Why governance ensures data trust at scale in Snowflake - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a role with read-only access.

Snowflake

CREATE ROLE [1];

Drag options to blanks, or click blank then click option'

Awrite_access

Bdata_reader

Cadmin_role

Ddata_writer

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing a role name that implies write access instead of read-only.

The data_reader role is typically used for read-only access, which supports governance by limiting data modification.

2fill in blank

medium

Complete the code to grant SELECT permission on a table to a role.

Snowflake

GRANT [1] ON TABLE sales_data TO ROLE data_reader;

Drag options to blanks, or click blank then click option'

ASELECT

BINSERT

CUPDATE

DDELETE

Attempts:

3 left

💡 Hint

Common Mistakes

Granting write permissions like INSERT or UPDATE instead of SELECT.

SELECT permission allows read access to the table, which is essential for data governance to ensure controlled data viewing.

3fill in blank

hard

Fix the error in the code to revoke a role's access properly.

Snowflake

REVOKE [1] ON DATABASE analytics FROM ROLE data_analyst;

Drag options to blanks, or click blank then click option'

ACREATE

BSELECT

CUSAGE

DDROP

Attempts:

3 left

💡 Hint

Common Mistakes

Revoking permissions that do not control access to the database directly.

USAGE permission on a database allows a role to access it. Revoking USAGE removes access, which is key for governance.

4fill in blank

hard

Fill both blanks to create a secure masking policy and apply it to a column.

Snowflake

CREATE MASKING POLICY [1] AS (val STRING) RETURNS STRING -> CASE WHEN CURRENT_ROLE() [2] 'data_reader' THEN val ELSE '****' END;

Drag options to blanks, or click blank then click option'

Amask_ssn

BLIKE

C=

Dmask_email

Attempts:

3 left

💡 Hint

Common Mistakes

Using LIKE instead of = for exact role matching.

Choosing a policy name unrelated to the data.

The masking policy mask_ssn hides sensitive data unless the current role exactly matches data_reader.

5fill in blank

hard

Fill all three blanks to grant a masking policy to a column in a table.

Snowflake

ALTER TABLE customer_data ALTER COLUMN [1] SET MASKING POLICY [2]; GRANT [3] ON TABLE customer_data TO ROLE data_reader;

Drag options to blanks, or click blank then click option'

Assn

Bmask_ssn

CSELECT

Demail

Attempts:

3 left

💡 Hint

Common Mistakes

Applying masking to the wrong column.

Granting incorrect permissions like INSERT or UPDATE.

The ssn column is masked by mask_ssn policy, and SELECT permission is granted to the data_reader role for controlled access.

Practice

1. What is the main purpose of data governance in Snowflake?

easy

A. To set rules that keep data safe and reliable

B. To speed up data loading processes

C. To create more storage space automatically

D. To delete old data without backup

Solution

1. Step 1: Understand the role of governance

   Governance is about setting rules and policies to protect and manage data.

2. Step 2: Identify the main goal

   The main goal is to keep data safe and reliable for users.

3. Final Answer:

   To set rules that keep data safe and reliable -> Option A

4. Quick Check:

   Governance = Data safety and reliability [OK]

Hint: Governance means setting rules for safe, trusted data [OK]

Common Mistakes:

• Confusing governance with performance tuning
• Thinking governance deletes data automatically
• Assuming governance creates storage space

2. Which Snowflake feature helps control who can see sensitive data?

easy

A. Data unloading

B. Warehouse scaling

C. Automatic clustering

D. Data masking policies

Solution

1. Step 1: Identify features related to data access

   Data masking policies hide sensitive data from unauthorized users.

2. Step 2: Exclude unrelated features

   Warehouse scaling, clustering, and unloading do not control data visibility.

3. Final Answer:

   Data masking policies -> Option D

4. Quick Check:

   Masking = Control data visibility [OK]

Hint: Masking policies hide sensitive data from unauthorized users [OK]

Common Mistakes:

• Confusing warehouse scaling with data access control
• Thinking clustering affects data visibility
• Assuming unloading controls data masking

3. Given this Snowflake SQL snippet:

CREATE MASKING POLICY ssn_mask AS (val STRING) RETURNS STRING ->
CASE WHEN CURRENT_ROLE() IN ('HR_ROLE') THEN val ELSE 'XXX-XX-XXXX' END;

What will a user with role 'SALES_ROLE' see when querying the SSN column?

medium

A. 'XXX-XX-XXXX' as masked value

B. The actual SSN value

C. An error message

D. NULL value

Solution

1. Step 1: Understand the masking policy logic

   The policy shows the real value only if the role is 'HR_ROLE'. Otherwise, it shows 'XXX-XX-XXXX'.

2. Step 2: Apply the policy for 'SALES_ROLE'

   Since 'SALES_ROLE' is not 'HR_ROLE', the user sees the masked value 'XXX-XX-XXXX'.

3. Final Answer:

   'XXX-XX-XXXX' as masked value -> Option A

4. Quick Check:

   Role not HR_ROLE = masked value [OK]

Hint: Masking shows real data only for allowed roles [OK]

Common Mistakes:

• Assuming all roles see real data
• Expecting an error instead of masked value
• Thinking masked value is NULL

4. You created a masking policy but users still see sensitive data. What is the likely cause?

medium

A. The warehouse size is too small

B. The masking policy syntax is incorrect

C. Users have roles that bypass the masking policy

D. Data is stored in an external stage

Solution

1. Step 1: Check role permissions

   Users with roles allowed by the masking policy see real data, bypassing masking.

2. Step 2: Exclude unrelated causes

   Incorrect syntax causes errors, not visible data; warehouse size and external stage do not affect masking.

3. Final Answer:

   Users have roles that bypass the masking policy -> Option C

4. Quick Check:

   Allowed roles see real data [OK]

Hint: Check user roles that bypass masking policies [OK]

Common Mistakes:

• Blaming warehouse size for masking issues
• Ignoring role permissions in masking
• Assuming external stage affects masking

5. How does combining role-based access control (RBAC) with masking policies help maintain data trust at scale in Snowflake?

hard

A. It speeds up query performance by caching data

B. It ensures only authorized users see sensitive data, while others see masked data

C. It automatically deletes data after a set time

D. It allows all users to see all data for transparency

Solution

1. Step 1: Understand RBAC and masking roles

   RBAC assigns roles to users controlling data access; masking policies hide sensitive data based on roles.

2. Step 2: Combine effects for trust

   Only authorized roles see real data; others see masked data, ensuring trust and security at scale.

3. Final Answer:

   It ensures only authorized users see sensitive data, while others see masked data -> Option B

4. Quick Check:

   RBAC + masking = trusted data access [OK]

Hint: RBAC plus masking controls who sees real vs masked data [OK]

Common Mistakes:

• Thinking governance deletes data automatically
• Confusing masking with performance features
• Assuming all users see all data