ARA-C01 Question 78
Select 21.3 Outline Snowflake security principles and identify use cases where they should be applied.A financial services company is redesigning access controls in Snowflake after an internal audit found that developers can query production customer tables directly and several teams are using the ACCOUNTADMIN role for routine work. The company must enforce least privilege, separate administrative duties, and ensure analysts only see rows for customers in their assigned region. Which TWO actions should the Snowflake architect recommend to best align with Snowflake security principles?
- A
Create custom roles for functional job duties, grant object privileges to those roles, and assign the roles to users instead of using ACCOUNTADMIN for daily activities
- B
Implement a row access policy on the customer tables so query results can be filtered by the analyst's region entitlement at runtime
- C
Grant the analysts the IMPORTED PRIVILEGES privilege on the SNOWFLAKE database so they can query only the rows for their region
- D
Use a single shared role for all administrators and developers so privilege management is centralized and easier to audit
- E
Grant ownership of production schemas directly to analyst roles so they can manage grants on the tables they query
Show answer and explanation
Correct answers: A, B
Explanation
The best answers are to use custom RBAC roles for job functions and to implement a row access policy for regional data filtering. Snowflake security principles emphasize least privilege, role-based access control, and separation of duties. In practice, this means avoiding broad use of ACCOUNTADMIN, SYSADMIN, or other highly privileged roles for everyday work, and instead designing custom role hierarchies that grant only the permissions required. For fine-grained data protection, Snowflake provides row access policies to enforce row-level security dynamically based on context such as current role, user, or mapping tables. This is more appropriate than trying to solve the problem with broad administrative privileges or unrelated privileges such as IMPORTED PRIVILEGES. Relevant Snowflake documentation includes guidance on Access Control Overview, System-Defined Roles, Role-Based Access Control, and Row Access Policies.
- A. Correct.
Correct. This follows Snowflake's role-based access control model and the principle of least privilege. Best practice is to create hierarchical custom roles aligned to business functions, grant only the required privileges to those roles, and avoid routine use of powerful system roles such as ACCOUNTADMIN. ACCOUNTADMIN is intended for limited administrative tasks, not daily querying or development work.
- B. Correct.
Correct. Row access policies are designed for fine-grained, dynamic row-level security in Snowflake. In this scenario, they allow a single customer table to enforce regional entitlements at query time without copying data into separate regional tables. This directly addresses the requirement that analysts only see rows for their assigned region.
- C. Incorrect.
Incorrect. IMPORTED PRIVILEGES on the SNOWFLAKE database is typically used to access shared metadata and account usage views provided by Snowflake, not to enforce row-level filtering on application data. It does not limit analysts to rows for a specific region in customer tables.
- D. Incorrect.
Incorrect. A single shared role for administrators and developers violates separation of duties and increases blast radius if credentials are misused. Snowflake security guidance favors distinct roles for different responsibilities, allowing privilege delegation and auditing at the appropriate scope.
- E. Incorrect.
Incorrect. Granting OWNERSHIP of production schemas to analyst roles is excessive and conflicts with least privilege. OWNERSHIP is a powerful privilege that effectively gives full control over securable objects and grant management. Analysts who only need to query data should typically receive usage and select-related privileges, not ownership.