ADA-C01 Question 43
Single answerCreate custom rolesA Snowflake administrator is designing a least-privilege access model for a new analytics team. The company wants all analysts to inherit a common baseline of read-only access to shared reporting objects, while a smaller subset of senior analysts also needs additional privileges to create temporary working tables in a sandbox schema. The administrator must create custom roles so privileges can be managed centrally and assigned to users with minimal duplication. Which approach best meets these requirements?
- A
Create a single custom role for all analysts, grant it both the read-only privileges and sandbox table-creation privileges, and assign that role to every analyst user.
- B
Create two custom roles: one baseline role with shared read-only privileges and one senior-analyst role with sandbox creation privileges; then grant the baseline role to the senior-analyst role and assign roles to users based on job function.
- C
Grant all required object privileges directly to each user account, and use a custom role only for future objects that may be created later.
- D
Create a senior-analyst custom role first, grant it to the baseline analyst role, and then assign only the baseline role to all users so inherited privileges flow down as needed.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to create layered custom roles based on business responsibilities and use role hierarchy to avoid duplicated privilege grants. In Snowflake RBAC, privileges are granted to roles, roles are granted to other roles, and roles are then granted to users. A common design is to place shared privileges in a lower-level role and grant that role to a more specialized higher-level role. This allows the higher-level role to inherit the lower-level privileges. For this scenario, a baseline analyst role should contain the common read-only access, and a senior-analyst role should contain the additional sandbox privileges while inheriting the baseline role. This follows Snowflake best practices for least privilege, centralized administration, and scalable custom role design. Relevant Snowflake documentation includes the access control overview, role hierarchy behavior, and guidance on using roles rather than granting privileges directly to users.
- A. Incorrect.
Incorrect. This violates least-privilege because every analyst would receive sandbox table-creation capability, even though only senior analysts need it. While it reduces administrative overhead, it does so by over-granting access rather than by designing an appropriate role hierarchy.
- B. Correct.
Correct. This is the recommended RBAC design in Snowflake: create custom roles aligned to job functions, place common privileges in a reusable baseline role, and grant that lower-level role to a higher-level senior role. Senior analysts then inherit the shared read-only access plus their additional sandbox privileges, while standard analysts receive only the baseline role. This minimizes duplication and supports centralized privilege management.
- C. Incorrect.
Incorrect. Directly granting privileges to users is not a best practice in Snowflake RBAC because it makes access harder to audit, scale, and maintain. Snowflake recommends granting privileges to roles and then assigning roles to users. Using direct user grants would increase administrative complexity and reduce consistency.
- D. Incorrect.
Incorrect. The role hierarchy direction is backwards. In Snowflake, if role A is granted to role B, then role B inherits role A's privileges. To let senior analysts inherit baseline access, the baseline role should be granted to the senior role, not the reverse. Assigning only the baseline role to all users would also fail to provide the senior-specific privileges.