SnowflakeProfessional levelADA-C01

ADA-C01 exam dumps: 565 free SnowPro Advanced: Administrator practice questions

Free ADA-C01 practice questions for the SnowPro® Advanced: Administrator exam, with the correct answer and a full explanation for every option. Read the first 10 below, browse all 565 by number, or take a timed practice exam.

Question bank last updated April 2026

Start timed practice exam Browse all 565 questions

Free ADA-C01 practice questions

Questions 1 to 10 of 565

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

ADA-C01 Question 1

Single answerI need one more page for Domain 6.0.Here are all 6 domains with every skill and sub-item:

A Snowflake administrator is reviewing account security after an internal audit. The audit found that several service users connect from approved corporate networks, but some also use username/password authentication without network restrictions. The security team wants to reduce the risk of credential misuse while minimizing disruption to existing workloads. Which action should the administrator take to enforce that these users can authenticate only from approved network locations while preserving existing user objects and role assignments?

A
Create a network policy with the approved IP address list and assign the policy to the affected users or at the account level
B
Create a masking policy to restrict authentication attempts based on source IP address
C
Grant the SECURITYADMIN role to the service users so they can manage their own trusted IP addresses
D
Configure a resource monitor to block logins from unapproved IP addresses
E
Move the users to a separate virtual warehouse that is accessible only from approved corporate networks

Show answer and explanation

Correct answer: A

Explanation

This scenario tests knowledge of Snowflake access control and authentication hardening in a practical administrative context. The correct solution is to use a network policy, which supports allowed and blocked IP lists and can be associated either with the account or specific users. That makes it appropriate when an organization wants to enforce source network restrictions without replacing user identities or changing RBAC design. By contrast, masking policies protect query output, resource monitors manage credit usage, and warehouses do not provide authentication boundaries. As a best practice, administrators should combine network policies with stronger authentication methods such as key-pair authentication, OAuth, or MFA where applicable, while following least-privilege principles for role assignment. Relevant Snowflake documentation includes guidance on network policies, user security, and account access control.

A. Correct.
Correct. Snowflake network policies are the supported control for restricting authentication based on allowed and/or blocked IP addresses. They can be applied at the account level or to individual users, which allows an administrator to tighten access without recreating users or changing role assignments. This directly addresses the requirement to limit authentication to approved network locations while minimizing disruption.
B. Incorrect.
Incorrect. Masking policies are used to control how sensitive data is exposed in query results, not to control login behavior or source-network restrictions. This option reflects a common confusion between data governance controls and authentication/access controls.
C. Incorrect.
Incorrect. Granting SECURITYADMIN would increase privileges significantly and does not enforce source IP restrictions for authentication. It would also violate least-privilege principles by allowing service users to manage security-related objects unnecessarily.
D. Incorrect.
Incorrect. Resource monitors track and control credit consumption for warehouses. They can suspend warehouses or send notifications when usage thresholds are reached, but they do not evaluate client source IP addresses or control authentication.
E. Incorrect.
Incorrect. Virtual warehouses are compute resources for query execution. Network access restrictions are not enforced by placing users on a particular warehouse. Authentication controls such as network policies are the proper mechanism for restricting where users can connect from.

ADA-C01 Question 2

Single answerI need one more page for Domain 6.0.Here are all 6 domains with every skill and sub-item:

A Snowflake administrator is preparing a business continuity design for a critical production account. The company requires recovery from an accidental table drop within minutes, and it also requires the ability to continue operations in another cloud region if an entire region becomes unavailable. Cost control is important, so the solution should avoid keeping a fully duplicated environment running unless necessary. Which approach best meets these requirements?

A
Enable Time Travel and Fail-safe on the production database, and rely on Fail-safe for cross-region business continuity.
B
Create database replication to a secondary account in another region, promote the secondary only during a regional outage, and use Time Travel in the primary account for accidental object recovery.
C
Use zero-copy cloning of the production database into another region on a weekly schedule, and use the clone as the recovery environment for both accidental drops and regional outages.
D
Configure Tri-Secret Secure for the account and use it to recover dropped objects and provide automatic regional failover.

Show answer and explanation

Correct answer: B

Explanation

The best answer is to combine Time Travel for operational recovery of accidental changes with cross-region replication for business continuity. In Snowflake, Time Travel allows administrators to recover dropped or changed data within the data retention period, making it suitable for accidental table drops. For account- or region-level continuity, Snowflake supports replication and failover capabilities across regions and clouds, depending on edition and configuration. Promoting a secondary only when needed helps meet cost-control requirements because the organization avoids running a full active-active environment continuously. Fail-safe should not be treated as a business continuity strategy; it is a Snowflake-managed emergency recovery feature with limited customer control and slower recovery objectives. This aligns with Snowflake documentation and best practices for separating operational recovery objectives from disaster recovery architecture.

A. Incorrect.
Incorrect. Time Travel helps recover data changes such as accidental drops or deletes within the configured retention period, and Fail-safe provides a last-resort recovery mechanism managed by Snowflake. However, Fail-safe is not intended for customer-driven business continuity or cross-region failover. It does not provide an operational secondary environment in another region.
B. Correct.
Correct. This design addresses both requirements using the appropriate Snowflake capabilities. Time Travel is the primary mechanism for quick recovery from accidental object drops. For region-level disaster recovery/business continuity, database replication to a secondary account in another region provides a synchronized copy that can be promoted during an outage. This also supports cost control because the secondary does not need to be actively serving workloads until failover is required.
C. Incorrect.
Incorrect. Zero-copy cloning is useful for fast, space-efficient copies inside Snowflake, but it is not the primary mechanism for cross-region disaster recovery. Clones also depend on the source object's metadata and do not replace replication/failover groups for regional resiliency. A weekly clone schedule would also create unacceptable data loss exposure for a critical production workload.
D. Incorrect.
Incorrect. Tri-Secret Secure is a key management/security feature related to encryption control, not a disaster recovery or object recovery feature. It does not restore dropped tables and does not provide regional failover capabilities.

ADA-C01 Question 3

Single answerDomain 1.0: Snowflake Security, Role-Based Access Control (RBAC), and User Administration (31%)

A Snowflake administrator is onboarding a new finance analytics team. Team members must be able to query data in the FINANCE_DB database and create temporary and permanent tables in the FINANCE_SANDBOX schema for analysis. They must not be able to grant access to other users, modify existing production schemas, or administer users and roles. The company wants to follow least-privilege and avoid assigning high-level system roles directly to end users. Which approach best meets these requirements?

A
Grant the SYSADMIN role directly to each finance analyst, because SYSADMIN can manage database objects without requiring SECURITYADMIN.
B
Create a custom role, grant USAGE on the FINANCE_DB database, USAGE on the target schemas, SELECT on required tables/views, and CREATE TABLE on the FINANCE_SANDBOX schema; then grant the custom role to the analysts.
C
Grant the SECURITYADMIN role to the team so they can manage access to the FINANCE_DB objects they use, but instruct them not to create or alter roles.
D
Create a custom role with OWNERSHIP on the FINANCE_DB database and grant that role to the analysts so they can create objects where needed without additional grants.

Show answer and explanation

Correct answer: B

Explanation

The best answer is to create a custom role with only the privileges required for the finance analytics workload. In Snowflake RBAC, best practice is to assign system-defined administrative roles sparingly and grant end users custom roles that match business functions. For querying data, users typically need USAGE on the database and schema along with object privileges such as SELECT on tables or views. For creating tables, the role needs CREATE TABLE on the target schema; restricting that privilege to FINANCE_SANDBOX prevents changes in production schemas. This design satisfies least-privilege, avoids direct assignment of high-level administrative roles, and prevents analysts from administering roles or granting access. These principles align with Snowflake documentation on access control, role hierarchy, object privileges, and best practices for separating administrative duties from functional data access.

A. Incorrect.
Incorrect. SYSADMIN is a powerful system-defined role intended for managing objects across the account hierarchy. Granting it directly to analysts violates least-privilege and gives far more access than required, including the ability to create and manage many objects beyond the finance sandbox. Although SYSADMIN does not manage users and roles like SECURITYADMIN, it is still too broad for this use case.
B. Correct.
Correct. This is the recommended RBAC design in Snowflake: create a custom functional role aligned to the team's job duties and grant only the minimum required privileges. To query objects, users need appropriate USAGE privileges on the database and schema, plus SELECT on the tables or views. To create permanent tables in a schema, CREATE TABLE on that schema is required; temporary tables also require the ability to create tables in the schema. This approach avoids granting role-management capabilities and limits object creation to the designated sandbox schema.
C. Incorrect.
Incorrect. SECURITYADMIN is intended for managing grants, users, and roles. Giving it to analysts would let them administer access and potentially escalate privileges, which directly conflicts with the requirement that they must not administer users and roles or grant access to others. This is a common misconception because people often associate data access setup with SECURITYADMIN, but that role should be tightly controlled.
D. Incorrect.
Incorrect. OWNERSHIP is the highest privilege on an object and effectively gives full control, including the ability to transfer ownership and manage grants on that object depending on the situation. Granting OWNERSHIP on the entire database is far broader than necessary and would allow modification of production structures, which the scenario explicitly prohibits. Least-privilege calls for schema-level creation privileges in the sandbox rather than database-level ownership.

ADA-C01 Question 4

Single answerDomain 1.0: Snowflake Security, Role-Based Access Control (RBAC), and User Administration (31%)

A Snowflake administrator is asked to let a data engineering team create and manage pipelines in schema PROD_DB.ETL while preventing them from changing ownership of existing objects or granting access to other roles. The team must be able to create tables, views, stages, file formats, tasks, and streams in the schema, and they must be able to operate their own tasks after creation. The security team also wants to follow least-privilege principles and avoid using ACCOUNTADMIN or SECURITYADMIN for day-to-day operations. Which setup best meets these requirements?

A
Grant the team role OWNERSHIP on schema PROD_DB.ETL and USAGE on database PROD_DB so they can create and manage all objects in the schema.
B
Grant the team role USAGE on database PROD_DB and schema PROD_DB.ETL, CREATE TABLE, CREATE VIEW, CREATE STAGE, CREATE FILE FORMAT, CREATE TASK, and CREATE STREAM on schema PROD_DB.ETL, plus OPERATE on tasks after task creation as needed.
C
Grant the team role ALL PRIVILEGES on database PROD_DB and schema PROD_DB.ETL so they can create and run any ETL object without requiring additional grants.
D
Grant the team role CREATE TASK and CREATE STREAM on database PROD_DB, then rely on future grants so the role automatically receives ownership of objects it creates in schema PROD_DB.ETL.

Show answer and explanation

Correct answer: B

Explanation

The best answer is Option 2 because it applies Snowflake RBAC correctly and follows least-privilege design. In Snowflake, creating objects inside a schema requires USAGE on the containing database and schema, along with the appropriate CREATE privileges on the schema. For example, CREATE TABLE, CREATE VIEW, CREATE STAGE, CREATE FILE FORMAT, CREATE TASK, and CREATE STREAM are granted at the schema level. When a role creates an object, that role becomes the owner of that object, which lets the team manage the objects they create without needing OWNERSHIP on the schema itself. For task administration, OPERATE is the relevant privilege for running, suspending, or resuming tasks. This design prevents unnecessary administrative power, avoids granting schema OWNERSHIP or broad ALL PRIVILEGES, and is consistent with Snowflake best practices for access control and separation of duties as described in Snowflake documentation on access control privileges, schema object creation privileges, and task privileges.

A. Incorrect.
Incorrect. OWNERSHIP on the schema is overly permissive and directly conflicts with the requirement to prevent the team from changing ownership or granting access to other roles. OWNERSHIP is the highest level of control over an object and includes the ability to transfer ownership. While it would allow object management, it violates least-privilege principles and gives broader control than necessary.
B. Correct.
Correct. To create objects in a schema, a role needs USAGE on the parent database and schema, plus the relevant CREATE
C. Incorrect.
Incorrect. ALL PRIVILEGES on the database and schema is broader than required and may still not represent a precise least-privilege design. It also grants unnecessary capabilities beyond the stated ETL object creation needs. In Snowflake, best practice is to grant only the specific privileges required instead of broad privilege bundles, especially in controlled production environments.
D. Incorrect.
Incorrect. CREATE TASK and CREATE STREAM are schema-level privileges, not database-level privileges, so this grant model is invalid for enabling object creation in PROD_DB.ETL. In addition, future grants do not cause a role to automatically receive ownership of objects it creates; ownership of a newly created object is assigned to the creating role at creation time. This option mixes privilege scope incorrectly and reflects a common misunderstanding of future grants.

ADA-C01 Question 5

Single answer1.1 Manage administrative roles

A Snowflake account uses a centralized platform team to manage security. The company wants to delegate user and role administration to an identity operations team without giving that team broad access to data objects or account-wide configuration. The identity operations team must be able to create users, reset passwords, rotate key pairs, and grant or revoke roles to users. Which role should be granted to the identity operations team to meet these requirements while following least-privilege best practices?

A
Grant the SECURITYADMIN role
B
Grant the USERADMIN role
C
Grant the SYSADMIN role
D
Grant the ACCOUNTADMIN role

Show answer and explanation

Correct answer: B

Explanation

The best answer is USERADMIN. Snowflake provides distinct system-defined administrative roles to support separation of duties. USERADMIN is designed for user and role management, including creating users and roles and granting roles to users. SECURITYADMIN is more powerful because it manages grants and security objects broadly, so it is typically reserved for central security administration rather than routine identity operations. SYSADMIN is focused on object administration, and ACCOUNTADMIN should be tightly restricted because it has near-unrestricted administrative capabilities. This aligns with Snowflake best practices for role-based access control and separation of duties: use the least-privileged built-in admin role that satisfies the operational requirement. Reference: Snowflake documentation on system-defined roles and access control best practices, especially the descriptions of USERADMIN, SECURITYADMIN, SYSADMIN, and ACCOUNTADMIN.

A. Incorrect.
Incorrect. SECURITYADMIN is a powerful system role that can manage grants globally, including granting object privileges and managing roles. While it can administer roles, it provides broader security administration capabilities than required for a team that only needs to manage users and grant or revoke roles to users. This exceeds least-privilege guidance.
B. Correct.
Correct. USERADMIN is the system role intended for creating and managing users and roles. In practice, it is the appropriate role to delegate when a team needs to create users, manage user properties such as passwords or public keys, and grant or revoke roles to users, without also receiving broad object privilege management or account-level administrative powers.
C. Incorrect.
Incorrect. SYSADMIN is primarily intended to create and manage warehouses, databases, schemas, and other objects. It is the recommended owner of most custom roles and objects, but it is not the least-privilege role for user lifecycle administration. Granting SYSADMIN would not align with the requirement to delegate identity administration specifically.
D. Incorrect.
Incorrect. ACCOUNTADMIN is the most powerful built-in administrative role and combines capabilities from SYSADMIN and SECURITYADMIN, along with account-level administration. It would allow the team to perform far more actions than required, making it inappropriate for a least-privilege delegation model.

ADA-C01 Question 6

Single answer1.1 Manage administrative roles

A company is tightening administrative controls in Snowflake after an internal audit. The security team wants one role to manage users, passwords, MFA enrollment resets, and role grants, while a separate role must manage warehouses, resource monitors, and account-level parameters. The team also wants to avoid granting broader privileges than necessary. Which pair of built-in system roles best meets these requirements?

A
Grant SECURITYADMIN for user and role administration, and SYSADMIN for warehouses, resource monitors, and account parameter management
B
Grant USERADMIN for user administration, and ACCOUNTADMIN for warehouses, resource monitors, and account parameter management
C
Grant USERADMIN for user and role administration, and SYSADMIN for warehouses, resource monitors, and account parameter management
D
Grant SECURITYADMIN for user and role administration, and ACCOUNTADMIN for warehouses, resource monitors, and account parameter management

Show answer and explanation

Correct answer: D

Explanation

Snowflake best practice is to limit use of ACCOUNTADMIN because it is the most powerful built-in role, combining capabilities of SYSADMIN and SECURITYADMIN plus account-level administration. For managing administrative roles, candidates should understand the distinction between USERADMIN, SECURITYADMIN, SYSADMIN, and ACCOUNTADMIN. USERADMIN is focused on users and roles, SECURITYADMIN handles security-related administration and grants, SYSADMIN manages object creation and operational administration, and ACCOUNTADMIN is required for the broadest account-level tasks such as account parameter management. In this scenario, the cleanest least-privilege alignment among built-in roles is SECURITYADMIN for user/role and grant administration, and ACCOUNTADMIN for warehouses, resource monitors, and account-level parameters. This reflects Snowflake documentation on system-defined roles and the recommendation to reserve ACCOUNTADMIN for only those tasks that require it.

A. Incorrect.
Incorrect. SECURITYADMIN can manage grants globally and is appropriate for user and role administration, but SYSADMIN is primarily intended to create and manage objects such as warehouses and databases, not broader account-level administration such as account parameters. Account-level administrative tasks are typically handled by ACCOUNTADMIN.
B. Incorrect.
Incorrect. USERADMIN is the built-in role focused on creating and managing users and roles, but it does not have the broader grant-management capabilities associated with SECURITYADMIN. In the scenario, the security team specifically wants management of role grants as part of the administrative function. In addition, while ACCOUNTADMIN can manage warehouses, resource monitors, and account parameters, this option does not best align with the requirement to centralize user and grant administration under the most appropriate built-in security role.
C. Incorrect.
Incorrect. USERADMIN can create and manage users and roles, but it is not the best fit when the requirement explicitly includes role grants and broader security administration. SYSADMIN can manage warehouses and many object-level administrative tasks, but it is not the correct built-in role for account-level parameter management.
D. Correct.
Correct. SECURITYADMIN is the built-in system role intended for security-related administration, including managing grants and user/role administration. ACCOUNTADMIN is the top-level administrative role and is required for broad account-level administration, including managing account parameters and other account-wide settings. It can also manage warehouses and resource monitors. This pairing separates security administration from account/platform administration while avoiding use of ACCOUNTADMIN for both functions.

ADA-C01 Question 7

Single answerIdentify use cases and follow best practices for ORGADMIN and ACCOUNTADMIN roles (note: ORGADMIN will be replaced with GLOBARORGADMIN)

A company uses one Snowflake organization with several production and non-production accounts. The security team wants to reduce risk from highly privileged roles while still allowing central administration. They decide that organization-level tasks such as creating new accounts and viewing organization-wide usage should be performed by a very small central team, while day-to-day administration inside each account should be handled locally. Which approach BEST aligns with Snowflake best practices for using ORGADMIN (noting that this role is being replaced by GLOBALORGADMIN) and ACCOUNTADMIN?

A
Grant ACCOUNTADMIN in every account to the central team, and avoid using ORGADMIN/GLOBALORGADMIN because account-level roles can perform the same organization-wide tasks.
B
Use ORGADMIN/GLOBALORGADMIN only for organization-level responsibilities such as managing accounts in the organization, and limit ACCOUNTADMIN to account-specific administration within each account; assign both roles only to a minimal number of trusted administrators.
C
Grant ORGADMIN/GLOBALORGADMIN to all account administrators so they can troubleshoot both account-level and organization-level issues without role switching.
D
Use ACCOUNTADMIN for creating new accounts in the organization, and reserve ORGADMIN/GLOBALORGADMIN mainly for warehouse, database, and user management inside each account.

Show answer and explanation

Correct answer: B

Explanation

The key distinction is scope. ACCOUNTADMIN is the top administrative role inside a single Snowflake account and is intended for account-level tasks, while ORGADMIN is the organization-level administrative role, with Snowflake indicating that ORGADMIN will be replaced by GLOBALORGADMIN. In practice, organization-level tasks such as creating or managing accounts and reviewing organization-wide information belong to ORGADMIN/GLOBALORGADMIN, whereas local administration inside each account should remain with ACCOUNTADMIN or delegated custom roles.

From a security and governance perspective, Snowflake best practices emphasize least privilege, separation of duties, and minimizing assignment of highly privileged system roles. A common real-world pattern is to keep ORGADMIN/GLOBALORGADMIN with a very small central platform team and reserve ACCOUNTADMIN for a small number of trusted administrators per account, delegating routine operational tasks through lower-privilege custom roles where possible.

This question tests whether the candidate can correctly separate organization-level and account-level responsibilities and apply privilege-minimization best practices rather than simply identifying role names.

A. Incorrect.
Incorrect. ACCOUNTADMIN is the highest privileged role within a single Snowflake account, but it does not replace organization-level administration. Organization-level tasks such as managing accounts in the organization are handled by ORGADMIN, which Snowflake indicates is being replaced by GLOBALORGADMIN. This option also violates least-privilege guidance by broadly granting ACCOUNTADMIN to a central team across all accounts.
B. Correct.
Correct. This reflects Snowflake best practice: use ORGADMIN/GLOBALORGADMIN for organization-scoped responsibilities, such as creating and managing accounts in the organization and viewing organization-level information, while ACCOUNTADMIN should be used for administration within an individual account. Both roles are highly privileged and should be tightly controlled and granted to as few trusted users as possible.
C. Incorrect.
Incorrect. Granting ORGADMIN/GLOBALORGADMIN broadly to all account administrators expands privilege unnecessarily and conflicts with separation-of-duties and least-privilege principles. Account administrators usually need account-scoped privileges, not organization-wide authority.
D. Incorrect.
Incorrect. This reverses the intended scope of the roles. ACCOUNTADMIN is for account-level administration, while ORGADMIN/GLOBALORGADMIN is for organization-level administration. Warehouse, database, role, and user management inside an account are not the primary purpose of ORGADMIN/GLOBALORGADMIN.

ADA-C01 Question 8

Select 2Identify use cases and follow best practices for ORGADMIN and ACCOUNTADMIN roles (note: ORGADMIN will be replaced with GLOBARORGADMIN)

A global retailer uses a Snowflake organization with several accounts for development, production, and a recently acquired subsidiary. The security team wants to reduce risk from over-privileged administrative access while still allowing central governance of organization-level tasks. They also want day-to-day account administration to continue within each account. Which TWO actions best follow Snowflake best practices for using the ORGADMIN role (noting that ORGADMIN is being replaced with GLOBALORGADMIN) and the ACCOUNTADMIN role?

A
Assign ORGADMIN/GLOBALORGADMIN only to a very limited set of trusted administrators for organization-level operations such as managing accounts, and avoid using it for routine in-account object administration.
B
Grant ACCOUNTADMIN to all platform engineers because it is required for most SQL administration tasks and is the recommended role for daily operational work.
C
Use ACCOUNTADMIN within each account for account-level administration, but create and use more granular custom roles for routine operational tasks whenever possible instead of relying on ACCOUNTADMIN for all work.
D
Use ORGADMIN/GLOBALORGADMIN to manage warehouses, databases, and schemas inside each account so that organization-wide standards are enforced from a single role.
E
Grant both ORGADMIN/GLOBALORGADMIN and ACCOUNTADMIN to the same broad operations team so they can switch roles as needed without delays.

Show answer and explanation

Correct answers: A, C

Explanation

The best answers are 1 and 3. In Snowflake, ORGADMIN, which is being replaced by GLOBALORGADMIN, is designed for organization-level administration across accounts in an organization. It should be restricted to a very small number of trusted administrators and used only for organization-scoped tasks. ACCOUNTADMIN is the highest-privileged built-in role within a single account, but Snowflake best practices recommend avoiding its use for routine work. Instead, administrators should implement least-privilege access by creating custom roles for specific operational duties and reserving ACCOUNTADMIN for tasks that truly require it. This aligns with Snowflake guidance around separation of duties, minimizing assignment of powerful built-in roles, and using built-in roles only where appropriate for their intended scope.

A. Correct.
Correct. ORGADMIN, and going forward GLOBALORGADMIN, is intended for organization-level administration, such as viewing and managing accounts in the organization. Best practice is to tightly restrict this role to a small number of highly trusted administrators because it has broad scope across the organization. It should not be used for routine administration within a single account.
B. Incorrect.
Incorrect. ACCOUNTADMIN is highly privileged within an account, but it is not recommended for broad assignment or routine daily administration. Snowflake best practice is to use least privilege and delegate operational tasks through narrower custom roles whenever possible. Many administration tasks can be performed without granting ACCOUNTADMIN.
C. Correct.
Correct. ACCOUNTADMIN is the top administrative role inside an individual Snowflake account and is appropriate for certain account-level administrative tasks. However, best practice is not to use ACCOUNTADMIN for all operational work. Instead, organizations should create more specific roles for tasks such as warehouse management, user administration, data loading, or security operations, reducing risk and improving auditability.
D. Incorrect.
Incorrect. ORGADMIN/GLOBALORGADMIN is not the role used to manage regular objects such as warehouses, databases, and schemas inside accounts. Those are account-scoped administrative responsibilities typically handled with ACCOUNTADMIN or delegated custom roles within the account. This option reflects a common misunderstanding that organization-level scope overrides account object management.
E. Incorrect.
Incorrect. Granting both powerful roles broadly increases risk and violates least-privilege principles. Snowflake best practice is to separate organization-level administration from account-level administration as much as practical, assigning only the permissions required for each job function. Broad dual-role assignment makes accidental misuse or security exposure more likely.

ADA-C01 Question 9

Single answerAnalyze the impact of organizational-level changes on account-level objects

An enterprise uses Snowflake Organizations to centrally manage several production and non-production accounts. The organization administrator is asked to rename one of the production accounts to align with a new naming standard. A Snowflake administrator in that account is concerned about possible impact on existing account-level objects and integrations. Which statement best describes the expected impact of this organizational-level change?

A
Renaming the account changes the account locator, so database replication and failover groups referencing the source account must be recreated.
B
Renaming the account updates the account name shown in the organization, but account-level objects such as databases, warehouses, roles, users, and grants remain unchanged; however, any external processes that reference the account identifier in connection settings may need to be updated depending on what identifier they use.
C
Renaming the account automatically renames all account-level objects that include the old account name as a naming prefix, including warehouses, databases, and resource monitors.
D
Renaming the account invalidates all existing network policies and security integrations because they are bound to the original organization-level account name.

Show answer and explanation

Correct answer: B

Explanation

In Snowflake Organizations, certain actions such as renaming an account are performed at the organization level, but they do not automatically modify account-level objects inside that account. A key distinction is between the account name and the account locator: the locator is a stable identifier, while the account name is an administratively managed name that may appear in organization views and some connection contexts. As a result, renaming an account generally does not affect internal objects like databases, schemas, warehouses, users, roles, grants, resource monitors, network policies, or integrations. The main operational concern is external dependency review: connection strings, partner tools, IdP settings, private connectivity documentation, scripts, and automation may rely on account identifiers or URLs. Snowflake documentation on organization and account administration, as well as account identifiers and connection URLs, supports this distinction and the best practice of validating external integrations after organization-level account changes.

A. Incorrect.
Incorrect. An account rename does not change the account locator. The locator is the stable identifier used in many Snowflake URLs and cross-account operations. Because the locator does not change, replication and failover configurations are not recreated solely due to an account rename. This option reflects a common misconception that the display/account name and locator are the same thing.
B. Correct.
Correct. An organization-level account rename affects the account's name within the organization, but it does not automatically alter account-level objects such as databases, warehouses, roles, users, grants, resource monitors, or policies. The practical risk is with clients, scripts, SSO configurations, or integration code that may reference an account name or account URL format that includes the old account name rather than a stable locator-based identifier. Administrators should validate connection strings and dependent tooling after the rename.
C. Incorrect.
Incorrect. Snowflake does not cascade account renames into object renames. Object names are independent metadata objects within the account. If an organization used naming conventions that embedded the old account name in object names, those objects would keep their current names unless explicitly renamed by administrators.
D. Incorrect.
Incorrect. Network policies and security integrations are not invalidated simply because the account name was changed at the organization level. These account-level objects remain in place. Some external identity provider or client-side configurations might require review if they explicitly reference an old account URL or identifier, but the Snowflake objects themselves are not automatically invalidated.

ADA-C01 Question 10

Single answerAnalyze the impact of organizational-level changes on account-level objects

A global enterprise uses an organization with several Snowflake accounts for development, testing, and production. The organization administrator plans to rename one existing account to align with a new corporate naming standard. Several application teams are concerned about possible downstream impact on their account-level objects and integrations. Which statement best describes the effect of this organizational-level change?

A
Renaming the account changes only the account identifier shown at the organization level; existing databases, schemas, roles, warehouses, and users inside the account are not renamed automatically.
B
Renaming the account automatically updates all fully qualified object names in SQL, including database, schema, and object references stored in views and procedures.
C
Renaming the account causes all shares, replication/failover configurations, and data listings associated with the account to be dropped and recreated manually.
D
Renaming the account automatically changes the names of all account-level objects that include the old account name as part of their object name.

Show answer and explanation

Correct answer: A

Explanation

This question tests the candidate's ability to distinguish organization-level administration from account-level object management. In Snowflake, changing an account name at the organization level does not automatically rename internal account objects such as databases, schemas, roles, warehouses, or users. The practical impact is primarily on references to the account itself, especially in cross-account access patterns, integrations, client connection settings, or operational documentation. Best practice is to perform an impact assessment for anything that references the account name externally, while understanding that contained objects remain unchanged unless explicitly altered. This aligns with Snowflake administration guidance that organization-level actions manage accounts as entities, whereas object names and definitions within an account are controlled independently through account-level DDL and administration.

A. Correct.
Correct. An account rename is an organization-level administrative change that affects the account's identity and related references such as account locator-based identification or organization/account naming conventions, but it does not automatically rename objects contained within the account. Account-level objects such as databases, schemas, tables, roles, warehouses, and users retain their existing names unless explicitly altered. This is the key distinction between changing an account's organizational metadata and modifying object definitions inside the account.
B. Incorrect.
Incorrect. Fully qualified SQL object names are based on database, schema, and object names, not on the account name in a way that Snowflake rewrites automatically across code artifacts. Renaming an account does not trigger mass updates to stored SQL text in views, procedures, tasks, or application code. A common misconception is to assume Snowflake propagates name changes throughout dependent code, but administrators must still assess external references and integrations separately.
C. Incorrect.
Incorrect. Renaming an account does not inherently drop shares, replication groups, failover groups, or listings. However, administrators should validate any integration or configuration that references the account by organization/account name or locator because some external or cross-account references may need to be updated. The misconception here is confusing a metadata rename with destructive reconfiguration.
D. Incorrect.
Incorrect. Snowflake does not inspect object names and rewrite them just because they happen to contain the old account name as part of a string. If a warehouse, database, role, or other object was manually named using the old naming convention, it keeps that name until an administrator explicitly renames it. This option reflects a common but incorrect assumption that organizational naming changes cascade into object names automatically.

Timed practice exam

Take a ADA-C01 practice test under exam conditions

65 questions in 115 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

What the ADA-C01 exam covers

The objectives this question bank covers most, by number of questions.

I need one more page for Domain 6.0.Here are all 6 domains with every skill and sub-item:
2 questions
Domain 1.0: Snowflake Security, Role-Based Access Control (RBAC), and User Administration (31%)
2 questions
1.1 Manage administrative roles
2 questions
Identify use cases and follow best practices for ORGADMIN and ACCOUNTADMIN roles (note: ORGADMIN will be replaced with GLOBARORGADMIN)
2 questions
Analyze the impact of organizational-level changes on account-level objects
2 questions
1.2 Given a set of business requirements, design access control framework
2 questions
Identify use cases for the different frameworks
2 questions
Discretionary Access Control (DAC)
2 questions

All 565 ADA-C01 practice questions

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them.

ADA-C01 exam dumps FAQ

Are these ADA-C01 dumps real exam questions?

No. These are original practice questions written to the SnowPro® Advanced: Administrator exam objectives, not questions copied from a live exam. Memorising leaked questions violates Snowflake's candidate agreement and stops working the moment the question pool rotates. Use this bank to check your understanding of each domain and to find the topics you still need to study.

How many ADA-C01 practice questions are there?

565 questions, each with the correct answer, an explanation of the answer, and a note on why every other option is wrong. The first 10 are on this page and every question has its own page linked below.

Are the ADA-C01 exam dumps free?

Yes. Every question, answer and explanation on this page and the linked question pages is free to read without an account. A free HydraNode account adds timed practice exams, scoring and progress tracking across attempts.

How do I take a timed ADA-C01 practice test?

Sign in and start the SnowPro® Advanced: Administrator exam on HydraNode. A session gives you 65 questions drawn from this bank in 115 minutes, then a score report with a per-question review.

What topics does the ADA-C01 exam cover?

The questions in this bank are grouped under: I need one more page for Domain 6.0.Here are all 6 domains with every skill and sub-item:; Domain 1.0: Snowflake Security, Role-Based Access Control (RBAC), and User Administration (31%); 1.1 Manage administrative roles; Identify use cases and follow best practices for ORGADMIN and ACCOUNTADMIN roles (note: ORGADMIN will be replaced with GLOBARORGADMIN); Analyze the impact of organizational-level changes on account-level objects; 1.2 Given a set of business requirements, design access control framework; Identify use cases for the different frameworks; Discretionary Access Control (DAC).