COF-C03 - Account Management and Data Governance - Section 2.1

Explain role-based access control including system-defined roles, custom roles, the role hierarchy, securable objects, and privilege grants.

Explain how Snowflake controls access through roles rather than users: the system-defined roles (ORGADMIN, ACCOUNTADMIN, SECURITYADMIN, USERADMIN, SYSADMIN, PUBLIC), how custom roles are granted to other roles to build a hierarchy, and how privileges on securable objects are granted to roles. Recognise ownership and the principle of least privilege.

role-based access controlsystem-defined rolesACCOUNTADMIN SECURITYADMIN SYSADMINrole hierarchyprivileges and grants

Practice question for this objective

Free sampleAccount Management and Data Governancemedium

An administrator is documenting how privilege inheritance works in the Snowflake role hierarchy, where a senior role has been granted a more junior role beneath it. Which TWO statements correctly describe how privileges and grants behave across that hierarchy? Select TWO.

  • AA role granted to a parent role passes all of its privileges upward, so the parent can exercise everything the child role can. Correct
  • BA privilege granted directly to a child role flows downward to every role that the child role itself contains beneath it.
  • CPrivileges are granted to roles and roles are granted to users, so a user gains access only through the roles assigned to them. Correct
  • DGranting a privilege to a user directly is the normal way to give that one person access without involving any role.
Privileges attach to roles and flow upward to parent roles, and users gain access only through the roles granted to them. In the Snowflake hierarchy a parent role inherits all privileges of any role granted to it, so access aggregates upward, and because privileges bind to roles rather than users, a user must be granted a role to wield its privileges rather than receiving privileges directly.

Why A is correct: Granting a role to another role makes the parent inherit every privilege the child holds, which is the defining behaviour of the Snowflake role hierarchy.

Why B is wrong: Inheritance flows upward toward parent roles, not downward to contained roles, so this reverses the direction of privilege flow and is incorrect.

Why C is correct: Snowflake grants privileges to roles rather than directly to users, and users obtain those privileges by being granted the roles, which is a core principle of the model.

Why D is wrong: Snowflake does not support granting most object privileges straight to a user, so this contradicts the role-based model even though direct grants feel intuitive.

See more COF-C03 practice questions, answers explained.

More in this domain

Back to all Account Management and Data Governance objectives, or the COF-C03 cert hub.

Examworthy is not affiliated with or endorsed by Snowflake. Original, blueprint-aligned practice material only.