An administrator is planning the privileges and object scope needed to create and manage Snowflake masking policies and row access policies at scale. Which TWO statements about managing these governance objects are correct? Select TWO.
- ACentralised policy administration is best handled by granting every analyst the ACCOUNTADMIN role so they can attach policies to columns themselves.
- BBoth masking policies and row access policies are schema-level objects, so creating them requires the CREATE MASKING POLICY or CREATE ROW ACCESS POLICY privilege on the target schema. Correct
- CA masking policy must be recreated separately in every database because policies cannot be referenced from objects outside their own schema.
- DA row access policy can be written to reference a separate mapping table so that membership changes there alter row visibility without editing the policy itself. Correct
Why A is wrong: Tempting because ACCOUNTADMIN can do everything, but handing it out broadly violates least privilege; a dedicated custom or security role should manage policies instead.
Why B is correct: Correct, because these policies live inside a schema and their creation depends on the matching schema-level CREATE privilege, in line with least-privilege object management.
Why C is wrong: Tempting because policies are schema-scoped, but a policy can protect columns in other schemas and databases as long as the data types match, so duplication is unnecessary.
Why D is correct: Correct, because a row access policy body can join to an entitlements mapping table, letting assignment changes flow through automatically without rewriting the policy.