Snowflake’s foundational security capability isalways-on end-to-end encryption, applied to all customer data both at rest and in transit. Snowflake encrypts data stored in micro-partitions using AES-256, and all network communication uses TLS encryption. Key management is automated through Snowflake’s hierarchical key model, providing additional rotation, rekeying, and defense-in-depth mechanisms.
While RBAC, masking policies, and network policies are crucial components of Snowflake security, encryption is the platform’s guaranteed, baseline, mandatory protection feature. It applies universally to all data, regardless of workload, role configuration, or user settings.
Option A: automated masking is optional and policy-driven, not a primary universal mechanism.
Option B: network perimeter defense exists but is not the platform’s core foundation.
Option C: RBAC controls access but does not protect data itself.
Thus, Snowflake’s primary and most universal security capability is end-to-end encryption.
==================