SnowPro Advanced: Security Engineer Question 202
Single answerImplement the principle of least privilege for replication-specific rolesA global retailer uses Snowflake replication to copy a production database from account PROD_US to account DR_EU for disaster recovery testing. The security team wants to enforce least privilege for the role used to manage replication. Requirements: the role must be able to refresh the replicated database in DR_EU, but it must not be able to create warehouses, manage users, or administer unrelated databases. Which approach best meets these requirements?
- A
Grant ACCOUNTADMIN to the replication operator role in DR_EU because cross-account replication tasks require full account-level administration.
- B
Create a custom role in DR_EU, grant only the privileges required to refresh the replicated database and any necessary access to the target database object, then assign that role to the replication operator user.
- C
Grant SYSADMIN to the replication operator role in DR_EU because database-level operations are owned by SYSADMIN and this is the minimum practical role for replication.
- D
Use the existing SECURITYADMIN role in DR_EU because replication is a security-sensitive activity and SECURITYADMIN is designed for controlled privileged operations.
Show answer and explanation
Correct answer: B
Explanation
For SnowPro Advanced: Security Engineer, the key principle is to separate replication duties from broad account administration. In Snowflake, least privilege means creating a dedicated custom role for the operational task and granting only the minimal privileges required on the relevant replicated objects, rather than assigning powerful built-in roles such as ACCOUNTADMIN, SYSADMIN, or SECURITYADMIN. This reduces risk, supports separation of duties, and aligns with Snowflake security best practices for role-based access control. Documentation and guidance around RBAC and replication/failover administration consistently emphasize using narrowly scoped custom roles wherever possible instead of defaulting to high-privilege system roles.
- A. Incorrect.
Incorrect. ACCOUNTADMIN is the most powerful system role and violates least-privilege principles. Replication administration does not require broad authority such as user management, warehouse creation, or full account governance. Choosing ACCOUNTADMIN is a common operational shortcut, but it creates unnecessary risk and exceeds the stated requirements.
- B. Correct.
Correct. The least-privilege approach is to create a dedicated custom role for replication operations and grant only the specific privileges needed to perform the refresh of the replicated database in the target account. This limits blast radius and prevents unrelated administrative capabilities such as user, warehouse, or other database administration. Snowflake best practice is to avoid using broad system roles when a scoped custom role can perform the required task.
- C. Incorrect.
Incorrect. SYSADMIN is still far broader than necessary. Although SYSADMIN commonly owns many objects and can manage a wide range of resources, the scenario explicitly requires restricting the role from administering unrelated databases and other account resources. Using SYSADMIN would grant excessive permissions beyond the replication-specific task.
- D. Incorrect.
Incorrect. SECURITYADMIN is intended primarily for managing roles and grants, not for routine operation of replication objects. Assigning SECURITYADMIN would provide powerful security administration capabilities unrelated to refreshing a replicated database. This option reflects the misconception that anything security-related should use SECURITYADMIN, even when object-scoped privileges are sufficient.