SnowPro Advanced: MLOps Engineer free question 9 / 10 · Domain 5: Governance, Security, and Monitoring
The feature table FT_LOANS has a row access policy whose signature takes the REGION column, so each analyst sees only rows for their regions. The privacy team now wants a masking policy whose signature also takes REGION, to show it masked to most roles. Which statement matches the row access policy documentation?
- It works, since a column may be named in any number of policy signatures
- It works; the masking policy runs first, then the row filter reads the masked value
- It works, and the two policies run in the order in which they were attached
- Not as planned: one column cannot be in both policy signatures at the same time
Show the answer and explanation
Answer: D
Why this is correct
The section "Masking policies" on the row access policy page says that when a database object has both a row access policy and one or more masking policies, Snowflake evaluates the row access policy first. It then says that a given table or view column can be specified in either a row access policy signature or a masking policy signature; the same column cannot be specified in both at the same time. REGION is already in the row access policy signature on FT_LOANS, so a masking policy whose signature takes REGION cannot be added as planned. The privacy team has to protect the column in another way or change which policy reads REGION.
Why the other options are wrong
"It works; the masking policy runs first, then the row filter reads the masked value" … When an object has both a row access policy and one or more masking policies, the page says Snowflake evaluates the row access policy first. The planned pair is also blocked for REGION itself, because that column would be in both signatures.
"It works, and the two policies run in the order in which they were attached" … The order is fixed, not taken from when the policies were attached: Snowflake evaluates the row access policy first. And with REGION in both signatures, the pair cannot be set up at all.
"It works, since a column may be named in any number of policy signatures" … The page says a given table or view column can be specified in either a row access policy signature or a masking policy signature, so REGION can be in only one of them.
One column, one kind of policy signature
The Considerations section adds that attaching policies to tables already protected by other row access or masking policies may cause errors. Mapping out which columns each policy reads before rollout avoids failed ALTER TABLE statements in a deployment.