ADA-C01 Question 53
Select 2Monitor granted privileges to users and roles, and on objectsA Snowflake security administrator must validate whether the role ANALYST_READONLY can currently query data in the FINANCE_DB database, and also determine whether a specific user, JLEE, inherits that access through role grants. The administrator wants the most direct SQL commands to inspect both the privileges granted on the database and the role hierarchy affecting the user. Which TWO commands should the administrator use?
- A
SHOW GRANTS ON DATABASE FINANCE_DB;
- B
SHOW GRANTS TO ROLE ANALYST_READONLY;
- C
SHOW ROLES LIKE 'ANALYST_READONLY';
- D
SHOW GRANTS TO USER JLEE;
- E
DESCRIBE DATABASE FINANCE_DB;
Show answer and explanation
Correct answers: A, D
Explanation
To monitor granted privileges in Snowflake, administrators commonly use SHOW GRANTS variants depending on the inspection target: ON
- A. Correct.
Correct. SHOW GRANTS ON DATABASE FINANCE_DB returns the privileges granted directly on the database object, including which roles have privileges such as USAGE, OWNERSHIP, or imported privileges where applicable. This is the most direct way to inspect who has been granted access on that specific object.
- B. Incorrect.
Incorrect. SHOW GRANTS TO ROLE ANALYST_READONLY lists privileges granted to the role, as well as roles granted to the role, which is useful for reviewing the role overall. However, by itself it does not directly answer both parts of the scenario because the administrator also needs to determine whether the specific user JLEE inherits access. It is useful, but not sufficient for the combined requirement when only two commands are being selected.
- C. Incorrect.
Incorrect. SHOW ROLES LIKE 'ANALYST_READONLY' only confirms that the role exists and returns basic metadata about matching roles. It does not show object privileges granted to the role or user-to-role inheritance.
- D. Correct.
Correct. SHOW GRANTS TO USER JLEE returns roles granted to the user. This allows the administrator to verify whether JLEE has been assigned ANALYST_READONLY directly or through granted roles visible in the user's grants, which is necessary to determine inherited access from role assignments.
- E. Incorrect.
Incorrect. DESCRIBE DATABASE FINANCE_DB returns database properties and metadata such as retention settings and other attributes, not the access control grants on the object. It is commonly confused with grant inspection, but it is not a privilege-monitoring command.