Implement Data Protection and Encryption ARA-C01 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which encryption options are available for external stages in Snowflake?

   • AOnly client-side encryption
   • BOnly Snowflake-managed encryption
   • CNo encryption is supported for external stages
   • DServer-side encryption and client-side encryption
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A multinational company has a Snowflake account with a masking policy on a sensitive column. The policy currently masks data for all roles except the 'ADMIN' role. The compliance team has a new requirement: users in the 'FINANCE' role should also see the actual data, but only when they are connected from the corporate network. Which approach should be used?

   • AGrant the FINANCE role the ADMIN role to bypass the masking policy.
   • BCreate a separate masking policy for FINANCE users that returns the actual value only when the user's IP is in the corporate range.
   • CModify the masking policy to return the actual value for both ADMIN and FINANCE roles, and create a network policy that blocks FINANCE users from accessing Snowflake outside the corporate network.
   • DUse a row-level access policy to filter rows based on the user's IP address.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A data analyst needs to unload a query result to an external stage on Azure Blob Storage. The security team requires that the data be encrypted in transit and at rest. Which combination of settings should be used in the COPY INTO <location> command?

   • ASet ENCRYPTION = (TYPE = 'AZURE_SSE') in the COPY command.
   • BUse the COPY command with the CREDENTIALS option to enable encryption.
   • CUse the default encryption settings; Snowflake automatically encrypts data in transit and at rest.
   • DCreate the external stage with ENCRYPTION = (TYPE = 'AZURE_SSE') and use the COPY command without additional encryption options.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is required to use customer-managed keys for Snowflake encryption. They have enabled Tri-Secret Secure with AWS KMS. The security team wants to ensure that if the AWS KMS key is deleted, Snowflake data remains recoverable. What should they do?

   • AEnable key rotation on the AWS KMS key to prevent deletion.
   • BDisable Tri-Secret Secure and use Snowflake-managed keys to avoid the risk.
   • CStore a backup of the AWS KMS key in a secure location.
   • DContact Snowflake support to recover the account using the Snowflake-managed key fragment.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A healthcare organization is required to use customer-managed encryption keys to meet regulatory compliance. They have enabled Tri-Secret Secure with Azure Key Vault. The security team wants to understand what happens if the Azure Key Vault key is temporarily unavailable. Which statement accurately describes the impact on Snowflake data access?

   • AData remains accessible because Snowflake caches the unwrapped account master key, but new key wrapping operations may fail until the key is restored.
   • BData remains fully accessible and no impact occurs because the customer-managed key is only used for auditing purposes.
   • CData becomes inaccessible until the key is restored, because the customer-managed key is required for every decryption operation.
   • DAll data is automatically re-encrypted with Snowflake-managed keys to avoid any disruption.
   Reveal Solution Discussion Select an answer first