ARA-C01 Question 36
Single answerSystem roles and associated best practicesA global enterprise is redesigning its Snowflake access model after an audit found that several platform engineers were using the ACCOUNTADMIN role for routine warehouse and user-management tasks. The company wants to reduce risk, preserve clear separation of duties, and align with Snowflake best practices for system roles. Which approach should the architect recommend?
- A
Grant ACCOUNTADMIN to all platform engineers, but require multi-factor authentication and query tagging for accountability.
- B
Use SECURITYADMIN for managing users and roles, use SYSADMIN for creating and managing warehouses and other objects, and reserve ACCOUNTADMIN for a very limited number of administrators and exceptional account-level tasks.
- C
Make USERADMIN the primary role for all object creation because it can manage users and therefore reduces the need for SYSADMIN.
- D
Assign PUBLIC the warehouse management privileges needed for day-to-day administration so engineers do not need elevated system roles.
Show answer and explanation
Correct answer: B
Explanation
Snowflake provides built-in system roles with distinct administrative purposes, and best practice is to use them according to separation-of-duties principles rather than relying on ACCOUNTADMIN for routine tasks. In general, SYSADMIN is the role that should own and manage most objects such as warehouses, databases, schemas, and other operational resources. SECURITYADMIN manages roles, grants, and users. ACCOUNTADMIN is the top-level administrative role and should be reserved for a very limited group because it combines powerful capabilities and inherits key administrative privileges. Overusing ACCOUNTADMIN is a common anti-pattern flagged in security reviews. Snowflake documentation and best-practice guidance emphasize least privilege, limiting use of ACCOUNTADMIN, and structuring role hierarchies so routine administration is performed with lower-privileged roles wherever possible.
- A. Incorrect.
Incorrect. Although MFA and monitoring are good controls, granting ACCOUNTADMIN broadly is not a best practice. ACCOUNTADMIN is the most powerful built-in system role and inherits privileges from major administrative roles. It should be tightly restricted because using it for routine operational work violates least-privilege principles and increases the blast radius of mistakes or misuse.
- B. Correct.
Correct. This aligns with Snowflake role design best practices. SECURITYADMIN is intended for managing roles and grants, including users and role hierarchy. SYSADMIN is the recommended owner of warehouses, databases, and other account objects used for normal administration and operations. ACCOUNTADMIN should be limited to a very small set of trusted administrators for exceptional account-level administration, billing, and other highly privileged tasks. This model supports separation of duties and reduces overuse of the highest-privilege role.
- C. Incorrect.
Incorrect. USERADMIN is focused on creating and managing users and roles, but it is not the recommended primary role for object creation and ongoing platform resource management. Object creation and ownership are generally aligned to SYSADMIN or custom functional roles under it. Using USERADMIN as the main operational role would blur responsibilities and does not follow Snowflake's intended system role separation.
- D. Incorrect.
Incorrect. PUBLIC is granted to every user and role in the account, so assigning warehouse management privileges to PUBLIC would massively overexpose administrative capabilities. This directly contradicts least-privilege best practices and would create a serious security risk.