SnowPro Advanced: Security Engineer Question 16
Single answerUnderstand best practices for role design (functional vs. access roles):A company is redesigning Snowflake access to support rapid onboarding for new teams while reducing privilege sprawl. The Security Engineer wants to follow role design best practices by separating business job functions from technical object access. The company has these requirements: analysts in Finance need read access to specific Finance schemas, Finance ETL engineers need write access to those schemas, and user administration must be handled separately by the identity team. The company also wants to avoid granting object privileges directly to end-user roles whenever possible.
Which approach best aligns with Snowflake best practices for functional roles versus access roles?
- A
Create functional roles such as FINANCE_ANALYST and FINANCE_ETL, create access roles such as FINANCE_READ and FINANCE_WRITE that hold object privileges, grant the access roles to the functional roles, and grant a separate user administration role only to the identity team.
- B
Create only functional roles such as FINANCE_ANALYST and FINANCE_ETL, grant all required schema and table privileges directly to those roles, and also grant user administration privileges to FINANCE_ETL because engineers occasionally help with onboarding.
- C
Create access roles such as FINANCE_READ and FINANCE_WRITE for object privileges, assign those access roles directly to users, and avoid functional roles because they add unnecessary hierarchy.
- D
Create one broad FINANCE role that includes read, write, and user administration privileges so Finance managers can handle all operational needs without role switching.
Show answer and explanation
Correct answer: A
Explanation
Snowflake role design best practice is to separate business-oriented functional roles from technical access roles. Functional roles represent what a person does, such as analyst or ETL engineer. Access roles hold grants on securable objects, such as USAGE on databases and schemas or SELECT/INSERT/UPDATE on tables and views. By granting access roles to functional roles, organizations improve reuse, simplify onboarding, and reduce privilege sprawl. This also supports cleaner auditing because object access is managed independently from job-title mapping.
In this scenario, FINANCE_ANALYST and FINANCE_ETL should be functional roles, while FINANCE_READ and FINANCE_WRITE should be access roles containing the actual object privileges. Administrative capabilities such as user management should remain in separate administrative roles, consistent with least privilege and separation of duties. This design aligns with Snowflake guidance around hierarchical RBAC, role reuse, and avoiding unnecessary direct grants to user-facing roles.
- A. Correct.
Correct. This design follows the recommended separation of concerns: access roles encapsulate object privileges, while functional roles represent job responsibilities. Users are typically assigned functional roles, which inherit the needed access roles. Keeping user administration in a separate role for the identity team supports least privilege and reduces the risk of combining data access with administrative capabilities.
- B. Incorrect.
Incorrect. Granting object privileges directly to functional roles reduces reusability and makes privilege management harder as teams scale. It also violates the stated goal of avoiding direct object grants to end-user roles when possible. Adding user administration privileges to a Finance engineering role further mixes administrative duties with data access, which is not a best practice.
- C. Incorrect.
Incorrect. Access roles are useful for packaging object privileges, but assigning them directly to users bypasses the abstraction provided by functional roles. Functional roles are the preferred layer for mapping business responsibilities to users, while access roles remain reusable building blocks underneath.
- D. Incorrect.
Incorrect. A single broad role combining read, write, and user administration privileges creates excessive access and weakens separation of duties. This design increases risk, makes audits harder, and does not align with least privilege or with best practices for separating functional and administrative responsibilities.