SnowPro Advanced: Security Engineer Question 317
Single answerOver-privileged roles and usersA Snowflake security engineer is reviewing access after an internal audit finds that several analysts can create warehouses, grant privileges to other users, and read sensitive HR tables, even though their job only requires running queries in curated reporting schemas. The environment uses a mix of account roles, including SYSADMIN, SECURITYADMIN, and several custom roles that have been granted to users over time. Management asks for a remediation approach that reduces over-privileged access quickly without breaking normal reporting activity and that aligns with Snowflake security best practices.
Which action should the security engineer take FIRST?
- A
Grant the analysts the PUBLIC role only, because PUBLIC is inherited by every user and will simplify access management.
- B
Replace direct user grants and broad administrative role assignments with least-privilege custom roles for reporting, then grant those roles to the analysts.
- C
Transfer all object ownership from existing roles to ACCOUNTADMIN so a single role controls access consistently across the account.
- D
Revoke all current role grants from the analysts immediately, and require them to request elevated access each time they need to query reporting data.
Show answer and explanation
Correct answer: B
Explanation
The best first action is to redesign access around least-privilege custom roles and replace direct grants or broad system role assignments for end users. In Snowflake, access control is built around roles, and best practice is to grant privileges to roles rather than directly to users, then assign those roles based on job responsibilities. Analysts who only need to run queries against curated reporting data should typically receive narrowly scoped roles with required USAGE and SELECT privileges, not powerful administrative roles such as SYSADMIN or SECURITYADMIN.
This approach aligns with Snowflake RBAC guidance and the principle of least privilege. It also helps reduce privilege creep, simplifies audits, and supports separation of duties. Using PUBLIC as a catch-all access mechanism is discouraged for sensitive or job-specific privileges because any grants to PUBLIC are broadly inherited. Likewise, concentrating ownership or control in ACCOUNTADMIN increases risk and is inconsistent with security best practices. A measured transition to custom reporting roles addresses the audit finding while minimizing operational disruption.
- A. Incorrect.
Incorrect. PUBLIC is granted to all roles and users by default, but it is not intended to be the primary mechanism for managing business access. Relying on PUBLIC for analyst permissions increases the risk of broad unintended access because privileges granted to PUBLIC are effectively widely available. This does not address the core issue of over-privileged users and can make least-privilege enforcement harder.
- B. Correct.
Correct. Snowflake best practice is to use role-based access control with custom roles aligned to job functions, granting only the minimum required privileges. In this scenario, analysts need query access to curated reporting schemas, not administrative capabilities such as creating warehouses or granting privileges. Replacing direct grants and overly broad role assignments with least-privilege reporting roles is the most appropriate first remediation step because it reduces risk while preserving normal business activity.
- C. Incorrect.
Incorrect. Centralizing ownership in ACCOUNTADMIN is not a least-privilege approach and introduces significant security risk. ACCOUNTADMIN is a powerful administrative role and should be tightly restricted. Assigning broad ownership to ACCOUNTADMIN does not solve the problem of analyst over-privilege and can make governance and separation of duties worse.
- D. Incorrect.
Incorrect. Although removing excessive privileges is necessary, revoking all access immediately is not the best first step because it is likely to disrupt valid reporting work. The scenario explicitly requires reducing risk quickly without breaking normal reporting activity. A better initial action is to define and assign fit-for-purpose roles that preserve required read access while removing administrative privileges.