ADA-C01 Question 64
Single answerManage account-level permissionsA Snowflake administrator is onboarding a security operations team that must review query history, monitor running sessions, and terminate sessions when suspicious activity is detected. The team must not be able to create users, change role grants, or modify other account-level security settings. Which privilege should the administrator grant to the team's custom role to meet these requirements with the least privilege?
- A
Grant the MONITOR USAGE global privilege to the custom role
- B
Grant the OPERATE global privilege to the custom role
- C
Grant the SECURITYADMIN role to the custom role
- D
Grant the ACCOUNTADMIN role to the custom role
Show answer and explanation
Correct answer: B
Explanation
This scenario tests account-level permission design using least privilege. In Snowflake, global privileges can be granted directly to roles for targeted administrative capabilities without assigning powerful system roles. For a team that must observe activity and take operational action such as terminating suspicious sessions, OPERATE is the best fit. MONITOR USAGE supports visibility into usage and monitoring data, but by itself does not satisfy the requirement to stop sessions. SECURITYADMIN and ACCOUNTADMIN are common but incorrect choices because they overgrant access and violate least-privilege best practices. Snowflake documentation on access control and global privileges distinguishes monitoring privileges from operational privileges and emphasizes granting only the minimum privileges required for the job function.
- A. Incorrect.
Incorrect. MONITOR USAGE is a global privilege that allows viewing account usage and monitoring metadata, but it does not permit performing operational actions such as terminating sessions. A candidate might choose this because the team needs visibility into query history and sessions, but the requirement also includes taking action against suspicious sessions.
- B. Correct.
Correct. The OPERATE global privilege is designed for operational account-level actions, including managing or terminating running sessions and similar operational tasks, without broadly delegating account security administration. This aligns with the requirement to monitor activity and stop suspicious sessions while avoiding unnecessary authority to manage users, roles, or account-wide security configuration.
- C. Incorrect.
Incorrect. SECURITYADMIN is far too powerful for this use case. It is intended for managing grants and security objects such as roles and user access. Granting it would violate least-privilege requirements because the team would be able to alter role grants and other security-related permissions, which the scenario explicitly prohibits.
- D. Incorrect.
Incorrect. ACCOUNTADMIN is the most powerful system role in the account and includes extensive administrative capabilities well beyond the stated need. It would allow broad account management and security changes, directly conflicting with the requirement to prevent the team from creating users, changing role grants, or modifying account-level settings.