ADA-C01 Question 20
Single answerUser-based Access Control (UBAC)A Snowflake administrator is troubleshooting why a contractor can query a shared reporting schema even though the contractor was not granted any account roles. The user can sign in, switch to a default secondary role setting, and successfully run SELECT statements against tables in the ANALYTICS.REPORTING schema. The security team wants this access to be controlled directly at the user level for a short-term engagement, without creating or assigning account roles. Which action should the administrator take to intentionally support this requirement using Snowflake User-based Access Control (UBAC)?
- A
Grant the required object privileges directly to the user, and ensure the user has USE SECONDARY ROLES enabled so direct user grants can be evaluated in the session
- B
Grant the privileges to the PUBLIC role because UBAC uses PUBLIC as the container for user-specific object access
- C
Create a database role, grant object privileges to the database role, and assign the database role directly to the user because database roles are the primary mechanism for UBAC
- D
Grant the privileges directly to the user and set the user's default role to ACCOUNTADMIN so direct grants are activated during login
Show answer and explanation
Correct answer: A
Explanation
Snowflake supports User-based Access Control (UBAC), which allows certain privileges on securable objects to be granted directly to a user instead of to a role. This can be useful for temporary or highly targeted access, although Snowflake best practice generally favors role-based access control for manageability and auditability. A key operational detail is that direct user grants are considered only when secondary roles are enabled in the session. In practice, administrators commonly use USE SECONDARY ROLES = ALL so the user's direct grants can be evaluated alongside role grants.
The distractors reflect common misunderstandings: confusing PUBLIC with user-specific access, assuming database roles are the same as UBAC, or incorrectly believing elevated default roles are needed to activate direct grants. Snowflake documentation on access control and direct grants to users describes that direct user grants are supported but role-based design remains the recommended long-term model.
- A. Correct.
Correct. In Snowflake, UBAC allows object privileges to be granted directly to a user rather than through roles. For those direct grants to be used during authorization, the user session must have secondary roles enabled, typically with USE SECONDARY ROLES = ALL or an equivalent session setting. This matches the scenario requirement to avoid creating or assigning account roles for temporary access while still allowing the user to query the objects.
- B. Incorrect.
Incorrect. PUBLIC is an account role automatically granted to all users, but it is not a UBAC container for user-specific access. Granting privileges to PUBLIC would broadly expose access to all users, which is the opposite of the security team's goal of limiting access to one contractor.
- C. Incorrect.
Incorrect. Database roles can hold privileges on objects within a database and can be granted to account roles, but assigning privileges through a database role is role-based access control, not user-based access control. This option also does not satisfy the requirement to avoid creating or assigning account roles for this short-term use case.
- D. Incorrect.
Incorrect. Direct grants to a user do not require the ACCOUNTADMIN role, and setting a user's default role to ACCOUNTADMIN would be a severe over-privileging mistake. UBAC works through direct grants evaluated with secondary roles enabled, not by elevating the user's default role.