ADA-C01 Question 57
Single answerManage warehouse grants (for example, USAGE, OPERATE, MODIFY, MONITOR)A Snowflake administrator needs to delegate warehouse management for the ETL team while maintaining least privilege. The team must be able to start and stop the warehouse ETL_WH, suspend or resume it during off-hours, and view warehouse usage/activity for troubleshooting. However, they must not be able to change warehouse size, auto-suspend settings, or any other warehouse properties. Which privilege should be granted on ETL_WH to the ETL_SUPPORT role to meet these requirements?
- A
Grant USAGE on warehouse ETL_WH to ETL_SUPPORT
- B
Grant OPERATE on warehouse ETL_WH to ETL_SUPPORT
- C
Grant MONITOR on warehouse ETL_WH to ETL_SUPPORT
- D
Grant MODIFY on warehouse ETL_WH to ETL_SUPPORT
Show answer and explanation
Correct answer: B
Explanation
The best answer is OPERATE. In Snowflake, warehouse privileges are separated by purpose: USAGE is for consuming compute, OPERATE is for runtime control such as suspend/resume, MONITOR is for viewing usage and state, and MODIFY is for changing configuration. When a team needs to manage whether a warehouse is running but must not alter its configuration, OPERATE is the least-privilege choice. This aligns with Snowflake access control best practices: grant only the minimum required privilege for the task. Refer to Snowflake documentation for warehouse privileges and GRANT syntax, especially the distinctions among USAGE, OPERATE, MONITOR, and MODIFY on virtual warehouses.
- A. Incorrect.
Incorrect. USAGE allows a role to use the warehouse to execute queries and DML/DDL operations that require compute, but it does not allow the role to suspend, resume, or otherwise operate the warehouse. A common misconception is that because a role can 'use' a warehouse, it can also control its runtime state; in Snowflake these are separate privileges.
- B. Correct.
Correct. OPERATE allows a role to perform operational actions on a warehouse such as suspending and resuming it. This fits the requirement to start and stop ETL_WH without permitting configuration changes. Snowflake also allows users with appropriate access to inspect warehouse state and activity, but OPERATE is the key privilege for controlling runtime operation while avoiding broader administrative authority.
- C. Incorrect.
Incorrect. MONITOR allows a role to view warehouse details and usage information, which is useful for troubleshooting and observability, but it does not permit suspending or resuming the warehouse. Someone might choose this because the scenario mentions viewing activity, but MONITOR alone is insufficient for operational control.
- D. Incorrect.
Incorrect. MODIFY is too permissive for the stated requirement. It allows changing warehouse properties such as warehouse size, scaling policy, auto-suspend, and other configuration settings. Because the team must not be able to alter warehouse configuration, granting MODIFY would violate least-privilege design.