Snowflake Certification Practice Test

Can the ACCOUNTADMIN role modify or drop objects created by a custom role?

1. Yes, always

2. No, it can only view them

3. Only if the custom role is directly granted

4. Only if the custom role is a child of the ACCOUNTADMIN

The correct answer is: Only if the custom role is directly granted

The ACCOUNTADMIN role has extensive privileges, including the ability to manage all aspects of a Snowflake account; however, the ability to modify or drop objects created by a custom role is contingent on specific conditions related to the permissions associated with that custom role. In this case, the correct understanding is that the ACCOUNTADMIN can modify or drop objects only if the custom role was granted directly to the ACCOUNTADMIN role. This emphasizes the principle of role hierarchy and privileges in Snowflake, where explicit grants are necessary to exercise control over objects created by different roles. If the ACCOUNTADMIN role does not have direct access through grants, it cannot modify or drop those objects, even though it has high-level administrative capabilities. While the other options suggest varying interpretations of the ACCOUNTADMIN's privileges, they overlook the nuances of role-based access control in Snowflake, where permissions on the objects depend on the grants made to roles rather than being absolute, irrespective of direct grants.