ADA-C01 Question 40
Select 2Secure the ACCOUNTADMIN roleA company discovers that several senior engineers routinely log in with the ACCOUNTADMIN role to perform daily development and operational tasks. During a security review, the Snowflake administrator is asked to reduce the risk associated with this practice while still allowing a small break-glass group to perform account-level administration when necessary. Which actions should the administrator take to best secure the ACCOUNTADMIN role? (Choose two.)
- A
Create separate custom administrative roles for routine duties, grant only the minimum required privileges to those roles, and reserve ACCOUNTADMIN for exceptional account-level tasks.
- B
Grant ACCOUNTADMIN to all SYSADMIN users so they can inherit the full administrative hierarchy only when needed.
- C
Limit ACCOUNTADMIN assignment to a very small set of trusted users and require stronger authentication controls such as MFA through the organization's authentication policies.
- D
Transfer all object ownership to ACCOUNTADMIN so that administrators can centralize access control and reduce privilege sprawl.
- E
Set ACCOUNTADMIN as the default role for security administrators so sensitive account-level operations can be audited more easily.
Show answer and explanation
Correct answers: A, C
Explanation
To secure ACCOUNTADMIN, Snowflake best practices emphasize minimizing who has the role, using least privilege, and avoiding the role for day-to-day operations. A strong approach is to create custom roles for routine administration and reserve ACCOUNTADMIN for exceptional account-level actions, often as a tightly controlled break-glass role. In addition, privileged users should be protected with stronger authentication controls such as MFA and appropriate authentication or network policies. Broad assignment, default use, or unnecessary concentration of object ownership under ACCOUNTADMIN all increase risk rather than reduce it. These practices align with Snowflake guidance around access control, system roles, least-privilege design, and securing privileged access.
- A. Correct.
Correct. Snowflake security best practice is to follow least privilege and avoid using ACCOUNTADMIN for routine work. Creating purpose-built custom roles for operational, security, or platform tasks reduces blast radius and limits exposure of the highest-privilege role. ACCOUNTADMIN should be used sparingly for tasks that truly require account-level authority.
- B. Incorrect.
Incorrect. Broadly granting ACCOUNTADMIN to SYSADMIN users significantly increases risk. Although the system roles have a hierarchy, ACCOUNTADMIN is the most powerful role in the account and should not be distributed widely for convenience. This option reflects a common misconception that inherited hierarchy justifies broad assignment of the top role.
- C. Correct.
Correct. Restricting ACCOUNTADMIN to a very small break-glass group is a core security control. Requiring strong authentication, including MFA where supported by the organization's authentication and access policies, helps protect the most sensitive role from compromise. This aligns with Snowflake guidance to tightly control powerful roles and strengthen authentication for privileged access.
- D. Incorrect.
Incorrect. Transferring all ownership to ACCOUNTADMIN is not a recommended way to secure the role. Ownership conveys powerful control over objects, and centralizing all ownership under ACCOUNTADMIN can actually increase operational risk and over-concentrate privilege. In practice, ownership should be assigned thoughtfully to appropriate roles, often using custom administrative roles.
- E. Incorrect.
Incorrect. Making ACCOUNTADMIN the default role increases the chance that users will run ordinary actions with excessive privilege. Best practice is the opposite: users should default to lower-privileged roles and switch to ACCOUNTADMIN only when a justified administrative task requires it. Auditing can still be achieved without making the most powerful role the default.