ARA-C01 Question 205
Single answerRolesA global enterprise is redesigning access control in Snowflake after several audits found excessive privilege inheritance. The security team wants a model that minimizes direct object grants to users, supports centralized management of access to databases and warehouses, and allows business units to manage their own analyst roles without granting them broad account-level authority. Which approach best meets these requirements?
- A
Grant database, schema, table, and warehouse privileges directly to individual users so auditors can clearly trace each permission assignment.
- B
Create functional account roles (for example, BI_ANALYST and ETL_ENGINEER), grant object privileges to those roles, assign the roles to users, and use role hierarchy so business-unit-specific roles can inherit the functional roles they need.
- C
Create one custom role per business unit, grant that role OWNERSHIP on all databases and warehouses used by the unit, and let each unit assign privileges downward as needed.
- D
Use only system-defined roles such as SYSADMIN and SECURITYADMIN for all access management because built-in roles are easier to govern than custom roles.
Show answer and explanation
Correct answer: B
Explanation
Snowflake access control is built around roles, and best practice is to grant privileges to roles and then grant roles to users. This supports least privilege, simplifies audits, and scales better than direct grants to users. A layered role hierarchy is commonly recommended: access roles hold object privileges, functional roles map to job responsibilities, and business-unit or team roles can inherit those functional roles as needed. This design allows centralized governance of sensitive privileges while enabling delegated administration in a controlled way. In contrast, broad use of OWNERSHIP or system roles like SYSADMIN for general access creates unnecessary risk and weakens separation of duties. These principles are consistent with Snowflake documentation on access control, role hierarchy, and recommended RBAC design patterns.
- A. Incorrect.
This is incorrect because directly granting object privileges to users is not a scalable or recommended Snowflake access-control design. Snowflake best practice is to grant privileges to roles, then grant roles to users. Direct user grants make administration harder, increase audit complexity over time, and reduce the benefits of role-based access control and inheritance.
- B. Correct.
This is correct because it aligns with Snowflake RBAC best practices. Privileges should be granted to roles rather than directly to users. Functional roles can encapsulate job duties, and role hierarchy allows business-unit roles to inherit least-privilege access without needing account-wide administrative rights. This approach supports centralized governance while still enabling delegated role assignment within a controlled structure.
- C. Incorrect.
This is incorrect because granting OWNERSHIP broadly to business-unit roles violates least-privilege principles and introduces unnecessary risk. OWNERSHIP is a powerful privilege that includes the ability to transfer ownership and effectively control objects. Business units that only need to manage analyst access typically should not own all databases and warehouses. More granular privileges and role hierarchy are preferred.
- D. Incorrect.
This is incorrect because relying only on system-defined roles such as SYSADMIN and SECURITYADMIN is too coarse-grained for most enterprise designs. These roles are intended for specific administrative responsibilities, not day-to-day end-user access. Using them broadly would create excessive privilege exposure and weaken separation of duties.