Snowflake Certification Practice Test

What action should be taken to prevent the misusage of the ACCOUNTADMIN role?

1. Limit ACCOUNTADMIN to one non-developer

2. Revoke object creation authority entirely

3. Do not set ACCOUNTADMIN as the default role

4. Give training on proper role usage

The correct answer is: Do not set ACCOUNTADMIN as the default role

Setting the ACCOUNTADMIN role as the default role can lead to significant security risks. The ACCOUNTADMIN role has extensive privileges, including the ability to manage all aspects of the Snowflake account, such as creating and dropping roles, managing users, and accessing all data. By not making ACCOUNTADMIN the default role, you reduce the likelihood of accidental misuse by users who may inadvertently perform operations that could negatively impact the system or data integrity. When users operate with a lower-privileged role by default, they must consciously switch to the ACCOUNTADMIN role when necessary, encouraging more thoughtful actions and reducing the risk of operators executing unintended commands. This practice promotes better governance and control over sensitive operations, ensuring that users only invoke high-level privileges when absolutely necessary. The other actions, while they may contribute to security, do not directly address the critical nature of minimizing exposure to the ACCOUNTADMIN role through its default assignment. Limiting the role to a non-developer, revoking object creation authority, or providing training may help, but they do not mitigate the fundamental risk that comes from users being able to inadvertently perform high-risk operations without appropriate precautions in place.