COF-C03 Question 159
Single answerSystem-defined rolesA Snowflake account has several application teams that need to create and manage databases, warehouses, and roles for their own projects. The security team wants to avoid giving broad account-wide administrative access and asks which system-defined role should be used as the starting point for delegating this operational responsibility while still keeping user and role governance separated. Which role best fits this requirement?
- A
ACCOUNTADMIN
- B
SECURITYADMIN
- C
SYSADMIN
- D
USERADMIN
Show answer and explanation
Correct answer: C
Explanation
The best answer is SYSADMIN. In Snowflake's system-defined role model, responsibilities are intentionally separated: USERADMIN handles users and roles, SECURITYADMIN manages grants and can manage the role hierarchy, and SYSADMIN is intended for creating and owning account objects such as databases and warehouses. ACCOUNTADMIN sits above these roles and should be tightly restricted because it effectively combines powerful administrative capabilities. In practice, Snowflake recommends designing custom roles beneath SYSADMIN for object management and beneath USERADMIN/SECURITYADMIN for identity and access tasks, then granting those roles as needed. This supports least privilege and separation of duties, which are key best practices for SnowPro Core and real-world Snowflake administration.
- A. Incorrect.
Incorrect. ACCOUNTADMIN is the highest-level system-defined role and combines broad administrative capabilities across the account. Although it can perform the needed tasks, using it for routine delegation violates least-privilege best practices because it provides much more access than required.
- B. Incorrect.
Incorrect. SECURITYADMIN is intended primarily for managing grants and role hierarchy. It can manage object grants and roles, but it is not the recommended starting point for delegating ownership and day-to-day management of databases, warehouses, and other objects used by application teams. Using SECURITYADMIN would blur the separation between security administration and operational object management.
- C. Correct.
Correct. SYSADMIN is the recommended system-defined role for creating and managing account objects such as warehouses, databases, schemas, and other objects needed for workloads. Snowflake documentation describes SYSADMIN as the role that owns objects created in the account and recommends that custom roles for object management ultimately roll up to SYSADMIN. This makes it the best starting point when delegating operational administration while keeping security governance separate.
- D. Incorrect.
Incorrect. USERADMIN is focused on creating and managing users and roles, not on owning and operating databases, warehouses, or other project objects. Choosing USERADMIN reflects the common misconception that all administration belongs with user administration, but Snowflake separates identity/role management from object administration.