ADA-C01 Question 14
Select 2Identify use cases for the different frameworksA global enterprise uses Snowflake across several business units and wants to standardize governance and administration. The central platform team needs to: (1) define consistent security and object ownership patterns for databases, schemas, and warehouses; (2) delegate account-level administration without giving every administrator unrestricted access; and (3) organize many accounts under a single governance structure for centralized billing and policy management. Which Snowflake frameworks are the BEST fit for these requirements? (Select TWO.)
- A
Use the system-defined role hierarchy framework, including roles such as SYSADMIN, SECURITYADMIN, and ACCOUNTADMIN, to separate responsibilities and delegate administration.
- B
Use the Organizations framework to centrally manage multiple accounts, billing, and account-level governance across the enterprise.
- C
Use Snowpipe Streaming as the governance framework for assigning administrative responsibilities and account ownership.
- D
Use replication and failover groups as the primary framework for defining security ownership patterns and role delegation across a single account.
- E
Use data sharing as the framework for centralizing account administration and enforcing role separation.
Show answer and explanation
Correct answers: A, B
Explanation
The best answer is to combine Snowflake's role-based administration framework with the Organizations framework. Within an individual account, Snowflake best practice is to use role-based access control and the system-defined administrative roles to separate duties and reduce overuse of ACCOUNTADMIN. This supports practical governance goals such as assigning security management, object administration, and operational responsibilities to different teams. For multi-account enterprises, Snowflake Organizations provides the overarching framework for centralized account management and consolidated billing.
The other options describe real Snowflake capabilities, but they are intended for different use cases: Snowpipe Streaming is for ingestion, replication/failover groups are for business continuity, and data sharing is for secure live data access across accounts. Snowflake documentation on access control, system-defined roles, and Organizations aligns with this design approach and is commonly reflected in administrator best practices.
- A. Correct.
Correct. Snowflake's system-defined role hierarchy is the appropriate framework for separating duties within an account. Roles such as SYSADMIN, SECURITYADMIN, and ACCOUNTADMIN are designed to support administration with delegated responsibility. SYSADMIN typically manages objects and warehouses, SECURITYADMIN manages roles and grants, and ACCOUNTADMIN has the broadest level of account control. This framework is directly relevant to defining ownership and operational boundaries without granting every admin full account access.
- B. Correct.
Correct. Snowflake Organizations is the correct framework for managing multiple Snowflake accounts under a single organizational structure. It supports centralized visibility and administration use cases such as account creation, account grouping, and consolidated billing. For an enterprise operating across many business units, Organizations is the right fit for centralized governance at the multi-account level.
- C. Incorrect.
Incorrect. Snowpipe Streaming is an ingestion capability used for low-latency data loading into Snowflake. It is not an administrative or governance framework, and it does not provide mechanisms for role delegation, object ownership design, or centralized account management.
- D. Incorrect.
Incorrect. Replication and failover groups are business continuity and disaster recovery features. They are used to replicate supported objects and enable failover across regions or accounts, not to establish baseline governance models for role hierarchy or ownership delegation within an account. A candidate might choose this option because failover groups can include certain account-level objects, but that is not their primary governance purpose.
- E. Incorrect.
Incorrect. Data sharing is used to share live data securely between accounts without copying it. It is not intended to centralize account administration or implement separation of duties for administrators. This distractor reflects the misconception that any cross-account feature can serve as a governance framework.