Exam SnowPro Core topic 1 question 128 discussion

100% false. SYSADMIN should immediately be granted the role, then ACCOUNTADMIN will automatically have the grant through SYSADMIN.

B Instead, we recommend creating a hierarchy of roles aligned with business functions in your organization and ultimately assigning these roles to the SYSADMIN role.

B.False

https://docs.snowflake.com/en/user-guide/security-access-control-overview#roles "When creating roles that will serve as the owners of securable objects in the system, Snowflake recommends creating a hierarchy of custom roles, with the top-most custom role assigned to the system role SYSADMIN." B is correct according to that article

We don't have to granted the role to Accountadmin Its automatically have throught the SysADMIN role

B. False

https://docs.snowflake.com/en/user-guide/security-access-control-considerations Important: By default, not even the ACCOUNTADMIN role can modify or drop objects created by a custom role. The custom role must be granted to the ACCOUNTADMIN role directly or, preferably, to another role in a hierarchy with the SYSADMIN role as the parent. The SYSADMIN role is managed by the ACCOUNTADMIN role.

keyword in the question is "immediately" and that makes the correct answer as False. Granting custom role to ACCOUNTADMIN is not the only option. It can be assigned to role hierarchy with SYSADMIN as parent also

True ans A Important By default, not even the ACCOUNTADMIN role can modify or drop objects created by a custom role. The custom role must be granted to the ACCOUNTADMIN role directly or, preferably, to another role in a hierarchy with the SYSADMIN role as the parent. The SYSADMIN role is managed by the ACCOUNTADMIN role.

Best practice is to assign it to ACCOUNTADMIN;

By default, not even the ACCOUNTADMIN role can modify or drop objects created by a custom role. The custom role must be granted to the ACCOUNTADMIN role directly or, preferably, to another role in a hierarchy with the SYSADMIN role as the parent. The SYSADMIN role is managed by the ACCOUNTADMIN role. https://docs.snowflake.com/en/user-guide/security-access-control-considerations#managing-custom-roles Even it is mentioned preferably SYSADMIN, the idea is to grant custom role to ACCOUNTADMIN.

The custom role must be granted to the ACCOUNTADMIN role directly or, preferably, to another role in a hierarchy with the SYSADMIN role as the parent.

According to the docs: Accountadmin. https://docs.snowflake.com/en/user-guide/security-access-control-considerations.html#managing-custom-roles

B is correct

FALSE, Should be assigned to SYSADMIN role

The best practice is to assign it to SYSADMIN role, B is correct

It is TRUE.