ADA-C01 Question 58
Select 1Manage warehouse grants (for example, USAGE, OPERATE, MODIFY, MONITOR)A Snowflake administrator needs to let a support role troubleshoot performance issues on the warehouse ANALYTICS_WH without allowing that role to resize the warehouse or change its auto-suspend settings. The support team must be able to view warehouse activity and query execution details, and they must be able to suspend or resume the warehouse during incident response. Which privileges should be granted on ANALYTICS_WH to meet these requirements with least privilege?
- A
Grant USAGE and MODIFY on the warehouse
- B
Grant MONITOR and OPERATE on the warehouse
- C
Grant USAGE and MONITOR on the warehouse
- D
Grant OPERATE only on the warehouse
- E
Grant MODIFY and MONITOR on the warehouse
Show answer and explanation
Correct answer: B
Explanation
For Snowflake virtual warehouses, the privileges have distinct purposes: MONITOR is for viewing warehouse-related activity and usage information; OPERATE is for suspending and resuming the warehouse; MODIFY is for changing warehouse properties such as size and auto-suspend settings; and USAGE is required to use the warehouse for query execution. In this scenario, the support role does not need to run workloads or alter configuration, only observe and control the warehouse state during incidents. Therefore, the least-privilege solution is to grant MONITOR and OPERATE. This aligns with Snowflake access control best practices of granting only the minimum privileges required for the task.
- A. Incorrect.
Incorrect. USAGE allows queries to run on the warehouse, and MODIFY allows changing warehouse properties such as size, scaling policy, auto-suspend, and auto-resume. Because the requirement explicitly prohibits resizing or changing settings, MODIFY is too permissive.
- B. Correct.
Correct. MONITOR allows the role to view warehouse usage/activity details, and OPERATE allows the role to suspend and resume the warehouse. This combination satisfies the requirement to observe activity and control running state during incidents without permitting configuration changes.
- C. Incorrect.
Incorrect. MONITOR is appropriate for viewing activity, but USAGE is intended for running queries on the warehouse, not for suspending or resuming it. This option does not provide the needed operational control during incident response.
- D. Incorrect.
Incorrect. OPERATE allows suspend and resume, but by itself it does not provide the visibility needed to review warehouse activity and performance information. The scenario requires both observation and operational control.
- E. Incorrect.
Incorrect. MONITOR supports visibility, but MODIFY allows changing warehouse configuration, including resizing and auto-suspend behavior, which violates the least-privilege requirement. A candidate might choose this if they confuse operational control with configuration management.