SnowPro Advanced: Security Engineer Question 216
Single answerValidate the replication of users, roles, and grantsA global company uses Snowflake account replication for disaster recovery between a primary account in AWS us-east-1 and a secondary account in AWS us-west-2. The security team recently enabled replication of users, roles, and grants so that failover can occur without rebuilding access controls. During a DR test, the team wants to validate that security objects were replicated successfully to the secondary account before promoting it. Which action provides the most reliable validation?
- A
In the secondary account, query SNOWFLAKE.ACCOUNT_USAGE.USERS, ROLES, and GRANTS_TO_USERS / GRANTS_TO_ROLES after the latest replication refresh and compare the results to the primary account.
- B
In the secondary account, run SHOW REPLICATION DATABASES and confirm that the replication group name appears in the output.
- C
In the secondary account, query INFORMATION_SCHEMA.APPLICABLE_ROLES for a sample user; if the expected roles appear, all users, roles, and grants have been replicated.
- D
In the primary account, run SHOW GRANTS TO ROLE for each replicated role; if the grants exist in the primary account, replication to the secondary account is confirmed.
Show answer and explanation
Correct answer: A
Explanation
When validating replication of users, roles, and grants, the key principle is to verify the replicated state in the secondary account, not just the source configuration or the existence of replication setup. Snowflake supports replication of account objects through replication/failover groups, and after a refresh, administrators should inspect the target account's metadata to confirm that expected users, roles, and grant relationships are present. ACCOUNT_USAGE views are commonly used for this type of validation because they provide broad visibility into account-level security metadata. By contrast, checking replication configuration alone or validating only a subset of role visibility can lead to false confidence. Best practice during DR testing is to compare source and target security metadata after the most recent refresh before failover.
- A. Correct.
Correct. To validate replication of security objects, the team should inspect the replicated metadata in the secondary account itself. Comparing users, roles, and grants in views such as SNOWFLAKE.ACCOUNT_USAGE.USERS, ROLES, GRANTS_TO_USERS, and GRANTS_TO_ROLES after the most recent replication refresh provides direct evidence that the objects and their privilege relationships exist in the target account. This is the most reliable validation because it checks the actual replicated state rather than replication configuration or a partial sample.
- B. Incorrect.
Incorrect. SHOW REPLICATION DATABASES is focused on database replication metadata and does not validate that account-level security objects such as users, roles, and grants were actually replicated. A replication group existing or being visible does not prove that the expected principals and privilege mappings are present in the secondary account.
- C. Incorrect.
Incorrect. INFORMATION_SCHEMA.APPLICABLE_ROLES can help validate role availability for a particular session or user context, but checking one sample user is not sufficient to confirm that all intended users, roles, and grants were replicated. It is a partial test and can miss missing role hierarchies, direct grants, or users not included in the sample.
- D. Incorrect.
Incorrect. Verifying grants in the primary account only confirms source configuration. It does not validate that replication has completed successfully or that the secondary account contains the same security objects after the latest refresh. The validation must occur in the target account.