ADA-C01 Question 48
Single answerAlign usage of object access with business functionsA company is redesigning Snowflake access controls to better match business functions. The Finance team owns and manages finance schemas and tables, the Data Engineering team builds ETL pipelines and creates shared staging objects, and the BI team only needs read access to curated reporting tables. Auditors have found that several users were granted object privileges directly, making it difficult to verify whether access is aligned to job responsibilities. Which approach should the Snowflake administrator implement to best align object access with business functions while improving auditability and least-privilege access?
- A
Create functional roles such as FINANCE_OWNER, DATA_ENGINEER, and BI_ANALYST; grant object privileges to these roles based on responsibilities; and assign the roles to users instead of granting privileges directly to individual users.
- B
Grant all required privileges directly to each user, but document the business reason for every grant in an external spreadsheet reviewed quarterly.
- C
Use a single custom role for all three teams so that object grants are centralized and easier to manage, then rely on warehouse-level controls to separate duties.
- D
Grant OWNERSHIP on finance and reporting objects to all team leads so they can manage access for their departments without involving security administrators.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement role-based access control (RBAC) using roles that reflect business functions, then grant object privileges to those roles rather than directly to users. In Snowflake, privileges are assigned to roles, and roles are assigned to users. This model is central to aligning access with organizational responsibilities, simplifying audits, and enforcing least privilege. For this scenario, separate functional roles for Finance, Data Engineering, and BI map naturally to the way teams use data objects. Finance can receive administrative or object management privileges only for finance-owned objects, Data Engineering can receive create and modify privileges for ETL and staging objects, and BI can receive read access to curated reporting tables. Direct grants to users are generally discouraged because they reduce consistency and make entitlement reviews more difficult. Likewise, using one broad role for multiple business functions or granting widespread OWNERSHIP creates unnecessary privilege concentration and weakens segregation of duties. These practices align with Snowflake documentation and best practices around access control, RBAC, and least-privilege design.
- A. Correct.
Correct. Snowflake best practice is to grant privileges to roles, then assign roles to users. Designing access around business functions with functional roles aligns permissions to job responsibilities and improves auditability because administrators can review role grants and object grants systematically. This also supports least privilege by allowing each team to receive only the access required for its function.
- B. Incorrect.
Incorrect. Although documentation can help with governance, direct user grants are harder to manage and audit at scale. This approach does not align well with role-based access control and increases the risk of inconsistent access over time. In Snowflake, role-based grants are the preferred mechanism for maintaining business-function alignment.
- C. Incorrect.
Incorrect. A single shared role across Finance, Engineering, and BI violates least-privilege principles and does not align object access to distinct business functions. Warehouse controls govern compute usage, not fine-grained access to schemas, tables, and other securable objects, so they do not provide appropriate separation of duties for object access.
- D. Incorrect.
Incorrect. Granting OWNERSHIP broadly is excessive for most business functions because OWNERSHIP conveys full control over an object, including the ability to transfer privileges and modify grants. Team leads typically do not need this level of access for routine consumption or development tasks. Overusing OWNERSHIP weakens governance and increases administrative risk.