SnowPro Advanced: Security Engineer Question 279
Single answerOperational-overhead implicationsA global company stores highly sensitive customer data in Snowflake and must support 12 business units across multiple regions. The security team currently manages access by granting object privileges directly to individual users and rotating ownership manually whenever teams change. Quarterly audits have revealed frequent access drift, and onboarding/offboarding creates a large administrative burden. The CISO asks for a redesign that reduces operational overhead while preserving strong access control and separation of duties. Which approach should the security engineer recommend?
- A
Continue granting privileges directly to users, but increase the frequency of manual entitlement reviews and ownership transfers.
- B
Implement a role-based access control model using functional roles granted to users and access roles granted privileges on objects, then assign ownership to managed roles rather than individual users.
- C
Assign all object ownership to the ACCOUNTADMIN role so that one central team can manage grants consistently across the entire account.
- D
Use a single custom role for each business unit that combines all data access, administration, and ownership privileges to minimize the total number of roles.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to redesign access using Snowflake RBAC in a layered, role-centric way. From an operational-overhead perspective, direct grants to users and user-based object ownership do not scale well in environments with many teams, frequent personnel changes, and strict audit requirements. A role hierarchy with clearly separated functional roles and access roles allows administrators to manage privileges at the role level and adjust user membership as people join, move, or leave. Assigning ownership to roles instead of individuals also avoids repeated object transfer work during reorganizations. This approach aligns with Snowflake best practices around least privilege, separation of duties, and scalable role design. Relevant Snowflake documentation includes guidance on access control, role hierarchies, and using roles rather than direct user grants to simplify administration and auditing.
- A. Incorrect.
This does not address the root cause of the overhead. Direct grants to users are difficult to scale, increase the chance of inconsistent entitlements, and make onboarding, offboarding, and audit remediation more labor-intensive. More frequent manual reviews may improve detection of issues, but they increase operational effort instead of reducing it.
- B. Correct.
This is correct. Snowflake best practices favor role-based access control using a layered role design, where object privileges are granted to access roles and users receive functional roles appropriate to their job responsibilities. Assigning ownership and administration to roles instead of individuals reduces churn when personnel change, simplifies user lifecycle management, and supports separation of duties. This design lowers operational overhead because administrators adjust role membership rather than repeatedly modifying direct user grants and object ownership.
- C. Incorrect.
This is incorrect because centralizing all ownership in ACCOUNTADMIN creates unnecessary concentration of privilege and weakens separation of duties. Although it may appear to reduce complexity, it increases security risk and is not aligned with least privilege guidance. ACCOUNTADMIN should be tightly controlled and used sparingly, not as the default owner of broad sets of business objects.
- D. Incorrect.
This is incorrect because combining data access, administration, and ownership into a single role per business unit may reduce the count of roles, but it increases risk and makes governance less flexible. It also undermines separation of duties and makes entitlement reviews harder because each role becomes overly broad. Operationally, monolithic roles often create more exceptions over time, not fewer.