Data Governance, Lineage and Trust Center — Snowflake SnowPro Core practice questions

Dynamic Data Masking does what?

1. Encrypts the column values at rest in the cloud storage
2. Returns masked values at query time based on the role
3. Deletes sensitive columns from the underlying base table
4. Disables multi-factor authentication for the role

Answer: B — Returns masked values at query time based on the role

B) Correct — a masking policy is evaluated at query time against the current role and substitutes a masked value for unauthorized roles. A) At-rest encryption is always on and separate. C) Nothing is deleted. D) Masking has no bearing on MFA.

A query against ACCOUNT_USAGE views can be:

1. Real-time, exactly matching INFORMATION_SCHEMA for every view
2. Subject to latency, up to about 45 minutes or more per view
3. Instant always, because the views read live metadata directly
4. Deprecated in favor of querying the Snowsight activity page

Answer: B — Subject to latency, up to about 45 minutes or more per view

B) Correct — ACCOUNT_USAGE views carry documented latency that varies by view. A) The two schemas differ in both freshness and scope. C) The data is materialized on a delay, not read live. D) ACCOUNT_USAGE is fully supported and widely used.

Object tags are used to:

1. Label objects and columns for governance and cost use
2. Speed up queries by adding metadata the optimizer reads
3. Cluster data by reordering rows across micro-partitions
4. Cache query results so repeated queries avoid a scan

Answer: A — Label objects and columns for governance and cost use

A) Correct — tags carry metadata that drives policies (such as tag-based masking) and cost or classification reporting. B) Tags are not a performance feature. C) Reordering rows is what a cluster key does. D) Caching is handled by the result cache.

A governance team wants a masking policy to apply automatically to every column tagged PII, including columns tagged in the future. The MOST appropriate approach is:

1. Attach the masking policy directly to each tagged column as it is discovered
2. Run a scheduled task that reads the tag references view and alters columns
3. Create a future grant of the masking policy on the schema
4. Assign the masking policy to the tag itself so tagged columns are protected

Answer: D — Assign the masking policy to the tag itself so tagged columns are protected

D) Correct — a tag-based masking policy is set on the tag, so any column carrying that tag is protected without per-column attachment. A) is the manual approach the team is explicitly trying to avoid. C) misapplies future grants, which govern privileges rather than policy attachment. B) is a workaround that reintroduces lag and operational risk when a native capability exists.

A single sales table must show each regional manager only their own region's rows, with no duplication of the table. The BEST mechanism is:

1. A row access policy mapped to a lookup table of role-to-region
2. A masking policy on the region column keyed to the current role
3. Separate secure views per region granted to the matching role
4. A clustering key on region so each role scans only its partitions

Answer: A — A row access policy mapped to a lookup table of role-to-region

A) Correct — row access policies filter rows at query time and commonly join a mapping table to resolve which rows a role may see. B) hides a column value but still returns every row. C) works but creates and maintains one object per region and leaves the base table exposed. D) confuses a performance feature with a security control; clustering never restricts visibility.

A provider wants to share a subset of a table's columns and rows with a consumer account. Which object type must be added to the share?

1. A standard view over the base table, granted to the consumer role
2. A materialized view restricted to the shared columns
3. A clone of the base table filtered at creation time
4. A secure view over the base table, added to the share

Answer: D — A secure view over the base table, added to the share

D) Correct — only secure views may be shared, because sharing a standard view would risk exposing base-table structure and data to the consumer. A) fails for that reason and cannot be added to a share. B) is not a shareable object and also does not solve the exposure concern. C) technically shares data but is a static copy that must be rebuilt as the source changes.

All of the following are governance advantages of running Cortex AI functions inside Snowflake EXCEPT:

1. Data processed by the functions stays within Snowflake's security boundary
2. Existing role-based access control governs who can use the functions
3. Usage can be monitored and limited by administrators
4. Model outputs are automatically guaranteed free of inaccuracies

Answer: D — Model outputs are automatically guaranteed free of inaccuracies

A) True benefit — data does not leave the governed platform. B) True — RBAC (e.g., the CORTEX_USER database role) gates access. C) True — admins can track and restrict consumption. D) Correct exception — no platform can guarantee LLM outputs are accurate; results still require human validation.

What does the ACCESS_HISTORY view provide that the query history does not?

ACCESS_HISTORY records the specific columns and objects that each query read and wrote, including through views. This supports column-level lineage, sensitive-data access auditing, and impact analysis, whereas query history only records the statements themselves.

Row Access Policies?

Filter rows visible per user/role/context. Like row-level security in DBs.

What does Snowflake data classification do?

Classification profiles a column's data and assigns system categories — a semantic category such as name or email, and a privacy category such as identifier, quasi-identifier, or sensitive. The results can be persisted as tags, which can then drive tag-based masking policies.

Standard view vs Secure view?

Standard: query rewritten + optimizer may inspect underlying objects. Secure: definition hidden, optimization limited but data is protected.