COF-C03 Question 160
Single answerFunctional rolesA Snowflake administrator is redesigning access control for a growing analytics platform. The company wants to reduce direct privilege grants to users and make access easier to audit. Data engineers need privileges to create and maintain tables and views in analytics schemas, while analysts should only be able to query published reporting objects. The administrator decides to implement functional roles. Which approach best aligns with Snowflake best practices for using functional roles?
- A
Create functional roles such as DATA_ENGINEER and ANALYST, grant object privileges to those roles, and then grant the functional roles to users or higher-level access roles as needed
- B
Grant all required table, schema, and warehouse privileges directly to each user so auditing reflects the exact privileges each person uses
- C
Create one shared functional role for both engineers and analysts, then rely on session context to limit who can modify objects
- D
Grant privileges only to the SYSADMIN role, and ask engineers and analysts to switch to SYSADMIN when they need to perform their work
Show answer and explanation
Correct answer: A
Explanation
The best answer is to create distinct functional roles based on job responsibilities and grant privileges to those roles. In Snowflake, functional roles are commonly used to model who a user is in the organization, such as analyst, engineer, or developer. This fits Snowflake RBAC best practices: grant privileges to roles, organize those roles hierarchically where appropriate, and assign roles to users instead of granting object privileges directly to users. In this scenario, separate roles for DATA_ENGINEER and ANALYST support least privilege and simplify auditing. Snowflake documentation on access control and role-based access control emphasizes using roles to manage privileges and reducing direct grants to users.
- A. Correct.
Correct. Functional roles are job-based roles that represent business functions, such as DATA_ENGINEER or ANALYST. In Snowflake RBAC, best practice is to grant privileges to roles rather than directly to users, then assign those roles to users or to other roles in a role hierarchy. This improves manageability, separation of duties, and auditability. It also supports least privilege by allowing engineers and analysts to receive only the permissions required for their responsibilities.
- B. Incorrect.
Incorrect. Although direct grants to users can work technically, they are not the recommended design for scalable Snowflake access control. Direct user grants become difficult to manage and audit as the environment grows. Functional roles exist specifically to avoid this pattern and to centralize privilege management around job responsibilities.
- C. Incorrect.
Incorrect. Combining engineers and analysts into a single functional role violates least-privilege design because the two groups have different responsibilities. Session context does not replace RBAC controls for object modification privileges. Analysts should not inherit create and maintenance permissions just because they share a role with engineers.
- D. Incorrect.
Incorrect. SYSADMIN is a powerful administrative role and should not be used as a general-purpose working role for standard users. Granting or using SYSADMIN broadly breaks separation of duties and exposes excessive privileges. Functional roles should encapsulate only the privileges needed for each job function.