System-defined roles (ACCOUNTADMIN, SYSADMIN, etc.) in Snowflake - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Role Privilege Scope Understanding

Which system-defined role in Snowflake has the highest level of privileges, including the ability to manage all other roles and account-level settings?

A SECURITYADMIN

B ACCOUNTADMIN

C SYSADMIN

D PUBLIC

💡 Hint

Think about the role that controls the entire account and can assign other roles.

The ACCOUNTADMIN role has the highest privileges in Snowflake. It can manage all other roles, users, and account-level settings. Other roles have more limited scopes.

❓ service_behavior

intermediate

Role Behavior on Object Ownership

If a user with the SYSADMIN role creates a new database, who becomes the owner of that database by default?

A The ACCOUNTADMIN role

B The PUBLIC role

C The SYSADMIN role

D The SECURITYADMIN role

💡 Hint

Ownership is assigned to the role that performs the creation.

When a user with the SYSADMIN role creates a database, the SYSADMIN role becomes the owner of that database by default.

❓ security

advanced

Role Hierarchy and Privilege Delegation

Which system-defined role is primarily responsible for managing role grants and user access control in Snowflake?

A PUBLIC

B ACCOUNTADMIN

C SYSADMIN

D SECURITYADMIN

💡 Hint

This role handles security-related tasks like granting roles and privileges.

The SECURITYADMIN role manages role grants and user access control, including creating users and assigning roles.

✅ Best Practice

advanced

Least Privilege Principle Application

To follow the least privilege principle, which role should be assigned to a user who only needs to create and manage warehouses but not manage users or roles?

A SYSADMIN

B SECURITYADMIN

C ACCOUNTADMIN

D PUBLIC

💡 Hint

Consider the role that manages compute resources but not security.

The SYSADMIN role is appropriate for managing warehouses and other objects without access to user or role management, aligning with least privilege.

❓ Architecture

expert

Role Usage in Multi-Account Architecture

In a Snowflake multi-account setup, which role should be used to centrally manage security policies and user access across all accounts?

A SECURITYADMIN role in each account coordinated centrally

B A custom role with SYSADMIN privileges

C ACCOUNTADMIN in each account separately

D PUBLIC role with elevated privileges

💡 Hint

Think about a role designed for security management that can be used consistently across accounts.

The SECURITYADMIN role is designed to manage security policies and user access. In multi-account setups, using SECURITYADMIN in each account coordinated centrally is best practice.