Protecting sensitive data with masking, row access policies, and Data Clean Rooms

Snowflake provides multiple layers of data protection including encryption at rest and in transit, role-based access control, and specialized policies for masking and filtering sensitive data. Data engineers must know how to implement and manage these features to meet compliance and security requirements. Understanding the interaction between these mechanisms and their scope of application is critical for the exam.

1 · Learn the must-know

• 1Snowflake encrypts all data at rest by default using AES-256 encryption, with no user configuration required, and supports Tri-Secret Secure using customer-managed keys (CMK) combined with Snowflake-managed keys for additional control (Business Critical edition and above).
• 2Dynamic Data Masking uses masking policies (schema-level objects) applied to columns to conditionally obfuscate data based on the querying role, without altering the underlying stored data.
• 3Row Access Policies control which rows are visible to which roles by applying conditional logic at query time, and can be combined with mapping tables for scalable row-level security.
• 4A single column can have only one masking policy attached at a time, but masking and row access policies can be applied together on the same table for combined column- and row-level protection.
• 5Object tagging can be paired with masking policies (tag-based masking policies) to automatically apply protection to any column carrying a specific tag, simplifying governance at scale across many tables.
• 6Network policies, along with features like private connectivity and IP allow/block lists, restrict where connections to Snowflake can originate from, complementing data-level protections with network-level security.

3 · Keep going

These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.