COF-C03 Account Management and Data Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Grant the SECURITYADMIN role to all analysts so they can manage their own masking policies.

  Why it's wrong here

  Granting SECURITYADMIN broadly violates least privilege and gives analysts the ability to alter users, roles, and grants account-wide. It does not provide a scalable protection mechanism and actively increases risk. Managing masking policies should remain with a small governance group, and analysts should receive only the data access they require through roles.

• ✓

  Use the ACCOUNT_USAGE.TAG_REFERENCES view to audit which columns carry governance tags.

  Why this is correct

  TAG_REFERENCES in the ACCOUNT_USAGE schema records tag assignments across the account, including the object, column, and tag involved. Governance teams query it to verify coverage, find untagged sensitive columns, and produce audit evidence. It complements tag-based masking by providing visibility into where tags are applied, which is essential for a scalable classification program.

• ✗

  Apply a separate masking policy to every sensitive column using ALTER TABLE for each column.

  Why it's wrong here

  Attaching a distinct masking policy to each column manually does not scale and is exactly the manual editing the team wants to avoid. It also creates maintenance overhead because policy changes must be repeated across many objects. Tag-based masking is the intended alternative for consistent, centralized protection across many tables.

• ✗

  Enable Tri-Secret Secure to automatically classify and mask sensitive columns.

  Why it's wrong here

  Tri-Secret Secure is a security feature that combines a Snowflake-managed key with a customer-managed key for encryption at rest. It protects data cryptographically but does not classify columns or apply masking policies, so it does not fulfill the governance team's requirement to classify and mask sensitive data consistently across many tables.

• ✓

  Create tags and associate masking policies with them, then apply the tags to columns across tables.

  Why this is correct

  Tag-based masking lets a governance team define a tag, attach a masking policy to that tag, and then apply the tag to any number of columns. Protection scales because the policy follows the tag, so adding a new tagged column automatically inherits the masking behavior without editing each table definition or creating a separate policy per column.