ARA-C01 Question 38
Single answerFunctional roles compared to access rolesA company is redesigning its Snowflake RBAC model after several audit findings. Analysts in the FINANCE department need read access to selected finance schemas and the ability to use a shared analytics warehouse. Some analysts also act as team leads and must be able to grant the same data access to new analysts joining their team. The security architect wants a design that separates job responsibilities from object privileges, simplifies user onboarding, and follows Snowflake best practices for role hierarchy.
Which approach should the architect implement?
- A
Create a single FINANCE_ANALYST role that contains all warehouse, database, schema, and table privileges, grant it directly to users, and allow team leads to use that same role for both querying and granting access.
- B
Create access roles such as FINANCE_READ and ANALYTICS_WH_USE that hold object privileges, create functional roles such as FINANCE_ANALYST and FINANCE_TEAM_LEAD, grant the access roles to the functional roles, and grant the functional roles to users. Grant team leads an additional functional role that inherits the needed access roles and can be used for delegated role grants if allowed by policy.
- C
Create one functional role per user, grant all required object privileges directly to each functional role, and avoid shared access roles so audits can trace privileges back to a single person.
- D
Grant object privileges directly to users for data access, but use functional roles only for warehouse usage because warehouse privileges change more frequently than database privileges.
Show answer and explanation
Correct answer: B
Explanation
In Snowflake, a common architectural best practice is to separate functional roles from access roles. Access roles contain privileges on securable objects such as warehouses, databases, schemas, tables, and views. Functional roles model business responsibilities, such as FINANCE_ANALYST or FINANCE_TEAM_LEAD, and are granted one or more access roles. Users are then granted the appropriate functional roles. This pattern improves scalability, simplifies onboarding and offboarding, supports least privilege, and makes audits easier because object privileges are centralized in reusable access roles rather than scattered across user-specific roles or direct user grants.
Snowflake documentation and implementation guidance consistently emphasize using role hierarchies to simplify privilege management. In practice, architects often design lower-level access roles for object privileges and higher-level functional roles for job alignment. This also helps with separation of duties: elevated capabilities such as grant delegation should be assigned intentionally through separate roles or administrative processes rather than by overloading standard end-user roles.
- A. Incorrect.
Incorrect. This mixes job function and object access into one role, which makes role reuse and least-privilege management harder. It also creates operational overhead because the same role is used both for performing work and for administering grants. Snowflake best practice is to separate access roles, which hold object privileges, from functional roles, which represent job responsibilities and are assigned to users.
- B. Correct.
Correct. This design aligns with Snowflake RBAC best practices: access roles encapsulate privileges on securable objects, while functional roles represent business job functions and are granted to users. The hierarchy allows onboarding by assigning a functional role instead of repeatedly granting object privileges. It also supports cleaner separation of duties, because team leads can receive a separate functional role or delegated administrative capability rather than sharing a broad end-user role. This model is scalable, auditable, and easier to maintain.
- C. Incorrect.
Incorrect. Creating one functional role per user defeats the purpose of role-based access control and significantly increases administrative complexity. Functional roles should map to business functions, not individuals. Directly embedding object privileges into many user-specific roles reduces reuse and makes audits and privilege changes more difficult.
- D. Incorrect.
Incorrect. Granting object privileges directly to users is generally discouraged in Snowflake because it bypasses the role hierarchy and makes access management less consistent and harder to audit. Functional roles are not intended only for warehouse usage; they should represent job functions, while access roles should carry privileges for warehouses, databases, schemas, tables, and other securable objects.