ARA-C01 Question 19
Single answerIsolate or segment accountsA global enterprise is redesigning its Snowflake deployment after an acquisition. It must support three business units with different requirements: (1) the Finance unit processes highly sensitive payroll data and requires strict administrative separation from other teams, (2) the Analytics unit runs heavy ad hoc workloads that should not affect other units, and (3) a central data engineering team must share curated data products with all business units while minimizing duplicate ingestion pipelines. The company wants an architecture decision that best balances security isolation, operational autonomy, and controlled data sharing. Which approach should the architect recommend?
- A
Create separate Snowflake accounts for each business unit, keep the central data engineering team in its own account, and use Secure Data Sharing to distribute curated datasets to the business-unit accounts.
- B
Use a single Snowflake account with separate virtual warehouses for each business unit, because warehouse isolation provides the same administrative and security separation as separate accounts.
- C
Use one Snowflake account with separate databases and schemas for each business unit, and rely on role-based access control only; this avoids the complexity of cross-account data sharing while still meeting strict isolation requirements.
- D
Create a separate account only for Finance, but keep Analytics and the central data engineering team in the same account because virtual warehouses fully isolate both workloads and governance responsibilities.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to segment the environment into multiple Snowflake accounts and use Secure Data Sharing for controlled distribution of curated data. In Snowflake, an account is a key isolation boundary: it separates administrators, account-level settings, object namespaces, resource monitors, integrations, and governance responsibilities more strongly than databases, schemas, roles, or warehouses within a single account. Warehouses isolate compute consumption and reduce workload interference, but they do not provide the same administrative or security isolation as separate accounts. For organizations with distinct business units, acquisition-driven boundaries, or highly sensitive data domains such as payroll or finance, a multi-account design is a common architectural best practice. A central producer account can ingest and prepare shared datasets once, then expose them to consumer accounts through Secure Data Sharing, reducing data duplication and avoiding multiple ingestion pipelines. This aligns with Snowflake guidance on using accounts as a segmentation mechanism for business units, environments, or regulatory boundaries, while using secure sharing to distribute governed data across account boundaries.
- A. Correct.
Correct. Separate Snowflake accounts are the strongest native boundary for isolating administration, security domains, billing visibility, object namespaces, and governance responsibilities across business units. This is especially appropriate when one unit, such as Finance, requires strict separation for sensitive data and administration. Keeping the central data engineering team in a dedicated account allows it to publish curated datasets once and share them outward using Secure Data Sharing, minimizing duplicate ingestion and transformation pipelines. Separate accounts also help prevent one unit's account-level administrators from having visibility into another unit's environment.
- B. Incorrect.
Incorrect. Separate virtual warehouses provide compute isolation, which helps prevent workload contention, but they do not create administrative or security-domain isolation equivalent to separate accounts. Account administrators, account parameters, integrations, network policies, and many governance controls remain within the same account boundary. This option addresses performance isolation but not the requirement for strict administrative separation.
- C. Incorrect.
Incorrect. Role-based access control inside a single account is important, but it is not the same as account segmentation. A single account still shares account-level administration, governance surface area, and object namespace. For highly sensitive business units requiring strict separation, relying only on RBAC within one account is typically insufficient compared with separate accounts. This option also underestimates the value of controlled cross-account sharing for a hub-and-spoke style architecture.
- D. Incorrect.
Incorrect. Creating a separate account for Finance partially addresses the most sensitive requirement, but placing Analytics and central data engineering in the same account reduces operational autonomy and governance separation for those two groups. While separate warehouses can isolate compute workloads, they do not isolate account administration and broader governance responsibilities. Because the scenario explicitly calls for balancing security isolation, operational autonomy, and controlled sharing across business units, a fuller multi-account strategy is a better fit.