ADA-C01 Question 15
Single answerDiscretionary Access Control (DAC)A Snowflake account uses role-based access control with several custom roles. The role DATA_STEWARD owns the SALES_DB database and all existing schemas and tables in it. An analyst with the role ANALYST_LEAD needs to delegate SELECT access on only a few existing tables in SALES_DB.PUBLIC to the role BI_READERS without involving SECURITYADMIN. The company wants to follow discretionary access control (DAC) principles while avoiding broader privilege escalation. Which action should the Snowflake administrator take?
- A
Grant the ANALYST_LEAD role the global MANAGE GRANTS privilege so the analyst can grant SELECT on the required tables to BI_READERS.
- B
Transfer ownership of the SALES_DB.PUBLIC schema to ANALYST_LEAD so the analyst can control grants on objects in that schema.
- C
Grant SELECT on the required tables to ANALYST_LEAD with GRANT OPTION so the analyst can grant that privilege on those specific tables to BI_READERS.
- D
Grant the ANALYST_LEAD role the SECURITYADMIN system role so the analyst can perform the required grants without changing object ownership.
Show answer and explanation
Correct answer: C
Explanation
This scenario tests practical application of discretionary access control in Snowflake. Under DAC, access to an object can be delegated by the object owner or by a role that has been granted a privilege with GRANT OPTION. Because DATA_STEWARD owns the objects, the least-privilege solution is for DATA_STEWARD (or another authorized administrator acting appropriately) to grant SELECT WITH GRANT OPTION on only the required tables to ANALYST_LEAD. ANALYST_LEAD can then grant SELECT on those same tables to BI_READERS. By contrast, MANAGE GRANTS, SECURITYADMIN, or transferring OWNERSHIP all provide much broader authority than needed. This aligns with Snowflake best practices around least privilege and delegated administration using object privileges with GRANT OPTION rather than elevated administrative roles. Relevant Snowflake documentation includes guidance on access control, discretionary access control behavior, GRANT OPTION, OWNERSHIP, and the MANAGE GRANTS global privilege.
- A. Incorrect.
Incorrect. MANAGE GRANTS is a powerful global privilege that effectively allows a role to manage grants across objects it does not own. This exceeds the requirement to delegate access on only a few tables and violates the goal of avoiding broader privilege escalation. It is also more aligned with centralized administrative control than limited DAC delegation.
- B. Incorrect.
Incorrect. Transferring OWNERSHIP of the schema would give ANALYST_LEAD broad control over the schema and its securable objects, far beyond the stated need to delegate SELECT on a few existing tables. OWNERSHIP is the highest level of control on an object and is not the least-privilege approach for this scenario.
- C. Correct.
Correct. In Snowflake DAC, an object owner, or a role with the privilege and GRANT OPTION, can delegate that privilege to another role. Granting ANALYST_LEAD the SELECT privilege with GRANT OPTION on only the required tables allows the analyst to grant SELECT to BI_READERS on those tables and nothing more. This satisfies the business requirement while following least privilege.
- D. Incorrect.
Incorrect. Granting SECURITYADMIN would provide much broader administrative capability than necessary. SECURITYADMIN is intended for managing grants and roles at an administrative level, not for limited business-user delegation on a small set of objects. This option conflicts with both least privilege and the stated desire to avoid broader escalation.