ADA-C01 Question 8
Select 2Identify use cases and follow best practices for ORGADMIN and ACCOUNTADMIN roles (note: ORGADMIN will be replaced with GLOBARORGADMIN)A global retailer uses a Snowflake organization with several accounts for development, production, and a recently acquired subsidiary. The security team wants to reduce risk from over-privileged administrative access while still allowing central governance of organization-level tasks. They also want day-to-day account administration to continue within each account. Which TWO actions best follow Snowflake best practices for using the ORGADMIN role (noting that ORGADMIN is being replaced with GLOBALORGADMIN) and the ACCOUNTADMIN role?
- A
Assign ORGADMIN/GLOBALORGADMIN only to a very limited set of trusted administrators for organization-level operations such as managing accounts, and avoid using it for routine in-account object administration.
- B
Grant ACCOUNTADMIN to all platform engineers because it is required for most SQL administration tasks and is the recommended role for daily operational work.
- C
Use ACCOUNTADMIN within each account for account-level administration, but create and use more granular custom roles for routine operational tasks whenever possible instead of relying on ACCOUNTADMIN for all work.
- D
Use ORGADMIN/GLOBALORGADMIN to manage warehouses, databases, and schemas inside each account so that organization-wide standards are enforced from a single role.
- E
Grant both ORGADMIN/GLOBALORGADMIN and ACCOUNTADMIN to the same broad operations team so they can switch roles as needed without delays.
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are 1 and 3. In Snowflake, ORGADMIN, which is being replaced by GLOBALORGADMIN, is designed for organization-level administration across accounts in an organization. It should be restricted to a very small number of trusted administrators and used only for organization-scoped tasks. ACCOUNTADMIN is the highest-privileged built-in role within a single account, but Snowflake best practices recommend avoiding its use for routine work. Instead, administrators should implement least-privilege access by creating custom roles for specific operational duties and reserving ACCOUNTADMIN for tasks that truly require it. This aligns with Snowflake guidance around separation of duties, minimizing assignment of powerful built-in roles, and using built-in roles only where appropriate for their intended scope.
- A. Correct.
Correct. ORGADMIN, and going forward GLOBALORGADMIN, is intended for organization-level administration, such as viewing and managing accounts in the organization. Best practice is to tightly restrict this role to a small number of highly trusted administrators because it has broad scope across the organization. It should not be used for routine administration within a single account.
- B. Incorrect.
Incorrect. ACCOUNTADMIN is highly privileged within an account, but it is not recommended for broad assignment or routine daily administration. Snowflake best practice is to use least privilege and delegate operational tasks through narrower custom roles whenever possible. Many administration tasks can be performed without granting ACCOUNTADMIN.
- C. Correct.
Correct. ACCOUNTADMIN is the top administrative role inside an individual Snowflake account and is appropriate for certain account-level administrative tasks. However, best practice is not to use ACCOUNTADMIN for all operational work. Instead, organizations should create more specific roles for tasks such as warehouse management, user administration, data loading, or security operations, reducing risk and improving auditability.
- D. Incorrect.
Incorrect. ORGADMIN/GLOBALORGADMIN is not the role used to manage regular objects such as warehouses, databases, and schemas inside accounts. Those are account-scoped administrative responsibilities typically handled with ACCOUNTADMIN or delegated custom roles within the account. This option reflects a common misunderstanding that organization-level scope overrides account object management.
- E. Incorrect.
Incorrect. Granting both powerful roles broadly increases risk and violates least-privilege principles. Snowflake best practice is to separate organization-level administration from account-level administration as much as practical, assigning only the permissions required for each job function. Broad dual-role assignment makes accidental misuse or security exposure more likely.