COF-C03 Account Management and Data Governance Practice Question
A company requires all data at rest within Snowflake to be encrypted using a customer-provided key. Which feature should they implement?
⚠ Common exam trap
Candidates often confuse Tri-Secret Secure with standard encryption-at-rest or external tokenization, failing to recognize that Tri-Secret Secure specifically involves customer-managed keys (CMK).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tri-Secret Secure.
Tri-Secret Secure is the Snowflake feature that allows customers to manage their own encryption keys, providing an extra layer of security beyond Snowflake's standard managed keys. This is critical for highly regulated industries like finance or healthcare that require strict control over data encryption. By using their own keys, customers ensure that even if Snowflake infrastructure were compromised, the data remains inaccessible without the customer-held key materials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Always Encrypted.
Why it's wrong here
Always Encrypted is a feature associated with Microsoft SQL Server and is not a feature or concept within Snowflake. Snowflake uses its own proprietary approach for data encryption at rest and in transit, which does not utilize the 'Always Encrypted' naming convention or its corresponding technical implementation.
- ✓
Tri-Secret Secure.
Why this is correct
Tri-Secret Secure combines Snowflake-managed keys with customer-managed keys (CMK) stored in a key management service. This architecture ensures that data remains encrypted with keys that are under the customer's direct control, satisfying stringent compliance and data privacy requirements for sensitive organizational data stored in the cloud.
- ✗
Transparent Data Encryption (TDE).
Why it's wrong here
TDE is the foundational encryption technology used by Snowflake to encrypt all data at rest by default. However, it is managed by Snowflake. If a customer requires the use of their own keys, they must specifically implement Tri-Secret Secure, as standard TDE does not provide the customer-managed key capability.
- ✗
Client-Side Encryption.
Why it's wrong here
Client-side encryption involves the user encrypting data before it ever reaches Snowflake. While this provides maximum control, it breaks many Snowflake features like data sharing, time travel, and searching, as the engine cannot process the encrypted blobs. It is rarely the recommended solution for account-level data governance.
About these practice questions
This COF-C03 question is part of Courseiva's 280-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Snowflake exam blueprint
This COF-C03 practice question is part of Courseiva's free Snowflake certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the COF-C03 exam.