A data engineer needs to enforce row-level security on main.secure.events(region STRING, event_id STRING). Members of the account group all_regions must see all rows. All other users must see only rows where region = 'EU'.
Correct Answer:
A
A row-filter function must return a Boolean value indicating whether each row is visible to the current user. The function in option A returns true for members of the account-level all_regions group, allowing them to see every row. For other users, it returns the result of region = 'EU', limiting visibility to European records. is_account_group_member checks direct or indirect membership in an account-level group. The ALTER TABLE ... SET ROW FILTER ... ON (region) statement then associates the function with the table and passes the region column to it for every query. A column mask transforms displayed column values rather than removing rows. The object is a table, not a view, and USING COLUMNS is not the correct row-filter attachment syntax. Therefore, option A is correct.
