Design and Enforce Data Protection, Privacy, and Governance Across Snowflake SNOWPRO-ADVANCED-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which Snowflake feature allows you to automatically apply a masking policy to all columns with a specific tag?

   • AData sharing
   • BTime travel
   • CResource monitors
   • DTag-based masking policies
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A startup has a small data team where all users currently have the ACCOUNTADMIN role. The security engineer is tasked with implementing least-privilege access. The team needs to continue working with data, but no single user should have full administrative control. What should the security engineer do first?

   • ADisable the ACCOUNTADMIN role and create a new role for each user with only the privileges they need.
   • BCreate a custom role hierarchy with a SYSADMIN role for data operations and an ACCOUNTADMIN role reserved for a small number of administrators.
   • CCreate a single custom role with all necessary privileges and grant it to all users.
   • DGrant all users the SECURITYADMIN role instead of ACCOUNTADMIN, as it has fewer privileges.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the fundamental model for access control in Snowflake?

   • ADiscretionary access control (DAC)
   • BRole-based access control (RBAC)
   • CMandatory access control (MAC)
   • DAttribute-based access control (ABAC)
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A global company is subject to both GDPR and HIPAA. They store EU citizen health data in Snowflake. The GDPR requires that personal data of EU citizens not be transferred outside the EU without appropriate safeguards. The company currently has its Snowflake account in the US. What should the security engineer do to comply with GDPR data residency requirements?

   • AEncrypt the EU citizen health data with customer-managed keys stored in an EU KMS, and keep the data in the US account.
   • BApply a masking policy to the EU citizen health data so that only EU-based users can see the unmasked data.
   • CMove the EU citizen health data to a Snowflake account in an EU region and ensure that the data is not replicated to the US account.
   • DUse Snowflake's data sharing feature to share the data with an EU account, keeping the data in the US account.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which Snowflake feature allows you to automatically assign tags to columns based on the data they contain?

   • AClassification
   • BData masking
   • CResource monitors
   • DTime travel
   Reveal Solution Discussion Select an answer first