SnowPro Advanced: Security Engineer Question 205
Single answerManage and audit privileges such as CREATE REPLICATION GROUP and REPLICATEA global company uses Snowflake Business Critical Edition and has accounts in AWS us-east-1 (primary) and AWS eu-west-1 (secondary). The security team wants to let a platform engineer create and manage replication groups for disaster recovery, but they must follow least privilege and be able to verify the granted access during audits. The engineer has been assigned a custom role named DR_ADMIN. Which action should the security administrator take to meet this requirement?
- A
Grant the REPLICATE privilege on each database and failover group to DR_ADMIN, because REPLICATE alone allows creating and managing replication groups and is sufficient for auditability.
- B
Grant the CREATE REPLICATION GROUP privilege at the account level to DR_ADMIN, and use SHOW GRANTS TO ROLE DR_ADMIN to audit that the privilege was granted.
- C
Grant OWNERSHIP on the account to DR_ADMIN so the engineer can create replication groups and review grants with ACCOUNT_USAGE.GRANTS_TO_ROLES.
- D
Grant CREATE DATABASE on the account and MODIFY on each database to DR_ADMIN, then use SHOW ROLES to verify whether replication privileges are effective.
Show answer and explanation
Correct answer: B
Explanation
To allow a role to create replication groups in Snowflake, the required privilege is CREATE REPLICATION GROUP at the account level. This is the precise privilege for the task and is preferred over broad administrative grants such as OWNERSHIP on the account. In audit scenarios, security administrators commonly validate role grants using SHOW GRANTS TO ROLE <role_name>; account usage views may also be used for reporting, but the key point is that the privilege must actually be granted to the role. A common misconception is that REPLICATE alone allows creation of replication groups; in practice, Snowflake separates creation/administration privileges from replication-related privileges on supported objects. This question tests both least-privilege delegation and practical privilege auditing, which are central responsibilities for a SnowPro Advanced Security Engineer.
- A. Incorrect.
Incorrect. REPLICATE is not the privilege used to create replication groups. REPLICATE is associated with enabling replication or failover-related operations on supported objects, but creating a replication group requires the specific CREATE REPLICATION GROUP account-level privilege. This option also incorrectly claims REPLICATE alone is sufficient for the full requirement.
- B. Correct.
Correct. CREATE REPLICATION GROUP is the account-level privilege required to create replication groups. Granting this privilege to the custom DR_ADMIN role aligns with least privilege better than broad administrative ownership. For auditing, SHOW GRANTS TO ROLE DR_ADMIN is an appropriate way to verify that the role has been granted the privilege. This directly addresses both delegated administration and audit verification.
- C. Incorrect.
Incorrect. Granting OWNERSHIP on the account is far too broad and violates least-privilege principles. It would give the role extensive control well beyond replication administration. While grant metadata can be reviewed through account usage views, this is not the right access model for the stated requirement.
- D. Incorrect.
Incorrect. CREATE DATABASE and MODIFY do not authorize creation of replication groups. Replication group creation is controlled by the distinct CREATE REPLICATION GROUP account-level privilege. SHOW ROLES also does not verify object and account privileges in the way SHOW GRANTS TO ROLE does.