A Data Engineer has created a scalar User-Defined Function (UDF) that contains a SELECT statement based on a projection constraint column. The Engineer notices that the UDF behaves differently…

Question

Options

• AScalar SQL UDF - Snowflake allows the query to execute and returns NULL.
• BScalar SQL UDF - Snowflake blocks the query.
• CLogging & Event Tables - Snowflake allows the UDF to execute and captures log and event
• DLogging & Event Tables - Snowflake allows the UDF to execute but does not capture log and
• ELogging & Event Tables - Snowflake blocks the UDF but allows the statement calling the UDF to

• A
  70% (31)
• B
  5% (2)
• C
  7% (3)
• E
  18% (8)

Explanation

When a scalar SQL UDF references a projection policy-protected column, Snowflake does not block execution - it allows the query to run but returns NULL instead of the protected value (A is correct). For Logging & Event Tables, Snowflake similarly allows the UDF to execute, but suppresses the capture of log and event data to prevent sensitive column values from leaking through observability side channels (D is correct).

Why the distractors are wrong:

• B is wrong because Snowflake uses a "fail-open with NULL" strategy for scalar UDFs, not a hard block.
• C is wrong because capturing log/event data would create a security bypass - Snowflake intentionally suppresses this capture.
• E is wrong because Snowflake does not block the UDF itself; it executes fine, it just doesn't record telemetry.

Memory tip: Think of Snowflake's pattern as "allow but sanitize" - for scalar UDFs it sanitizes the output (NULL), and for event tables it sanitizes the observability trail (no logs). In both cases, the UDF runs; what gets suppressed is the visibility of the protected data.

No community discussion yet for this question.