What does a masking policy consist of in Snowflake?

A Snowflake masking policy is a schema-level object defined to protect a column of a specific data type. The policy's core logic is an SQL expression, typically a CASE statement, that determines what data a user sees based on their role or other session context. This CASE statement allows for one or more conditional branches (WHEN ... THEN). Each branch can return the original value, a redacted static value, or the result of a different masking function (e.g., SHA2, MD5, or a UDF). Therefore, a policy is bound to a single data type signature but can contain multiple conditions and invoke multiple functions to produce the masked output.

B. This is incorrect because a policy's CASE statement can evaluate multiple conditions (i.e., multiple WHEN clauses) and use different functions for different conditions.
C. This is incorrect because a single masking policy is created for a specific data type signature (e.g., STRING, NUMBER); it cannot be defined for multiple data types simultaneously.
D. This is incorrect because a single masking policy is defined for a single data type signature, not multiple data types.

1. Snowflake Documentation: CREATE MASKING POLICY

Reference: Snowflake Documentation > SQL Reference > DDL > CREATE MASKING POLICY.

Details: The syntax CREATE MASKING POLICY AS ( ... ) RETURNS -> explicitly shows that the policy is defined with specific argument data types () and a return type (), confirming it applies to a single data type signature. The documentation states, "The body of the masking policy is any valid SQL expression... For conditional masking, the expression typically uses a CASE function," which supports one or more conditions and one or more masking functions within its logic.

2. Snowflake Documentation: Introduction to Dynamic Data Masking

Reference: Snowflake Documentation > Data Governance > Dynamic Data Masking > Introduction to Dynamic Data Masking.

Details: This section explains that a masking policy is a schema-level object that "utilizes a CASE expression" to determine the returned data. A CASE expression is the standard SQL mechanism for handling multiple conditional paths, directly supporting the "one or more conditions" and "one or more masking functions" aspects of the correct answer.

3. Snowflake Documentation: Using Dynamic Data Masking

Reference: Snowflake Documentation > Data Governance > Dynamic Data Masking > Using Dynamic Data Masking.

Details: The examples provided demonstrate policies with CASE statements. For instance, ...CASE WHEN currentrole() IN ('ANALYST') THEN val ELSE '' END;. This structure can be extended with more WHEN clauses to create multiple conditions, each potentially using a different function or returning a different value.