SnowPro Advanced: Security Engineer Question 217
Single answerValidate the replication of users, roles, and grantsA company uses Snowflake Business Critical Edition with account replication between a primary account in AWS us-east-1 and a secondary account in AWS us-west-2 for disaster recovery. The security team recently enabled replication for users, roles, and grants. After the next refresh, they need to validate that security principals and their access relationships were replicated correctly to the secondary account before a DR test. Which action provides the most reliable validation?
- A
In the secondary account, use SHOW USERS, SHOW ROLES, and SHOW GRANTS TO ROLE for the replicated roles, and compare the results with the primary account after the latest refresh.
- B
In the secondary account, run DESCRIBE REPLICATION GROUP to confirm the group status is ACTIVE; if ACTIVE, users, roles, and grants are guaranteed to match the primary account.
- C
In the secondary account, query ACCOUNT_USAGE views for users and grants immediately after refresh because these views update synchronously and provide the fastest confirmation.
- D
In the primary account, run SHOW GRANTS OF SHARE and compare the output to the secondary account because share privileges validate replication of all users, roles, and grants.
Show answer and explanation
Correct answer: A
Explanation
To validate replication of users, roles, and grants, the best practice is to verify the replicated objects directly in the target account using SHOW commands and compare them with the source after the most recent replication refresh. In Snowflake, operational status of replication objects helps confirm that replication is functioning, but it does not replace object-level validation. Likewise, ACCOUNT_USAGE is valuable for audit and historical analysis, but its known latency makes it less suitable for immediate post-refresh validation. For disaster recovery readiness, security teams should validate the presence of users and roles, then confirm grant relationships such as role grants and privileges assigned to roles. This aligns with Snowflake guidance around account replication and metadata validation for failover preparedness.
- A. Correct.
Correct. The most reliable way to validate replication of users, roles, and grants is to inspect the replicated security objects directly in the secondary account and compare them to the primary after the latest refresh. SHOW USERS and SHOW ROLES verify that principals exist in the target account, while SHOW GRANTS TO ROLE helps confirm role-based privilege relationships were replicated. This directly tests the outcome the team cares about: whether the security model present in the primary is now present in the secondary.
- B. Incorrect.
Incorrect. A healthy replication group status indicates replication is configured and operating, but it does not by itself prove that specific users, roles, and grant relationships are present exactly as expected after a given refresh. Candidates may choose this because status checks are useful operationally, but they are not sufficient for detailed security validation.
- C. Incorrect.
Incorrect. ACCOUNT_USAGE is useful for reporting and auditing, but its views are not synchronous and can have latency. Because the team wants to validate the most recent refresh before a DR exercise, relying on ACCOUNT_USAGE immediately after refresh can lead to misleading results. This option reflects the common misconception that telemetry views are best for real-time validation.
- D. Incorrect.
Incorrect. Shares and their grants are a different security construct and do not validate whether account-level users, roles, and role grants replicated correctly. Someone might choose this because shares also involve privileges, but SHOW GRANTS OF SHARE is not the right validation mechanism for replicated users, roles, and grants.