ADA-C01 Question 46
Single answerDetermine use cases for primary and secondary rolesA Snowflake administrator is redesigning access for a data engineering team. Engineers use a common ETL role to run pipelines, but some engineers also need occasional read-only access to finance data for troubleshooting. The security team wants to avoid users repeatedly switching roles during troubleshooting sessions, while still keeping the ETL role as the main context for object creation and operational tasks. Which approach best meets this requirement?
- A
Grant the finance read-only role to the ETL role so all ETL executions automatically inherit finance access
- B
Set the ETL role as the users' primary role and enable the finance read-only role as a secondary role when needed
- C
Set the finance read-only role as the primary role and keep the ETL role as a secondary role so both privileges are merged for all actions
- D
Create a new custom role that duplicates the privileges of both the ETL and finance read-only roles, and assign that new role as the only role to the affected engineers
Show answer and explanation
Correct answer: B
Explanation
The best answer is to keep the ETL role as the primary role and use the finance read-only role as a secondary role when needed. This matches a common Snowflake use case for primary versus secondary roles: users operate mainly under one business or operational role, but can temporarily activate additional granted roles in the same session to avoid constant USE ROLE switching. Primary roles are important because they define the main active role context, especially for tasks such as object creation and ownership-related behavior. Secondary roles are useful when a user needs additive privileges from other granted roles during a session. This approach supports least privilege better than granting finance access directly to the ETL role, and it avoids unnecessary custom role sprawl. See Snowflake documentation on role-based access control, primary roles, and secondary roles, including the use of USE SECONDARY ROLES and the distinction between the current role and secondary active roles.
- A. Incorrect.
Incorrect. Granting the finance read-only role to the ETL role would broaden finance access to anyone using the ETL role, including pipeline executions and other users of that role. This violates least-privilege principles and is not appropriate when only some engineers need occasional access.
- B. Correct.
Correct. In Snowflake, the primary role remains the active role context for many operations, including ownership-sensitive behavior and object creation context, while secondary roles can be enabled so the session can use privileges from additional granted roles without repeatedly switching roles. This is a strong fit when users primarily work under one role but need occasional access from another role in the same session.
- C. Incorrect.
Incorrect. Using the finance read-only role as the primary role does not align with the requirement to keep the ETL role as the main operational context. In addition, primary and secondary roles are not simply interchangeable; the primary role is still significant for session context and object creation semantics.
- D. Incorrect.
Incorrect. Although this can work technically, it creates unnecessary role proliferation and duplicates privilege management. It also reduces flexibility and makes governance harder compared with using secondary roles for occasional additive access. Best practice is generally to avoid creating combined roles when the need is session-based and already addressed by Snowflake's secondary role capability.