SnowflakeProfessional levelPage 3 of 5

SnowPro Advanced: Security Engineer exam dumps: questions 201 to 300 of 431

Page 3 of the free SnowPro Advanced: Security Engineer question bank for the SnowPro® Advanced: Security Engineer exam. Questions 201 to 300 are listed below, the first 5 in full with answers and explanations. Back to page 1 for the exam overview and FAQ.

Question bank last updated April 2026

Start timed practice exam Questions 201 to 300

Free SnowPro Advanced: Security Engineer practice questions

Questions 201 to 205 of 431

Pick an answer before you open the explanation. Each question also has its own page with a permalink.

SnowPro Advanced: Security Engineer Question 201

Single answerManage data replication access control and privileges:

A global company uses two Snowflake accounts in different regions: a primary production account and a secondary disaster recovery account. The security team wants to enable replication for a database named FINANCE_DB while following least-privilege practices. An engineer has already created an integration role named DR_ADMIN in the primary account. Which privilege assignment is required in the primary account so DR_ADMIN can configure database replication for FINANCE_DB without granting broader administrative access than necessary?

A
Grant OWNERSHIP on FINANCE_DB to DR_ADMIN.
B
Grant REPLICATION privilege on FINANCE_DB to DR_ADMIN.
C
Grant MONITOR USAGE on the account to DR_ADMIN.
D
Grant IMPORTED PRIVILEGES on FINANCE_DB to DR_ADMIN.

Show answer and explanation

Correct answer: B

Explanation

To manage database replication in Snowflake using least privilege, the relevant object-level privilege is REPLICATION on the database being replicated. Granting OWNERSHIP would work functionally in many cases but is broader than necessary and violates the scenario's security requirement. MONITOR USAGE and IMPORTED PRIVILEGES are unrelated to configuring replication. This aligns with Snowflake's access control model and replication administration guidance, where replication/failover capabilities are delegated through specific privileges rather than broad ownership wherever possible.

A. Incorrect.
Incorrect. OWNERSHIP would allow full control over the database, including transfer of ownership and broad administrative actions. While an owner can perform many management tasks, this exceeds least-privilege requirements. For configuring replication on a specific database, Snowflake provides a dedicated REPLICATION privilege.
B. Correct.
Correct. The REPLICATION privilege on a database is the least-privilege assignment needed to enable and manage replication for that database. This is the intended privilege for controlling database replication access without granting full database ownership.
C. Incorrect.
Incorrect. MONITOR USAGE provides visibility into account usage metadata and monitoring information, but it does not authorize configuration of database replication. A candidate might choose this if they confuse operational visibility with administrative control.
D. Incorrect.
Incorrect. IMPORTED PRIVILEGES applies to objects such as shared databases and is used to consume privileges from a data share. It is not the privilege used to configure replication for a database in the source account.

SnowPro Advanced: Security Engineer Question 202

Single answerImplement the principle of least privilege for replication-specific roles

A global retailer uses Snowflake replication to copy a production database from account PROD_US to account DR_EU for disaster recovery testing. The security team wants to enforce least privilege for the role used to manage replication. Requirements: the role must be able to refresh the replicated database in DR_EU, but it must not be able to create warehouses, manage users, or administer unrelated databases. Which approach best meets these requirements?

A
Grant ACCOUNTADMIN to the replication operator role in DR_EU because cross-account replication tasks require full account-level administration.
B
Create a custom role in DR_EU, grant only the privileges required to refresh the replicated database and any necessary access to the target database object, then assign that role to the replication operator user.
C
Grant SYSADMIN to the replication operator role in DR_EU because database-level operations are owned by SYSADMIN and this is the minimum practical role for replication.
D
Use the existing SECURITYADMIN role in DR_EU because replication is a security-sensitive activity and SECURITYADMIN is designed for controlled privileged operations.

Show answer and explanation

Correct answer: B

Explanation

For SnowPro Advanced: Security Engineer, the key principle is to separate replication duties from broad account administration. In Snowflake, least privilege means creating a dedicated custom role for the operational task and granting only the minimal privileges required on the relevant replicated objects, rather than assigning powerful built-in roles such as ACCOUNTADMIN, SYSADMIN, or SECURITYADMIN. This reduces risk, supports separation of duties, and aligns with Snowflake security best practices for role-based access control. Documentation and guidance around RBAC and replication/failover administration consistently emphasize using narrowly scoped custom roles wherever possible instead of defaulting to high-privilege system roles.

A. Incorrect.
Incorrect. ACCOUNTADMIN is the most powerful system role and violates least-privilege principles. Replication administration does not require broad authority such as user management, warehouse creation, or full account governance. Choosing ACCOUNTADMIN is a common operational shortcut, but it creates unnecessary risk and exceeds the stated requirements.
B. Correct.
Correct. The least-privilege approach is to create a dedicated custom role for replication operations and grant only the specific privileges needed to perform the refresh of the replicated database in the target account. This limits blast radius and prevents unrelated administrative capabilities such as user, warehouse, or other database administration. Snowflake best practice is to avoid using broad system roles when a scoped custom role can perform the required task.
C. Incorrect.
Incorrect. SYSADMIN is still far broader than necessary. Although SYSADMIN commonly owns many objects and can manage a wide range of resources, the scenario explicitly requires restricting the role from administering unrelated databases and other account resources. Using SYSADMIN would grant excessive permissions beyond the replication-specific task.
D. Incorrect.
Incorrect. SECURITYADMIN is intended primarily for managing roles and grants, not for routine operation of replication objects. Assigning SECURITYADMIN would provide powerful security administration capabilities unrelated to refreshing a replicated database. This option reflects the misconception that anything security-related should use SECURITYADMIN, even when object-scoped privileges are sufficient.

SnowPro Advanced: Security Engineer Question 203

Single answerImplement the principle of least privilege for replication-specific roles

A global company uses Snowflake replication to maintain a read-only disaster recovery account in another region. The security team has asked the Snowflake administrator to redesign access so that replication can be configured and monitored using the principle of least privilege. The current process uses ACCOUNTADMIN for creating replication groups, adding databases to those groups, and performing failover-related setup. The administrator wants to replace this with a dedicated custom role that can manage only replication-related tasks and nothing broader. Which approach best meets this requirement?

A
Create a custom role, grant it the global privileges required for replication and failover group management, and grant ownership or other required object-level privileges only on the specific databases/accounts objects that must be added to the replication or failover configuration.
B
Create a custom role with MONITOR USAGE and imported privileges on the SNOWFLAKE database, because replication setup and failover actions can be completed with monitoring privileges alone.
C
Use SECURITYADMIN instead of ACCOUNTADMIN, because SECURITYADMIN is the least-privileged system role that can create replication groups and add any database to them.
D
Create a custom role that has MANAGE GRANTS and OWNERSHIP on all databases in the account, because broad ownership is required before any replication group or failover group can be created.

Show answer and explanation

Correct answer: A

Explanation

The best answer is to create a dedicated custom role for replication administration and grant it only the specific global and object-level privileges required for the replication or failover tasks it must perform. In Snowflake, least privilege means avoiding powerful system roles such as ACCOUNTADMIN for routine operational work and avoiding broad grants like OWNERSHIP on all databases. Instead, administrators should separate global administrative capabilities from object scope and grant access only to the databases or other securables actually involved in replication. This aligns with Snowflake security best practices around role design, minimizing privilege scope, and using custom roles for specialized operational duties such as replication and failover management.

A. Correct.
Correct. This is the least-privilege design Snowflake recommends in practice: use a dedicated custom role for replication administration, grant only the necessary global privileges for creating and managing replication/failover constructs, and separately grant the minimum object-level privileges needed on only those databases or objects that will participate. This avoids using ACCOUNTADMIN for routine replication administration and limits the blast radius if the role is misused.
B. Incorrect.
Incorrect. Monitoring-related privileges do not allow a role to create or manage replication groups or failover groups. Imported privileges on the SNOWFLAKE database may help with visibility into account usage views, but they do not replace the administrative privileges needed to configure replication or failover. This option confuses observability with administrative control.
C. Incorrect.
Incorrect. SECURITYADMIN is focused on role and grant management, not as a special-purpose replication administration role. It is not the designated least-privileged role for creating replication groups or managing replicated objects across the account. A custom role with the specific required privileges is the better least-privilege pattern.
D. Incorrect.
Incorrect. MANAGE GRANTS and OWNERSHIP on all databases is far broader than necessary and violates least-privilege principles. A replication administrator should receive access only to the specific databases or objects that must be replicated, not blanket ownership across the account. This option reflects a common but overly permissive shortcut.

SnowPro Advanced: Security Engineer Question 204

Single answerManage and audit privileges such as CREATE REPLICATION GROUP and REPLICATE

A global enterprise is setting up cross-region disaster recovery for several databases and wants to enforce least privilege. The SECURITYADMIN role has been asked to let a platform engineer create and manage replication groups without granting broad account-level control. During an audit, the security team also needs to verify which roles can create replication groups and which roles have been granted the ability to replicate specific objects. Which approach best satisfies both the operational and audit requirements?

A
Grant the platform engineer's role the CREATE REPLICATION GROUP privilege at the account level, grant REPLICATE on the required databases to that role, and use SHOW GRANTS TO ROLE plus SHOW GRANTS ON
B
Grant the platform engineer's role OWNERSHIP on the account so it can create replication groups, and use SHOW ROLES to determine which roles can replicate objects.
C
Grant the platform engineer's role the global MONITOR privilege and USAGE on the databases, because MONITOR allows creation of replication groups and SHOW DATABASES reveals replicate permissions.
D
Grant the platform engineer's role CREATE FAILOVER GROUP on the account and OPERATE on the databases, then use ACCOUNT_USAGE.QUERY_HISTORY to identify who can create replication groups and replicate objects.

Show answer and explanation

Correct answer: A

Explanation

The best answer is to grant only the specific privileges required: CREATE REPLICATION GROUP at the account level and REPLICATE on the objects that must be replicated. This follows Snowflake's least-privilege model and avoids unnecessary elevation such as granting OWNERSHIP on the account. For auditing, Snowflake privilege inspection commands such as SHOW GRANTS TO ROLE and SHOW GRANTS ON

A. Correct.
Correct. CREATE REPLICATION GROUP is an account-level privilege that can be granted to a role to allow creation of replication groups without transferring broad administrative ownership of the account. To include objects in replication, the role also needs the REPLICATE privilege on the relevant objects, such as databases. For auditing, SHOW GRANTS TO ROLE helps identify privileges granted to a specific role, and SHOW GRANTS ON
B. Incorrect.
Incorrect. OWNERSHIP on the account is far broader than necessary and violates least-privilege principles. Snowflake supports granting the specific CREATE REPLICATION GROUP privilege rather than elevating a role to effective full control. In addition, SHOW ROLES lists roles but does not provide a complete privilege mapping showing which roles have REPLICATE on specific objects.
C. Incorrect.
Incorrect. MONITOR does not permit creating replication groups. It is intended for visibility into resources and operations, not object creation. USAGE on databases also does not confer REPLICATE. SHOW DATABASES returns database metadata but is not the correct mechanism for auditing granted privileges such as REPLICATE or CREATE REPLICATION GROUP.
D. Incorrect.
Incorrect. CREATE FAILOVER GROUP and CREATE REPLICATION GROUP are distinct privileges tied to different object types. Granting CREATE FAILOVER GROUP does not allow creation of replication groups. OPERATE on databases is also not the privilege used for replication eligibility. QUERY_HISTORY can show executed SQL statements, but it does not directly provide an authoritative inventory of which roles currently hold CREATE REPLICATION GROUP or REPLICATE privileges.

SnowPro Advanced: Security Engineer Question 205

Single answerManage and audit privileges such as CREATE REPLICATION GROUP and REPLICATE

A global company uses Snowflake Business Critical Edition and has accounts in AWS us-east-1 (primary) and AWS eu-west-1 (secondary). The security team wants to let a platform engineer create and manage replication groups for disaster recovery, but they must follow least privilege and be able to verify the granted access during audits. The engineer has been assigned a custom role named DR_ADMIN. Which action should the security administrator take to meet this requirement?

A
Grant the REPLICATE privilege on each database and failover group to DR_ADMIN, because REPLICATE alone allows creating and managing replication groups and is sufficient for auditability.
B
Grant the CREATE REPLICATION GROUP privilege at the account level to DR_ADMIN, and use SHOW GRANTS TO ROLE DR_ADMIN to audit that the privilege was granted.
C
Grant OWNERSHIP on the account to DR_ADMIN so the engineer can create replication groups and review grants with ACCOUNT_USAGE.GRANTS_TO_ROLES.
D
Grant CREATE DATABASE on the account and MODIFY on each database to DR_ADMIN, then use SHOW ROLES to verify whether replication privileges are effective.

Show answer and explanation

Correct answer: B

Explanation

To allow a role to create replication groups in Snowflake, the required privilege is CREATE REPLICATION GROUP at the account level. This is the precise privilege for the task and is preferred over broad administrative grants such as OWNERSHIP on the account. In audit scenarios, security administrators commonly validate role grants using SHOW GRANTS TO ROLE <role_name>; account usage views may also be used for reporting, but the key point is that the privilege must actually be granted to the role. A common misconception is that REPLICATE alone allows creation of replication groups; in practice, Snowflake separates creation/administration privileges from replication-related privileges on supported objects. This question tests both least-privilege delegation and practical privilege auditing, which are central responsibilities for a SnowPro Advanced Security Engineer.

A. Incorrect.
Incorrect. REPLICATE is not the privilege used to create replication groups. REPLICATE is associated with enabling replication or failover-related operations on supported objects, but creating a replication group requires the specific CREATE REPLICATION GROUP account-level privilege. This option also incorrectly claims REPLICATE alone is sufficient for the full requirement.
B. Correct.
Correct. CREATE REPLICATION GROUP is the account-level privilege required to create replication groups. Granting this privilege to the custom DR_ADMIN role aligns with least privilege better than broad administrative ownership. For auditing, SHOW GRANTS TO ROLE DR_ADMIN is an appropriate way to verify that the role has been granted the privilege. This directly addresses both delegated administration and audit verification.
C. Incorrect.
Incorrect. Granting OWNERSHIP on the account is far too broad and violates least-privilege principles. It would give the role extensive control well beyond replication administration. While grant metadata can be reviewed through account usage views, this is not the right access model for the stated requirement.
D. Incorrect.
Incorrect. CREATE DATABASE and MODIFY do not authorize creation of replication groups. Replication group creation is controlled by the distinct CREATE REPLICATION GROUP account-level privilege. SHOW ROLES also does not verify object and account privileges in the way SHOW GRANTS TO ROLE does.

Timed practice exam

Take a SnowPro Advanced: Security Engineer practice test under exam conditions

65 questions in 115 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

SnowPro Advanced: Security Engineer practice questions 201 to 300 of 431

Every question has a page with the answer and explanation. Numbers are stable, so you can bookmark or share them. The bank is split into 5 pages of up to 100 questions.