ARA-C01 Question 89
Single answerAccess control privilegesA company uses Snowflake managed access schemas to centralize privilege management. In database FIN_DB, the schema PAYROLL is configured as a managed access schema and is owned by role SECURITY_ADMIN_PAYROLL. A developer role, APP_DEV, creates a new table PAYROLL.SALARIES. The company wants ANALYST_READONLY to be able to query the table, while ensuring individual object owners cannot grant access directly. Which action should the architect recommend to satisfy this requirement?
- A
Grant SELECT on table PAYROLL.SALARIES to role ANALYST_READONLY by using role SECURITY_ADMIN_PAYROLL or another role with MANAGE GRANTS
- B
Grant OWNERSHIP on table PAYROLL.SALARIES to role ANALYST_READONLY so it can inherit read access without additional grants
- C
Have role APP_DEV grant SELECT on table PAYROLL.SALARIES to role ANALYST_READONLY because APP_DEV created the table
- D
Grant USAGE on schema PAYROLL to role ANALYST_READONLY; SELECT on the table will be implied in a managed access schema
Show answer and explanation
Correct answer: A
Explanation
This question tests understanding of Snowflake access control behavior in managed access schemas. In a managed access schema, object owners lose the ability to grant privileges on objects they own unless they are also the schema owner or have MANAGE GRANTS. This design is used to enforce centralized governance and prevent ad hoc grants by developers or other object creators. To let ANALYST_READONLY query PAYROLL.SALARIES, a grant of SELECT must be issued by the schema owner role, SECURITY_ADMIN_PAYROLL, or by a role with the global MANAGE GRANTS privilege. In practice, the querying role also needs USAGE on the parent database and schema. This aligns with Snowflake documentation and best practices around managed access schemas, RBAC, and least-privilege access design.
- A. Correct.
Correct. In a managed access schema, object owners do not control grant decisions for objects in that schema. Privileges on objects in the schema are granted by the schema owner or by a role with the global MANAGE GRANTS privilege. To allow querying, ANALYST_READONLY would need the appropriate container privileges as well, such as USAGE on the database and schema, but the key action that satisfies the requirement is that SECURITY_ADMIN_PAYROLL (the schema owner) or a role with MANAGE GRANTS grants SELECT on PAYROLL.SALARIES.
- B. Incorrect.
Incorrect. OWNERSHIP is the highest privilege and transfers control of the object; it is not an appropriate way to provide read-only query access. It also violates least-privilege design. Query access should be granted with SELECT, not by transferring object ownership.
- C. Incorrect.
Incorrect. This is a common misconception. In a regular schema, the object owner can often grant privileges on the object. However, in a managed access schema, grant management is centralized and the object owner cannot independently grant access unless it is also the schema owner or holds MANAGE GRANTS. APP_DEV created the table, but that does not permit it to grant SELECT in this scenario.
- D. Incorrect.
Incorrect. USAGE on the schema is necessary for object resolution, but it does not imply SELECT on tables. Managed access schemas centralize who can grant privileges; they do not change the meaning of USAGE or make table-level read access implicit.