ADA-C01 Question 62
Single answerProvide access to non-account Administrators to monitor billing and usage informationA Snowflake account uses a centralized platform team to manage security, while a separate FinOps team needs read-only visibility into account spending trends and warehouse consumption. Company policy prohibits granting the ACCOUNTADMIN role to FinOps users. The FinOps team must be able to monitor billing and usage from Snowsight with the least privilege possible, without giving them broad administrative control over the account.
Which action should the Snowflake administrator take?
- A
Grant the ACCOUNTADMIN role to the FinOps users, but restrict their virtual warehouse usage to prevent configuration changes
- B
Grant the imported database role SNOWFLAKE.USAGE_VIEWER to a custom role assigned to the FinOps users
- C
Grant the MONITOR USAGE privilege on the account to the FinOps users' custom role
- D
Grant the SECURITYADMIN role to the FinOps users so they can view usage-related objects without modifying billing settings
Show answer and explanation
Correct answer: B
Explanation
For non-account administrators who need to monitor billing and usage, Snowflake best practice is to grant access through the SNOWFLAKE shared database using imported database roles rather than assigning powerful system roles like ACCOUNTADMIN or SECURITYADMIN. The SNOWFLAKE.USAGE_VIEWER database role is designed to provide access to usage and cost monitoring data with reduced privilege. This aligns with Snowflake guidance on using least privilege and role-based access control for account usage visibility. In practice, administrators typically grant this imported database role to a custom functional role, then assign that custom role to FinOps or reporting users. This enables visibility into account usage and billing-related views without delegating broad administrative authority.
- A. Incorrect.
Incorrect. ACCOUNTADMIN provides broad, high-risk control over the account and violates the stated least-privilege requirement. Limiting warehouse usage does not meaningfully reduce the administrative scope of ACCOUNTADMIN, which can still manage roles, objects, and many account-level settings. This is a common mistake when teams confuse operational restrictions with actual privilege reduction.
- B. Correct.
Correct. The SNOWFLAKE database exposes account usage and organization usage views through imported database roles. Granting the SNOWFLAKE.USAGE_VIEWER database role to a custom role is the supported least-privilege approach for allowing non-account administrators to monitor billing and usage information in Snowsight and through SQL, without granting broad account administration privileges.
- C. Incorrect.
Incorrect. MONITOR USAGE is not the correct mechanism for giving users access to Snowflake billing and usage information in this scenario. Candidates often assume an account-level monitor privilege controls visibility into account usage views, but Snowflake provides access to these shared usage datasets through roles on the SNOWFLAKE shared database, such as USAGE_VIEWER.
- D. Incorrect.
Incorrect. SECURITYADMIN is still a powerful administrative role and is not intended for read-only FinOps access to billing and usage data. It primarily manages grants and roles, which exceeds the business requirement. Granting SECURITYADMIN would violate least-privilege principles and create unnecessary separation-of-duties concerns.