SnowPro Advanced: Security Engineer Question 204
Single answerManage and audit privileges such as CREATE REPLICATION GROUP and REPLICATEA global enterprise is setting up cross-region disaster recovery for several databases and wants to enforce least privilege. The SECURITYADMIN role has been asked to let a platform engineer create and manage replication groups without granting broad account-level control. During an audit, the security team also needs to verify which roles can create replication groups and which roles have been granted the ability to replicate specific objects. Which approach best satisfies both the operational and audit requirements?
- A
Grant the platform engineer's role the CREATE REPLICATION GROUP privilege at the account level, grant REPLICATE on the required databases to that role, and use SHOW GRANTS TO ROLE plus SHOW GRANTS ON
- B
Grant the platform engineer's role OWNERSHIP on the account so it can create replication groups, and use SHOW ROLES to determine which roles can replicate objects.
- C
Grant the platform engineer's role the global MONITOR privilege and USAGE on the databases, because MONITOR allows creation of replication groups and SHOW DATABASES reveals replicate permissions.
- D
Grant the platform engineer's role CREATE FAILOVER GROUP on the account and OPERATE on the databases, then use ACCOUNT_USAGE.QUERY_HISTORY to identify who can create replication groups and replicate objects.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to grant only the specific privileges required: CREATE REPLICATION GROUP at the account level and REPLICATE on the objects that must be replicated. This follows Snowflake's least-privilege model and avoids unnecessary elevation such as granting OWNERSHIP on the account. For auditing, Snowflake privilege inspection commands such as SHOW GRANTS TO ROLE and SHOW GRANTS ON
- A. Correct.
Correct. CREATE REPLICATION GROUP is an account-level privilege that can be granted to a role to allow creation of replication groups without transferring broad administrative ownership of the account. To include objects in replication, the role also needs the REPLICATE privilege on the relevant objects, such as databases. For auditing, SHOW GRANTS TO ROLE helps identify privileges granted to a specific role, and SHOW GRANTS ON
- B. Incorrect.
Incorrect. OWNERSHIP on the account is far broader than necessary and violates least-privilege principles. Snowflake supports granting the specific CREATE REPLICATION GROUP privilege rather than elevating a role to effective full control. In addition, SHOW ROLES lists roles but does not provide a complete privilege mapping showing which roles have REPLICATE on specific objects.
- C. Incorrect.
Incorrect. MONITOR does not permit creating replication groups. It is intended for visibility into resources and operations, not object creation. USAGE on databases also does not confer REPLICATE. SHOW DATABASES returns database metadata but is not the correct mechanism for auditing granted privileges such as REPLICATE or CREATE REPLICATION GROUP.
- D. Incorrect.
Incorrect. CREATE FAILOVER GROUP and CREATE REPLICATION GROUP are distinct privileges tied to different object types. Granting CREATE FAILOVER GROUP does not allow creation of replication groups. OPERATE on databases is also not the privilege used for replication eligibility. QUERY_HISTORY can show executed SQL statements, but it does not directly provide an authoritative inventory of which roles currently hold CREATE REPLICATION GROUP or REPLICATE privileges.