Network policies in Snowflake can be applied to users and accounts. These policies control inbound access to the Snowflake service and internal stages, allowing or denying access based on the originating network identifiers12.
References: [ COF-C03 ] SnowPro Core Certification Exam Study Guide

In Snowflake, semi-structured data is optimally stored using specific data types that are designed to handle the flexibility and complexity of such data. The VARIANT data type can store structured and semi-structured data types, including JSON, Avro, ORC, Parquet, or XML, in a single column. The ARRAY data type, on the other hand, is suitable for storing ordered sequences of elements, which can be particularly useful for semi-structured data types like JSON arrays. These data types provide the necessary flexibility to store and query semi-structured data efficiently in Snowflake.
References:
Snowflake Documentation: Semi-structured Data Types

The Activity area of Snowsight includes the Query History page, which allows users to monitor and view details about queries executed in their account, including performance data1.It also includes the Automatic Clustering History, which provides insights into the automatic clustering operations performed on tables2.

The correct answer is D. Dynamic Data Masking .
Dynamic Data Masking is used to protect sensitive column values at query run time. It allows Snowflake to return different values depending on the user's role or other policy logic.
Why D is correct:
A masking policy can be applied to a table or view column. When a query runs, Snowflake evaluates the masking policy and determines whether to return the original value, a partially masked value, or a fully masked value.
Example concept:
CREATE MASKING POLICY phone_mask AS (val STRING)
RETURNS STRING - >
CASE
WHEN CURRENT_ROLE() IN ( ' CUSTOMER_SUPPORT_FULL ' ) THEN val
ELSE CONCAT( ' XXX-XXX- ' , RIGHT(val, 4))
END;
This protects sensitive phone numbers at query time without changing the underlying stored data.
Why the other options are incorrect:
A). Object tagging classifies or labels data for governance, but it does not mask values at query runtime by itself.
B). Data encryption protects data at rest and in transit, but it does not dynamically change query results based on role.
C). UDFs can implement custom logic, but Snowflake's built-in governance feature for runtime masking is Dynamic Data Masking.
Official Snowflake documentation reference:
Snowflake documentation describes Dynamic Data Masking as a column-level security feature that uses masking policies to selectively mask plain-text data in query results at runtime.
Reference: Snowflake Documentation - Dynamic Data Masking; Snowflake Documentation - Masking policies; SnowPro Core Study Guide - Data Protection and Governance.

Snowflake automatically rotates the Account and Table master keys when they are more than 30 days old. Active keys are retired, and new keys are created, ensuring robust security through frequent key changes1