ADA-C01 Question 220
Single answerDetermine use cases and benefitsA global company has several business units using the same Snowflake account. The platform team wants to improve governance and reduce administrative overhead while still allowing each business unit to manage its own users, warehouses, and data access policies. Today, all grants are managed centrally by SECURITYADMIN, which has become a bottleneck and causes delays when onboarding new analysts. The team is evaluating whether to introduce custom roles with delegated administration. Which approach would BEST address this requirement while preserving centralized control of high-level account governance?
- A
Grant ACCOUNTADMIN to each business unit lead so they can independently manage users, warehouses, and object privileges within their area.
- B
Create custom business-unit admin roles, grant them the necessary privileges on specific warehouses, databases, schemas, and user-management tasks, and assign those roles to the business unit leads while keeping top-level governance with central administrators.
- C
Move each business unit into a separate virtual warehouse and use warehouse ownership to control all user and object administration.
- D
Grant SYSADMIN to business unit leads and rely on future grant inheritance so they can manage all security-related tasks without needing SECURITYADMIN.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to implement delegated administration using custom roles that map to each business unit's responsibilities. In Snowflake, role-based access control is designed to let organizations distribute operational responsibilities without granting excessive account-wide power. This is a strong use case for custom roles because it reduces bottlenecks, supports separation of duties, and improves operational scalability while maintaining central oversight of sensitive account-level functions.
From a best-practice standpoint, Snowflake recommends granting only the minimum privileges required and avoiding routine use of powerful system roles such as ACCOUNTADMIN. Central administrators can retain control of global governance, while business-unit administrators receive carefully scoped privileges for the users, warehouses, and data objects they manage. Candidates should recognize that the benefit of delegated administration is not just convenience; it is also stronger governance through least privilege, clearer accountability, and reduced operational friction.
Relevant Snowflake documentation and guidance include role-based access control (RBAC), least-privilege administration, system roles such as ACCOUNTADMIN/SECURITYADMIN/SYSADMIN, and delegated management patterns using custom roles and grants.
- A. Incorrect.
Incorrect. Granting ACCOUNTADMIN to business unit leads violates least-privilege principles and gives broad control over the entire account, including billing-related and high-level administrative capabilities. This may reduce onboarding delays, but it creates major governance and security risks. A common misconception is that broad roles are the easiest way to decentralize administration; in practice, they usually overexpose authority.
- B. Correct.
Correct. This approach aligns with Snowflake best practices of using custom roles and delegated administration to balance autonomy with governance. Business-unit-specific admin roles can be granted only the privileges needed to manage users, warehouses, and access within their scope, while central teams retain control over account-wide settings and high-level governance. This reduces dependence on SECURITYADMIN for routine tasks and is an appropriate use case for role-based access control in decentralized operating models.
- C. Incorrect.
Incorrect. Virtual warehouses provide compute resources; they do not serve as a boundary for comprehensive user, role, and object administration. Warehouse ownership allows management of the warehouse itself, not full administrative control over databases, schemas, roles, or users associated with a business unit. Someone might choose this option if they confuse compute isolation with administrative delegation.
- D. Incorrect.
Incorrect. SYSADMIN is intended primarily for managing objects, not as a substitute for scoped security administration. Future grants help automate privilege propagation to new objects, but they do not provide a governance model for delegated user and role administration by themselves. This option mixes object administration with security administration and does not adequately preserve centralized control.