Snowpro Advanced Architect · Free Practice Question Medium
Question 15
- A Privileges flow upwards through the role hierarchy; a role inheriting another role gains its privileges.
- B A role granted to another role (e.g., DATA_ANALYST_ROLE granted to REPORTING_ROLE) inherits all privileges of the granted role.
- C Custom roles should be granted to system roles (e.g., DATA_ENGINEER_ROLE granted to ACCOUNTADMIN) to centralize management.
- D System roles like SYSADMIN automatically inherit all privileges of SECURITYADMIN and USERADMIN.
- E Users typically activate a secondary role to temporarily gain elevated privileges for specific tasks.
Reveal correct answers
Correct answers: A, B
Explanation
A role granted to another role (e.g., DATA_ANALYST_ROLE granted to REPORTING_ROLE) inherits all privileges of the granted role.
In Snowflake, roles can be assigned to other roles, creating a hierarchical structure where privileges flow upward through the hierarchy. This ensures that roles higher in the hierarchy inherit the privileges of roles granted to them.
Privileges flow upwards through the role hierarchy; a role inheriting another role gains its privileges.
Snowflake follows a role-based access control (RBAC) model where privileges granted to a role are inherited by any roles that are assigned to it. This allows for structured access control while maintaining least privilege principles.
The other options contain incorrect assumptions:
SYSADMIN does not automatically inherit all privileges of SECURITYADMIN and USERADMIN—each system role has specific responsibilities.
Custom roles should not be granted to system roles like ACCOUNTADMIN, as this would violate the principle of least privilege.
Users activating secondary roles is possible, but it is not a core mechanism for privilege inheritance.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
