In a masking policy that shows the plain-text value only to a specific role, what value is shown to a user without that role?

• A. The original value
• B. The masked value
• C. Null
• D. A hash of the value

Answer: (B)

Dynamic data masking serves to protect sensitive information by presenting a safe representation to users who aren’t granted the privilege to see the real data. When a user lacks the specific role that allows viewing the plain-text value, the masking policy supplies a masked representation instead of the actual value. That’s why the value shown to someone without the role is the masked value. If the user did have the role, they would see the original value. The other options don’t fit because the point of masking is to replace the real data with a redacted form for unauthorized users, not to show the original data, and a hash isn’t the typical output of Snowflake’s masking policy (it’s a different form of obfuscation that isn’t the standard masked value).