SnowPro Advanced: Security Engineer Question 201
Single answerManage data replication access control and privileges:A global company uses two Snowflake accounts in different regions: a primary production account and a secondary disaster recovery account. The security team wants to enable replication for a database named FINANCE_DB while following least-privilege practices. An engineer has already created an integration role named DR_ADMIN in the primary account. Which privilege assignment is required in the primary account so DR_ADMIN can configure database replication for FINANCE_DB without granting broader administrative access than necessary?
- A
Grant OWNERSHIP on FINANCE_DB to DR_ADMIN.
- B
Grant REPLICATION privilege on FINANCE_DB to DR_ADMIN.
- C
Grant MONITOR USAGE on the account to DR_ADMIN.
- D
Grant IMPORTED PRIVILEGES on FINANCE_DB to DR_ADMIN.
Show answer and explanation
Correct answer: B
Explanation
To manage database replication in Snowflake using least privilege, the relevant object-level privilege is REPLICATION on the database being replicated. Granting OWNERSHIP would work functionally in many cases but is broader than necessary and violates the scenario's security requirement. MONITOR USAGE and IMPORTED PRIVILEGES are unrelated to configuring replication. This aligns with Snowflake's access control model and replication administration guidance, where replication/failover capabilities are delegated through specific privileges rather than broad ownership wherever possible.
- A. Incorrect.
Incorrect. OWNERSHIP would allow full control over the database, including transfer of ownership and broad administrative actions. While an owner can perform many management tasks, this exceeds least-privilege requirements. For configuring replication on a specific database, Snowflake provides a dedicated REPLICATION privilege.
- B. Correct.
Correct. The REPLICATION privilege on a database is the least-privilege assignment needed to enable and manage replication for that database. This is the intended privilege for controlling database replication access without granting full database ownership.
- C. Incorrect.
Incorrect. MONITOR USAGE provides visibility into account usage metadata and monitoring information, but it does not authorize configuration of database replication. A candidate might choose this if they confuse operational visibility with administrative control.
- D. Incorrect.
Incorrect. IMPORTED PRIVILEGES applies to objects such as shared databases and is used to consume privileges from a data share. It is not the privilege used to configure replication for a database in the source account.