ADA-C01 Question 136
Single answer2.1 Manage organizations and accounts.A global company uses a Snowflake organization with several production and non-production accounts across AWS and Azure. The lead administrator wants a small central platform team to create new accounts, view organization-level usage, and rename accounts when business units are reorganized. However, each individual account's local administrators must continue managing users, roles, warehouses, and database objects only within their own account. Which role should be granted to the central platform team to meet these requirements with the least privilege?
- A
Grant the ORGADMIN role in the organization to the central platform team
- B
Grant the ACCOUNTADMIN role in every account to the central platform team
- C
Grant the SECURITYADMIN role in every account to the central platform team
- D
Grant the SYSADMIN role in the organization to the central platform team
Show answer and explanation
Correct answer: A
Explanation
The key distinction is between organization-level administration and account-level administration in Snowflake. For managing organizations and accounts, Snowflake uses the ORGADMIN role at the organization level. ORGADMIN is intended for tasks such as creating and managing accounts and accessing organization-level information. In contrast, ACCOUNTADMIN, SECURITYADMIN, and SYSADMIN are account-scoped roles used for administration inside a specific account. Because the requirement is to let a central team manage accounts across the organization while preserving local administration within each account, ORGADMIN is the best fit and satisfies least-privilege principles. This reflects Snowflake best practices for separating organization governance from account operations, as described in Snowflake documentation on organization administration, built-in system roles, and managing accounts in an organization.
- A. Correct.
Correct. ORGADMIN is the organization-level administrative role used to manage the Snowflake organization and its accounts. This includes tasks such as creating and managing accounts and accessing organization-level views and capabilities. It is the appropriate role for a centralized team that needs organization-wide account administration without requiring broad object-level administration inside each account. This aligns with least-privilege design because local account administration can remain with each account's own administrators.
- B. Incorrect.
Incorrect. ACCOUNTADMIN is scoped to an individual account, not the entire organization. Granting ACCOUNTADMIN in every account would provide very broad privileges inside each account, including management of warehouses, databases, roles, and users, which exceeds the stated requirement. It also creates unnecessary administrative overhead because the team would need privileges granted separately in each account rather than centrally at the organization level.
- C. Incorrect.
Incorrect. SECURITYADMIN is also an account-level role and primarily focuses on managing grants, roles, and users within an account. It does not provide organization-level capabilities such as creating new accounts or performing other organization administration tasks. Choosing this option reflects the misconception that account-level security administration can replace organization administration.
- D. Incorrect.
Incorrect. SYSADMIN is an account-level role used for managing objects such as warehouses and databases within an account. There is no organization-wide SYSADMIN role used for managing organizations and accounts in the way described. This option is a plausible distractor because candidates may confuse familiar account-level system administration with organization administration.