SnowPro Advanced: Security Engineer Question 17
Single answerSystem-defined rolesA security engineer is reviewing role assignments in a Snowflake account after a recent platform update. The company wants to let its security operations team manage users, roles, and security integrations without giving them unrestricted access to all account-level capabilities. The engineer is considering using Snowflake system-defined roles instead of continuing to grant broad privileges through ACCOUNTADMIN. Which role should be granted to the security operations team to best meet this requirement?
- A
ACCOUNTADMIN, because it is the standard role for all security administration tasks and is required to manage users and roles
- B
SECURITYADMIN, because it is the system-defined role intended to manage users, roles, and grants without providing the full breadth of ACCOUNTADMIN privileges
- C
USERADMIN, because it can manage all security integrations and all role grants while avoiding elevated account-level permissions
- D
SYSADMIN, because object ownership and warehouse management include all capabilities needed for security administration
Show answer and explanation
Correct answer: B
Explanation
Snowflake provides several system-defined roles with distinct administrative scopes, including ACCOUNTADMIN, SECURITYADMIN, USERADMIN, and SYSADMIN. For a team that must manage users, roles, and access-related configuration without being given full account-wide authority, SECURITYADMIN is the most appropriate system-defined role. This supports separation of duties and least privilege, both of which are key security best practices. ACCOUNTADMIN should be tightly restricted because it combines broad administrative powers. USERADMIN is narrower and commonly used for user and role creation, but SECURITYADMIN is the better fit for delegated access control and grant management. SYSADMIN is centered on object management rather than security administration. See Snowflake documentation on system-defined roles and access control best practices for role responsibilities and hierarchy.
- A. Incorrect.
Incorrect. ACCOUNTADMIN is the most powerful system-defined role in Snowflake and is intended for a limited set of highly trusted administrators. While it can perform security administration, granting it to an operational security team violates least-privilege principles because it also inherits broad administrative capabilities beyond security administration.
- B. Correct.
Correct. SECURITYADMIN is the system-defined role designed for security management tasks such as managing roles and grants. In practice, it is the appropriate role when a team needs to administer access control without receiving the broader account-wide authority of ACCOUNTADMIN. This aligns with Snowflake best practices to minimize use of ACCOUNTADMIN and delegate duties through lower-privileged system roles where possible.
- C. Incorrect.
Incorrect. USERADMIN is focused on user and role management, but it is not the best choice for a team responsible for broader security administration. A common misconception is that USERADMIN alone covers all security responsibilities. In Snowflake's role hierarchy, USERADMIN is intended more specifically for creating and managing users and roles, while SECURITYADMIN is the role associated with managing grants and overall access control administration.
- D. Incorrect.
Incorrect. SYSADMIN is primarily intended for creating and managing objects such as databases, schemas, tables, and warehouses. Although it is powerful for object administration, it is not the role designated for core security administration tasks like managing grants across the account. Choosing SYSADMIN reflects confusion between object administration and security administration.