SnowPro Advanced: Security Engineer Question 5
Select 2Configure and implement Role-Based Access Control (RBAC):A financial services company is redesigning access in Snowflake after an audit found that analysts were granted broad privileges directly and several users inherited access they no longer needed. The security engineer must implement a scalable RBAC model that supports least privilege, separates object ownership from day-to-day usage, and simplifies future onboarding. Which TWO actions should the engineer take?
- A
Create functional access roles such as ANALYST_RO and ANALYST_RW, grant object privileges to those roles, and then grant the roles to business-aligned roles assigned to users.
- B
Grant privileges directly to users whenever possible so access reviews can identify exactly which person has each object privilege without checking role hierarchy.
- C
Use a dedicated custom role to own schemas and tables where practical, and grant required usage and DML privileges to separate consumer roles instead of making end-user roles the owners.
- D
Grant the ACCOUNTADMIN role to team leads so they can manage access requests quickly without waiting for security administrators.
- E
Grant future privileges broadly at the database level to PUBLIC so new objects are automatically available to all authenticated users.
Show answer and explanation
Correct answers: A, C
Explanation
The best answers are 1 and 3 because they implement core Snowflake RBAC principles: grant privileges to roles rather than users, use role hierarchies to model job functions, and separate object ownership from consumption. In Snowflake, roles are the primary mechanism for access control, and scalable designs typically use lower-level access roles for object privileges and higher-level functional or business roles for user assignment. Dedicated ownership roles help prevent overprivileged user-facing roles and support stronger operational control. The rejected options conflict with documented best practices: direct grants to users reduce manageability, ACCOUNTADMIN should be tightly limited, and PUBLIC should not receive broad data access. These patterns align with Snowflake guidance on access control, role hierarchy design, least privilege, and minimizing use of powerful system roles.
- A. Correct.
Correct. This follows Snowflake RBAC best practices by assigning privileges to roles, not directly to users, and using a role hierarchy. Functional access roles encapsulate permissions such as read-only or read-write access, while higher-level business roles can aggregate those permissions for departments or job functions. This improves least privilege, simplifies onboarding/offboarding, and makes entitlement reviews more manageable.
- B. Incorrect.
Incorrect. Although direct grants may appear easier to audit at first glance, Snowflake best practice is to grant privileges to roles and assign roles to users. Direct grants to users do not scale well, increase administrative overhead, and make it harder to implement consistent least-privilege patterns across teams.
- C. Correct.
Correct. Separating ownership from usage is an important RBAC design principle in Snowflake. Object ownership is powerful because the OWNERSHIP privilege controls the object and is required for many administrative actions. Assigning ownership to a dedicated custom role reduces risk and avoids tying lifecycle management to individual end-user roles. Consumer roles should receive only the privileges they need, such as USAGE, SELECT, INSERT, UPDATE, or DELETE.
- D. Incorrect.
Incorrect. ACCOUNTADMIN is a highly privileged administrative role and should be tightly restricted. Granting it to team leads violates least privilege and separation of duties. Access management should instead be delegated through appropriately scoped custom roles and security administration processes.
- E. Incorrect.
Incorrect. PUBLIC is granted to every user and role in the account, so granting broad future privileges to PUBLIC would expose new objects too widely. This directly conflicts with the audit goal of reducing unnecessary inherited access and violates least-privilege best practices.