The correct answer is D. Dynamic Data Masking .
Dynamic Data Masking is used to protect sensitive column values at query run time. It allows Snowflake to return different values depending on the user’s role or other policy logic.
Why D is correct:
A masking policy can be applied to a table or view column. When a query runs, Snowflake evaluates the masking policy and determines whether to return the original value, a partially masked value, or a fully masked value.
Example concept:
CREATE MASKING POLICY phone_mask AS (val STRING)
RETURNS STRING - >
CASE
WHEN CURRENT_ROLE() IN ( ' CUSTOMER_SUPPORT_FULL ' ) THEN val
ELSE CONCAT( ' XXX-XXX- ' , RIGHT(val, 4))
END;
This protects sensitive phone numbers at query time without changing the underlying stored data.
Why the other options are incorrect:
A. Object tagging classifies or labels data for governance, but it does not mask values at query runtime by itself.
B. Data encryption protects data at rest and in transit, but it does not dynamically change query results based on role.
C. UDFs can implement custom logic, but Snowflake’s built-in governance feature for runtime masking is Dynamic Data Masking.
Official Snowflake documentation reference:
Snowflake documentation describes Dynamic Data Masking as a column-level security feature that uses masking policies to selectively mask plain-text data in query results at runtime.
[Reference: Snowflake Documentation — Dynamic Data Masking; Snowflake Documentation — Masking policies; SnowPro Core Study Guide — Data Protection and Governance., , ]
