SnowPro Advanced: Security Engineer Question 200
Single answerManage data replication access control and privileges:A security engineer is configuring cross-region database replication for a production database named FIN_DB from account ORG1.ACCOUNT_A to ORG1.ACCOUNT_B. The company requires least privilege and wants application owners in ACCOUNT_A to continue managing objects in FIN_DB, while only a tightly controlled administrative role can enable and manage replication. Which privilege assignment best meets this requirement?
- A
Grant OWNERSHIP on FIN_DB to the application owner role, because database owners can both manage objects and enable replication on the database.
- B
Grant REPLICATION privilege on FIN_DB to a dedicated admin role, and keep object-management privileges with the existing application owner role.
- C
Grant MONITOR privilege on the account to the application owner role, because monitoring access is sufficient to configure database replication.
- D
Grant IMPORTED PRIVILEGES on FIN_DB to the admin role, because imported privileges allow cross-account replication management.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to grant the REPLICATION privilege on the database to a dedicated administrative role and avoid using broader privileges such as OWNERSHIP unless truly required. In Snowflake, replication and failover administration is intentionally separated from ordinary object management so organizations can enforce separation of duties. This is a common security best practice: application teams manage schemas, tables, and grants needed for their workloads, while a limited platform or security admin role manages disaster recovery and replication configuration. Candidates should distinguish replication privileges from unrelated concepts such as MONITOR or IMPORTED PRIVILEGES. See Snowflake documentation on replication and failover privileges and access control, especially the sections covering REPLICATION privilege usage and least-privilege role design.
- A. Incorrect.
Incorrect. OWNERSHIP is the highest privilege and would allow broad control over the database, but it violates the least-privilege requirement if the application owner role only needs to manage objects. Snowflake provides a separate REPLICATION privilege for enabling and managing replication/failover groups or replicated databases, so elevating the application owner to OWNERSHIP just to manage replication is unnecessary and overly permissive.
- B. Correct.
Correct. The REPLICATION privilege is designed for controlling replication-related operations separately from general object administration. Assigning REPLICATION on FIN_DB to a dedicated admin role allows a tightly controlled team to enable and manage replication, while the existing owner or delegated roles can continue normal object lifecycle management. This aligns with least-privilege design and separation of duties.
- C. Incorrect.
Incorrect. MONITOR allows visibility into usage or status information in certain contexts, but it does not grant the ability to configure replication. A common misconception is that because replication has status and monitoring views, monitoring access is enough to administer it. In Snowflake, configuring replication requires the appropriate replication-specific privilege, not just observability privileges.
- D. Incorrect.
Incorrect. IMPORTED PRIVILEGES is used for consuming privileges from shared databases in data sharing scenarios, not for administering replication on a database. This distractor targets confusion between data sharing and replication. Cross-region/account database replication is governed by replication-related privileges, not imported privileges.