.

Tags allow for the classification of data assets, enabling administrators to identify sensitive information and apply policies programmatically. This is a fundamental component of data governance, as it provides a structured way to manage and protect data across large, complex schemas without requiring manual column-level configuration.

Snowflake evaluates Row Access Policies first to determine which rows a user can access, then applies Masking policies to the columns within those allowed rows. This sequential order is essential for maintaining strict security boundaries, as it prevents users from performing operations on rows they are not authorized to see.

Access History provides a detailed audit of which columns and tables were accessed by a query. This is essential for governance, as it allows administrators to identify if unauthorized roles are attempting to access sensitive data, providing the foundation for automated security alerting and compliance reporting.

Applying masking policies to the base table ensures that even if the underlying data is accessed via a view, the masking rules are still enforced. Using a secure view provides the added benefit of hiding the underlying schema metadata, making this the most secure approach for external data sharing.

Centralizing governance objects enables a single source of truth for security policies. This simplifies the management of privileges and makes auditing significantly easier, as all policies are located in one place. It also allows for clear separation of duties between the security team and the data engineering team.

Snowflake's data classification service uses a set of predefined system tags, such as 'SNOWFLAKE.CORE.EMAIL' or 'SNOWFLAKE.CORE.PHONE', to identify and label columns. These tags help categorize data automatically, allowing administrators to apply governance policies based on these labels rather than manually tagging every column in the database.

By applying tags to databases or schemas, organizations can monitor usage and associate costs with specific projects or departments. This visibility is essential for cost management, as it allows leadership to identify high-cost areas and optimize resource consumption based on actual business value and departmental activity.

Access History captures column-level access information for queries, including which columns were read and written. It is designed for auditing and compliance, and the data is retained for 365 days. This meets the requirement of tracking column access and retaining for one year. Therefore, Access History is the correct feature.

Row access policies are designed to filter rows based on conditions such as the current role. By defining a policy that returns TRUE only when the role is COMPLIANCE_OFFICER or when ACCOUNT_STATUS is not 'DELINQUENT', the engineer enforces exactly the required row-level security. This is the standard Snowflake mechanism for row-level filtering.

The performance of a Row Access Policy depends heavily on how well Snowflake can prune data. If the mapping table is large or poorly structured, the policy evaluation can become a bottleneck. Keeping mapping tables lean and indexed via clustering ensures that the join logic does not force unnecessary data scanning.

Snowflake Data Classification includes built-in semantic categories such as SSN that automatically identify and tag columns containing Social Security numbers. By applying classification to the entire PROD database, the steward can scan all schemas and tables without manual effort. The system assigns tags like SNOWFLAKE.CORE.SSN to matching columns, enabling automated governance.

Applying a masking policy directly to columns provides a centralized way to enforce data governance. By granting the APPLY MASKING POLICY privilege to a governance role, you ensure that security policies are managed by the data security team rather than the database owners, following the principle of least privilege.

The ACCOUNT_USAGE.TAG_REFERENCES view contains a comprehensive record of all tag associations across the entire Snowflake account, including those in different databases. This view is the standard for account-wide governance and auditing, allowing for a single query to return all objects tagged with specific compliance-related labels.

Row Access Policies allow for conditional logic that incorporates context functions like CURRENT_USER or session attributes. This enables the implementation of fine-grained access control where rows are only visible if the user's location satisfies specific regulatory requirements or internal business rules defined within the policy's SQL expression.

Snowflake's native object tagging allows custom tags to be created with CREATE TAG, applied to columns, tables, and other objects, and governed through the APPLY TAG privilege on the tag. By granting APPLY TAG only to TAG_ADMIN, the engineer ensures only that role can assign or change the tag on objects. This directly satisfies both the categorization and the access-control requirements using a single governance feature.

Snowflake Data Classification automatically scans tables and views, identifies sensitive data using native and custom classifiers, and assigns system tags such as SNOWFLAKE.CORE.PRIVACY_CATEGORY. This directly addresses the need to discover and tag personal data across many databases with minimal manual effort. The system tags can then be used to drive masking policies, making this the correct approach.

Tag-based masking policies allow you to associate a masking policy with a tag. When the tag is applied to a column, the masking policy is automatically enforced. This ensures consistent protection across all tables that use the tag, and new columns tagged later are automatically covered. It meets the requirement for consistent masking based on a tag.

Snowflake allows masking policies to be attached to system tags, including those created by Data Classification. This enables automatic masking of columns that are classified as sensitive, such as those tagged with SEMANTIC_CATEGORY = 'PII'. The masking policy is then enforced whenever the tag is present on a column.

If the policy references the mapping table without fully qualifying it (e.g., using just TENANT_MAPPING instead of DB.SCHEMA.TENANT_MAPPING), the resolution depends on the session's current database and schema. Users with different session contexts might resolve the table incorrectly, leading to no matching rows. This is a common pitfall. Fully qualifying objects in policies ensures consistent behavior regardless of session settings, which is why this is the most likely cause.