ADA-C01 Question 54
Select 2Monitor granted privileges to users and roles, and on objectsA security administrator needs to validate whether the role ANALYST_READONLY still has direct or inherited access to a sensitive table named FIN_DB.PII.CUSTOMERS after several recent role changes. The administrator also needs to identify whether any individual users received direct grants that bypass the expected role hierarchy. Which approach will provide the most complete and reliable view of current privileges in Snowflake?
- A
Run SHOW GRANTS TO ROLE ANALYST_READONLY and SHOW GRANTS ON TABLE FIN_DB.PII.CUSTOMERS, then correlate the results to determine role-based access and object-level grants.
- B
Query ACCOUNT_USAGE.GRANTS_TO_ROLES and ACCOUNT_USAGE.GRANTS_TO_USERS to review grants associated with the role, the table, and any direct grants to users.
- C
Run DESCRIBE TABLE FIN_DB.PII.CUSTOMERS because it lists all current privileges and all users who can access the table.
- D
Use SHOW USERS to determine which users inherited access to FIN_DB.PII.CUSTOMERS through ANALYST_READONLY.
- E
Run SHOW GRANTS OF ROLE ANALYST_READONLY to identify role hierarchy relationships, then combine that with SHOW GRANTS ON TABLE FIN_DB.PII.CUSTOMERS to evaluate inherited access paths and direct object grants.
Show answer and explanation
Correct answers: B, E
Explanation
To monitor granted privileges effectively in Snowflake, administrators need to examine both object-level grants and role hierarchy relationships, and also verify whether direct grants to users exist outside the intended role-based access model. For operational checks, SHOW GRANTS ON
- A. Incorrect.
This is only partially sufficient. SHOW GRANTS TO ROLE ANALYST_READONLY returns privileges granted directly to the role, and SHOW GRANTS ON TABLE returns grants on the table. However, this combination does not fully reveal inherited access through role hierarchy or direct grants to individual users unless additional commands are used. It is a common first step, but not the most complete approach for the scenario.
- B. Correct.
Correct. ACCOUNT_USAGE.GRANTS_TO_ROLES helps identify object privileges and role grants involving roles, while ACCOUNT_USAGE.GRANTS_TO_USERS helps detect direct grants to users. Together, these views support account-wide auditing and are well suited for validating both expected role-based access and exceptions where users received direct grants outside the intended model. This is especially useful for ongoing monitoring and reporting.
- C. Incorrect.
Incorrect. DESCRIBE TABLE returns metadata about the table structure and properties, not a complete privilege audit trail. It does not list all roles or users with access to the object. This distractor reflects the misconception that object metadata commands also provide security visibility.
- D. Incorrect.
Incorrect. SHOW USERS returns user attributes such as login and default role information, but it does not calculate or display inherited privileges on a specific object. A user may have access through multiple roles, and SHOW USERS alone cannot determine effective access to FIN_DB.PII.CUSTOMERS.
- E. Correct.
Correct. SHOW GRANTS OF ROLE ANALYST_READONLY reveals role hierarchy relationships, such as whether the role is granted to other roles or users, while SHOW GRANTS ON TABLE identifies which roles or users have privileges on the table. Used together, these commands help evaluate inherited access paths as well as direct grants on the object. This is a strong operational approach for real-time validation.