SnowPro Advanced: Security Engineer Question 3
Single answer1.1 Design and implement access control strategies.A security engineer is designing access control for a Snowflake environment used by three groups: Data Engineers who build and load tables in the RAW and CURATED schemas, BI Analysts who only need to query curated reporting tables, and Security Auditors who must review grants and policies but should not be able to read business data. The company wants a least-privilege model that is easy to operate at scale as new objects are created. Which approach best meets these requirements?
- A
Grant privileges directly to each user, and use ACCOUNTADMIN to create all future objects so access can be adjusted centrally.
- B
Create functional roles for Data Engineers, BI Analysts, and Security Auditors; grant object privileges to those roles, use future grants where appropriate for new objects, and assign the roles to users.
- C
Grant imported privileges on the SNOWFLAKE database to all three groups so they can inherit the access they need without additional role design.
- D
Use a single custom role for all three groups, and rely on separate warehouses to prevent Security Auditors from seeing table data.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to design role-based access using functional roles and grant privileges to roles rather than directly to users. In Snowflake, RBAC is the core access-control model, and a scalable design typically uses roles aligned to business functions, often combined with role hierarchies where appropriate. Future grants are especially useful for schemas that will receive new tables or views regularly, because they automate privilege assignment for supported object types and reduce manual maintenance. For this scenario, Data Engineers would typically receive privileges needed to create and manage objects in RAW and CURATED, BI Analysts would receive SELECT on curated reporting objects only, and Security Auditors would receive only the metadata and administrative visibility required for audit functions, not business-data read access. This aligns with Snowflake guidance on least privilege, separation of duties, and role-based grant management.
- A. Incorrect.
This is incorrect because granting privileges directly to users does not scale well and is contrary to Snowflake best practice, which is to grant privileges to roles and then assign roles to users. Using ACCOUNTADMIN to create all objects is also not recommended for routine operations because it concentrates excessive privilege in one role and increases operational risk. In addition, centralized object creation by ACCOUNTADMIN does not solve least-privilege requirements for the different groups.
- B. Correct.
This is correct because Snowflake access control is role-based, and best practice is to create roles aligned to job functions, grant the minimum required privileges to those roles, and then grant the roles to users. Future grants help ensure that newly created tables, views, and other supported objects in the relevant schemas automatically receive the intended privileges, reducing administrative overhead. This approach also allows Security Auditors to receive metadata and governance-related access separately from data-reading privileges, which supports least privilege and separation of duties.
- C. Incorrect.
This is incorrect because imported privileges on the SNOWFLAKE database are primarily used to access account usage and other shared metadata exposed by the SNOWFLAKE database; they do not replace proper role design for business data access in customer databases and schemas. Granting imported privileges to all groups would not provide the needed RAW/CURATED object access model and would not enforce the distinct responsibilities of engineers, analysts, and auditors.
- D. Incorrect.
This is incorrect because warehouses control compute usage, not data authorization. A user with the necessary object privileges can read table data regardless of which warehouse is used to run the query. Using one role for all three groups violates least privilege and separation of duties because it combines incompatible access patterns into a single entitlement set.