ARA-C01 Question 206
Single answerRolesA global enterprise is redesigning access control in Snowflake after an audit found that object ownership is concentrated in a few broad administrative roles. The security team wants application databases and schemas to remain manageable by platform administrators without giving them broad access to business data. They also want future grants to be handled consistently as new schemas and objects are created. Which approach best meets these requirements?
- A
Transfer ownership of databases and schemas to a custom platform role, grant that role to SYSADMIN, and let SYSADMIN continue managing both structure and data access.
- B
Use separate custom functional roles for object ownership and data access, assign ownership of databases/schemas to a platform role, grant data privileges through separate access roles, and use future grants to standardize new object permissions.
- C
Grant all application teams the SECURITYADMIN role so they can manage grants on their own objects without needing centralized administration.
- D
Keep ownership with ACCOUNTADMIN, create database roles for all privileges, and rely on ACCOUNTADMIN to grant those database roles directly to end users.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to separate ownership roles from access roles. In Snowflake, the role that owns an object has full control over that object, including the ability to grant privileges on it. Because of this, concentrating ownership in highly privileged administrative roles creates avoidable risk. A stronger design gives ownership of databases and schemas to narrowly scoped custom platform roles, while data access is delivered through separate custom roles or database roles depending on the design. Future grants are a key operational tool for ensuring newly created objects inherit the correct privilege model consistently. This approach aligns with least-privilege principles and Snowflake best practices around role-based access control, custom role hierarchy design, and minimizing use of system roles such as ACCOUNTADMIN and SECURITYADMIN for routine operations.
- A. Incorrect.
This does not sufficiently separate duties. Although using a custom role for ownership is better than concentrating ownership in ACCOUNTADMIN, granting that ownership role to SYSADMIN still mixes structural administration with broad access patterns. In practice, a role that owns containers and objects can manage privileges on them, so this design does not achieve the audit goal of separating platform administration from business data access.
- B. Correct.
This is correct. A best-practice Snowflake role design separates functional responsibilities: one set of roles owns and manages objects, while different access roles receive SELECT, INSERT, UPDATE, or other data privileges. Assigning ownership of databases and schemas to a platform role allows controlled administration of structure, while separate access roles limit data exposure. Future grants help ensure new schemas, tables, and views receive consistent permissions without manual intervention, which is especially important in growing environments.
- C. Incorrect.
This is incorrect because SECURITYADMIN is a powerful system role intended for managing roles and grants at the account level, not for decentralized use by application teams. Giving it broadly violates least privilege and increases administrative and audit risk. It also does not solve the ownership concentration problem in a controlled way.
- D. Incorrect.
This is incorrect because keeping ownership with ACCOUNTADMIN is explicitly contrary to the audit finding that ownership is too centralized in broad administrative roles. While database roles can be useful for managing privileges within a database, relying on ACCOUNTADMIN for ongoing direct grants to end users is not aligned with least privilege or operational best practices.