Exam SnowPro Core topic 1 question 421 discussion

https://docs.snowflake.com/en/user-guide/security-access-control-overview.html#system-defined-roles

CD

Answer is CD Custom account roles can be created using the USERADMIN role (or a higher role) as well as by any role to which the CREATE ROLE privilege has been granted. https://docs.snowflake.com/en/user-guide/security-access-control-overview#label-access-control-overview-role-types Refer 'Custome Role' section in the above link

AccountAdmin & SysAdmin

Don't spam wrong answers - see the diagram and docs before voting

SysAdmin : Does not have the power to create a Custom Role. A Custom Role can be assigned with SysAdmin Privilege but, it cannot create a Role. Security Admin and UserAdmin can create, Manage Users and Roles. Its not a good practice to use the AccountAdmin to create the Roles. Though it can be created, the role should be assigned to SysAdmin. https://www.chaosgenius.io/blog/snowflake-roles-access-control/#:~:text=SECURITYADMIN%20(Security%20Administrator)%3A&text=It%20has%20the%20ability%20to%20create%2C%20monitor%2C%20and%20manage%20users,via%20the%20system%20role%20hierarchy.

https://www.bing.com/search?q=According+to+Snowflake+best+practice+recommendations%2C+which+system-defined+roles+should+be+used+to+create+custom+roles%3F&cvid=878ab2eb3e7a4c1eb414d5f94dfd4759&aqs=edge..69i57j69i11004.1528j0j9&FORM=ANAB01&PC=U531

show this picture https://docs.snowflake.com/ko/user-guide/security-access-control-overview#role-hierarchy-and-privilege-inheritance

Answer

https://docs.snowflake.com/en/user-guide/security-access-control-configure#label-security-custom-role

I would go for Accountadmin and SYSadmin as per https://docs.snowflake.com/en/user-guide/security-access-control-configure#label-security-custom-role

https://docs.snowflake.com/en/user-guide/security-access-control-overview.html#custom-roles

https://docs.snowflake.com/en/user-guide/security-access-control-overview.html#system-defined-roles

Answer -- CD