A new CUSTOMER table is created by a data pipeline in a Snowflake schema where MANAGED ACCESS is enabled. Which roles can grant access to the CUSTOMER table? (Choose three.)

Question

Options

• AThe role that owns the schema
• BThe role that owns the database
• CThe role that owns the CUSTOMER table
• DThe SYSADMIN role
• EThe SECURITYADMIN role
• FThe USERADMIN role with the MANAGE GRANTS privilege

• A
  82% (23)
• B
  4% (1)
• C
  4% (1)
• D
  11% (3)

Explanation

In a Snowflake managed access schema, privilege grants on objects are centralized - the schema owner (A) takes control of all grant operations within that schema, and any role holding the MANAGE GRANTS privilege (E: SECURITYADMIN by default, F: USERADMIN or any role explicitly granted it) can also grant access. This design deliberately removes grant rights from object owners.

Why the distractors are wrong:

• C (table owner) is the critical trap: managed access schemas exist specifically to strip object owners of their usual ability to grant privileges - the table owner cannot grant access to their own table.
• B (database owner) has no special grant authority inside a managed access schema; database ownership doesn't cascade into schema-level privilege control.
• D (SYSADMIN) does not hold MANAGE GRANTS by default in Snowflake, so it has no special standing in a managed access schema.

Memory tip: Think of managed access as a schema "lockdown" - the Schema owner holds the keys, and only roles with a master key (MANAGE GRANTS) can also open doors. The table owner's key simply doesn't work inside a managed access schema.

No community discussion yet for this question.