ARA-C01 Question 77
Select 21.3 Outline Snowflake security principles and identify use cases where they should be applied.A healthcare company is building a Snowflake data platform that will be used by three groups: data engineers who load raw patient data, analysts who query de-identified datasets, and an external billing partner that should access only a small set of billing records. The security architect must enforce least privilege, minimize exposure of protected health information (PHI), and simplify long-term administration as teams change. Which TWO actions best align with Snowflake security principles for this design?
- A
Create functional roles for data engineers, analysts, and the external billing partner; grant object privileges to those roles, and assign roles to users instead of granting privileges directly to users.
- B
Allow analysts to query the raw patient tables directly, but rely on warehouse isolation and query history monitoring to detect inappropriate PHI access.
- C
Publish secure views that expose only de-identified columns to analysts and a separate secure view that filters billing rows for the external partner.
- D
Grant the external billing partner the ACCOUNTADMIN role temporarily so they can troubleshoot access issues without waiting for administrators.
- E
Use a single shared role for all internal and external users to reduce administrative overhead, then control visibility primarily through naming conventions.
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are 1 and 3 because they apply Snowflake's core security principles of role-based access control, least privilege, and controlled data exposure. Snowflake recommends assigning privileges to roles and then assigning roles to users, rather than granting privileges directly to users. This improves manageability and supports organizational change. For sensitive data, architects should avoid granting broad access to base tables and instead publish controlled interfaces such as secure views, including filtered or de-identified projections where appropriate. Secure views are especially useful when data consumers should not see underlying implementation details or unrestricted sensitive columns. By contrast, warehouses do not provide authorization boundaries, and highly privileged roles like ACCOUNTADMIN should be tightly restricted. These practices are consistent with Snowflake guidance on access control, system-defined roles, least-privilege design, and secure data access patterns.
- A. Correct.
Correct. Snowflake security best practice is to use role-based access control (RBAC) and grant privileges to roles rather than directly to users. Creating functional or access roles for distinct job responsibilities supports least privilege and makes administration easier as personnel change. Users can be assigned or removed from roles without redesigning object grants. This is a core Snowflake security principle and is especially appropriate in environments handling sensitive data such as PHI.
- B. Incorrect.
Incorrect. Warehouse isolation controls compute usage, not data authorization. Query history monitoring is detective, not preventive, and does not satisfy least privilege by itself. Allowing analysts direct access to raw patient tables increases the risk of exposing PHI. Snowflake best practice is to restrict access at the object level and expose only approved data structures such as views or governed datasets.
- C. Correct.
Correct. Secure views are appropriate when the architect needs to limit exposed data and prevent unintended disclosure through underlying object definitions. In this scenario, secure views can present de-identified columns to analysts and provide filtered access for the external billing partner. This aligns with data minimization and least privilege, both important security design principles in Snowflake. It also creates a cleaner abstraction layer so consumers do not need direct access to base tables containing sensitive data.
- D. Incorrect.
Incorrect. ACCOUNTADMIN is a highly privileged administrative role and should not be granted to an external partner for troubleshooting. This violates least privilege and creates unnecessary risk. Temporary elevation is still inappropriate here because the partner's business need is limited to a subset of billing data, not account administration. Troubleshooting should be handled through properly scoped roles and administrator processes.
- E. Incorrect.
Incorrect. A single shared role undermines separation of duties and least privilege. Naming conventions do not enforce security in Snowflake; privileges granted through roles and object access do. Combining internal and external users into one broad role increases blast radius and complicates auditing. This is a common misconception when teams optimize for convenience over security architecture.