ADA-C01 Question 52
Single answerCreate additional AdministratorsA global company is onboarding a new platform operations team that must manage users, roles, and warehouse configuration in a Snowflake account. The security team does not want to share the ACCOUNTADMIN role broadly because it also owns high-risk privileges such as global account management and broad object access. The lead architect wants a solution that follows least privilege while still allowing the new team to perform day-to-day administrative tasks. Which approach should be implemented?
- A
Grant ACCOUNTADMIN to the new team because it already contains all privileges required for user, role, and warehouse administration.
- B
Create a custom role, grant it the USERADMIN and SYSADMIN roles, and assign that custom role to the new team.
- C
Create a custom role, grant it MANAGE GRANTS and OWNERSHIP on all current and future warehouses, and assign that custom role to the new team.
- D
Grant SECURITYADMIN to the new team because it can manage users and roles, and warehouse administration can be handled through inherited security privileges.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to create a custom administrative role and grant it the USERADMIN and SYSADMIN roles. In Snowflake, system-defined roles are designed with separation of duties in mind: USERADMIN focuses on user and role management, while SYSADMIN manages warehouses, databases, and other objects. For organizations that need additional administrators without exposing ACCOUNTADMIN, Snowflake best practice is to create custom roles that inherit only the administrative capabilities required. This supports least privilege, improves auditability, and reduces operational risk. ACCOUNTADMIN should be reserved for a very limited set of trusted personnel because it has broad control over the account. This aligns with Snowflake guidance on access control, role hierarchy, and use of system-defined roles.
- A. Incorrect.
Incorrect. Although ACCOUNTADMIN would allow the team to perform the required tasks, this violates Snowflake best practice. ACCOUNTADMIN is the top-level administrative role and should be tightly limited because it effectively combines broad capabilities across the account. Using it for routine administration expands risk unnecessarily and does not follow least privilege.
- B. Correct.
Correct. A common Snowflake best practice for creating additional administrators is to create a custom role and grant it both USERADMIN and SYSADMIN. USERADMIN enables management of users and roles, while SYSADMIN enables management of warehouses and other objects typically required for operational administration. Assigning the custom role to the new team provides the needed capabilities without giving them full ACCOUNTADMIN access.
- C. Incorrect.
Incorrect. MANAGE GRANTS allows grant management but does not replace the administrative capabilities provided by USERADMIN for user and role administration. Also, granting OWNERSHIP on warehouses may allow control over those specific objects, but it does not provide the complete, scalable account-level administrative pattern needed for creating and managing users, roles, and future operational objects. This is an overly customized and incomplete approach.
- D. Incorrect.
Incorrect. SECURITYADMIN can manage users and roles and can grant privileges, but it is not the recommended role for warehouse administration. Warehouse creation and broader object administration are typically associated with SYSADMIN or roles inheriting from it. Assuming security privileges alone can cover warehouse administration reflects a misunderstanding of Snowflake's system role separation.