How can the Snowflake context functions be used to help determine whether a user is authorized to see data that has column-level security enforced? (Select TWO).

Question

Options

• ASet masking policy conditions using current_role targeting the role in use for the current session.
• BSet masking policy conditions using is_role_in_session targeting the role in use for the current
• CSet masking policy conditions using invoker_role targeting the executing role in a SQL statement.
• DDetermine if there are ownership privileges on the masking policy that would allow the use of any
• EAssign the accountadmin role to the user who is executing the object.

• A
  82% (37)
• B
  2% (1)
• D
  11% (5)
• E
  4% (2)

Explanation

Snowflake masking policies use context functions inside their conditional expressions to dynamically determine whether a querying user should see plain or masked data. Option A is correct: CURRENT_ROLE() returns the active primary role of the current session. Masking policy conditions commonly check IF CURRENT_ROLE() IN ('ANALYST_ROLE', 'FINANCE_ROLE') THEN plain value ELSE masked value - this is the most standard pattern for role-based column masking. Option C is correct: INVOKER_ROLE() returns the role that is actively executing the SQL statement, which matters in contexts like stored procedures or tasks where the ownership role and the calling role may differ - it ensures the policy evaluates the actual executing role, not just the session role. Option B (IS_ROLE_IN_SESSION()) checks whether a specific role is anywhere in the active role hierarchy of the session, which is useful but was not listed as a correct answer here - the exam targets the two most direct function patterns. Option D (ownership privileges) is not a context function. Option E (assigning ACCOUNTADMIN) bypasses security rather than implementing governed column-level access.

No community discussion yet for this question.