ADA-C01 Question 148
Single answerPerform account tasksA Snowflake account administrator needs to decommission a legacy ETL service account that has been used for years across multiple databases, warehouses, and integrations. Before disabling the user, the administrator must identify every object in the account currently owned by that service account so ownership can be transferred without breaking production processes. Which approach should the administrator use?
- A
Run SHOW GRANTS TO USER <service_user> to list all objects the user owns, then transfer ownership for the returned objects
- B
Query the ACCOUNT_USAGE views such as GRANTS_TO_USERS to identify OWNERSHIP grants held by the user across object types, then transfer ownership with GRANT OWNERSHIP
- C
Use DESCRIBE USER <service_user> to retrieve the list of databases, schemas, and warehouses owned by the user, then reassign them
- D
Drop the user with CASCADE so that Snowflake automatically transfers ownership of dependent objects to ACCOUNTADMIN
Show answer and explanation
Correct answer: B
Explanation
For decommissioning a user safely, the administrator should first discover which objects are owned by that principal and then transfer ownership deliberately. In Snowflake, ownership is a special privilege and should be reassigned using GRANT OWNERSHIP before disabling or dropping the user. Account-level metadata in SNOWFLAKE.ACCOUNT_USAGE is the appropriate source for broad inventory and impact analysis across the account. This is more reliable for administrative review than relying on user description commands, and Snowflake does not provide an automatic user-drop cascade mechanism that rehomes ownership. Relevant Snowflake documentation includes GRANT OWNERSHIP, SHOW GRANTS, and the ACCOUNT_USAGE views for account-wide auditing and administration.
- A. Incorrect.
Incorrect. SHOW GRANTS TO USER returns privileges granted to the user, but it is not a complete account-wide ownership discovery mechanism for all object types in the way required for a controlled decommissioning process. Administrators often confuse privileges granted to a user with a comprehensive inventory of objects owned by that user. Ownership analysis is typically done through account metadata views and then remediated explicitly.
- B. Correct.
Correct. A practical way to identify objects owned by a user across the account is to query Snowflake metadata in ACCOUNT_USAGE, including grant-related views such as GRANTS_TO_USERS, and filter for the OWNERSHIP privilege. Once identified, ownership should be transferred explicitly using GRANT OWNERSHIP on each object to an appropriate role before disabling or removing the user. This aligns with Snowflake best practices for account task administration and controlled ownership transfer.
- C. Incorrect.
Incorrect. DESCRIBE USER returns user properties such as login-related attributes and defaults, not an inventory of all securable objects owned by that user. This option reflects a common misconception that user metadata includes object ownership relationships.
- D. Incorrect.
Incorrect. Snowflake does not support dropping a user with a CASCADE option that automatically reassigns ownership of all owned objects to ACCOUNTADMIN. Ownership must be handled explicitly. Assuming automatic reassignment is dangerous and could leave administration incomplete or fail the drop operation depending on remaining dependencies.