ADA-C01 Question 63
Single answerManage account-level permissionsA company wants to tighten administrative access in its Snowflake account. The SECURITYADMIN role should continue to manage users and roles, but it must no longer be able to create warehouses, databases, or other account-level objects. A separate custom role, PLATFORM_ADMIN, should be responsible for creating and managing those account-level objects. Which change best meets this requirement while following Snowflake privilege best practices?
- A
Grant the ACCOUNTADMIN role to PLATFORM_ADMIN and revoke ACCOUNTADMIN from SECURITYADMIN.
- B
Grant CREATE WAREHOUSE, CREATE DATABASE, and other required global privileges directly to PLATFORM_ADMIN, and avoid using SECURITYADMIN for object creation.
- C
Transfer ownership of the SNOWFLAKE database to PLATFORM_ADMIN so it can create account-level objects without additional privileges.
- D
Grant SYSADMIN to SECURITYADMIN so it can delegate object creation to PLATFORM_ADMIN through inherited privileges.
Show answer and explanation
Correct answer: B
Explanation
The key distinction is that managing account-level permissions in Snowflake often involves global privileges granted on the account, not just object-level privileges or role inheritance assumptions. SECURITYADMIN is designed primarily for user, role, and grant management. To separate duties, organizations commonly create a custom role for platform administration and grant it only the necessary global privileges, such as CREATE WAREHOUSE and CREATE DATABASE. This aligns with Snowflake best practices around least privilege and separation of duties, rather than relying on broad system roles like ACCOUNTADMIN. Relevant Snowflake documentation includes guidance on access control, system-defined roles, and global privileges granted at the account level.
- A. Incorrect.
Incorrect. Granting ACCOUNTADMIN to PLATFORM_ADMIN would provide broad administrative capabilities far beyond the stated requirement, violating least-privilege principles. Also, SECURITYADMIN is intended for managing grants, roles, and users, while ACCOUNTADMIN is the top-level administrative role and should be tightly controlled. Replacing one overly powerful role with another does not solve the problem cleanly.
- B. Correct.
Correct. In Snowflake, account-level object creation is controlled through global privileges such as CREATE WAREHOUSE, CREATE DATABASE, CREATE INTEGRATION, and similar privileges granted at the account level. A best-practice approach is to use a custom administrative role for platform operations and grant only the required global privileges to that role. SECURITYADMIN can continue to manage users and roles without also being used to create account-level objects.
- C. Incorrect.
Incorrect. Ownership of the SNOWFLAKE database does not confer the ability to create account-level objects such as warehouses or databases. Those actions require account-level global privileges. This option confuses database-level ownership with account-level administrative permissions.
- D. Incorrect.
Incorrect. Granting SYSADMIN to SECURITYADMIN expands privileges in the wrong direction and mixes security administration with object administration. While SYSADMIN is commonly used for creating and owning many objects in role hierarchies, the requirement is specifically to prevent SECURITYADMIN from being used for account-level object creation. Adding SYSADMIN to SECURITYADMIN would undermine separation of duties.