SnowPro Associate: Platform Question 99
Single answer● DatabasesA data engineering team is reorganizing its Snowflake environment. They want a new database for a marketing analytics project, but they also want to reduce the effort required to set up object privileges for future schemas, tables, and views created in that database. A role named MARKETING_ANALYST already exists and should automatically receive read-only access to newly created schemas and to future tables and views in the database. Which action best meets this requirement?
- A
Grant USAGE on the database to MARKETING_ANALYST, then grant SELECT on all current and future tables in the account to MARKETING_ANALYST
- B
Grant OWNERSHIP on the database to MARKETING_ANALYST so the role inherits read access to all future objects in the database
- C
Grant USAGE on the database and future USAGE on schemas in the database to MARKETING_ANALYST, then grant future SELECT on tables and views in the database to MARKETING_ANALYST
- D
Grant IMPORTED PRIVILEGES on the database to MARKETING_ANALYST, then grant future SELECT on tables and views in the database
Show answer and explanation
Correct answer: C
Explanation
The best answer is to use future grants scoped to the database. In Snowflake, access to objects in a database typically requires USAGE on the database, USAGE on the relevant schema, and object-level privileges such as SELECT on tables and views. To reduce ongoing administration for newly created objects, Snowflake supports future grants on schemas, tables, and views at the database or schema level. For this scenario, granting USAGE on the database, future USAGE on schemas in the database, and future SELECT on tables and views in the database allows MARKETING_ANALYST to automatically receive read-only access as new objects are created. This reflects standard Snowflake RBAC and future grant behavior documented in Snowflake's privilege and access control documentation.
- A. Incorrect.
Incorrect. Granting USAGE on the database is necessary, but granting SELECT on future tables at the account level is not how Snowflake manages future grants for standard database objects. Future grants are scoped to a database or schema, not to the entire account for tables and views. This option also does not address future schema access.
- B. Incorrect.
Incorrect. OWNERSHIP is the highest privilege and transfers control of the database, which is far more access than read-only. It is not a best practice to grant ownership just to simplify access management. Also, ownership does not automatically provide the intended least-privilege read-only pattern for downstream analyst access.
- C. Correct.
Correct. To allow a role to read objects created in the future, Snowflake supports future grants at the database or schema level. The role needs USAGE on the database, USAGE on future schemas in that database, and SELECT on future tables and views in that database. This approach aligns with Snowflake best practices for managing read-only access while minimizing ongoing administrative effort.
- D. Incorrect.
Incorrect. IMPORTED PRIVILEGES is used primarily for accessing objects shared from another account through a share, not for normal privilege management inside a standard Snowflake database created in the account. It does not solve the requirement for automatic read access to future schemas, tables, and views in a local database.