A Data Engineer wants to centralize grant management to maximize security. A user needs OWNERSHIP on a table in a new schema. However, this user should not have the ability to make grant decisions…

Question

Options

• AGrant OWNERSHIP to the user on the table.
• BRevoke grant decisions from the user on the table.
• CRevoke grant decisions from the user on the schema.
• DAdd the WITH MANAGED ACCESS parameter on the schema.

• A
  17% (5)
• B
  3% (1)
• C
  7% (2)
• D
  72% (21)

Explanation

Using WITH MANAGED ACCESS on the schema (option D) is correct because it centralizes all grant decisions to the schema owner, meaning even users who hold OWNERSHIP on objects within that schema cannot grant privileges to others - only the schema owner or privileged roles like ACCOUNTADMIN/SECURITYADMIN can manage grants.

Option A is wrong because granting OWNERSHIP alone gives the user the ability to make grant decisions on that object by default - it does the opposite of restricting them. Option B is wrong because "grant decisions" is not a discrete, revocable privilege in Snowflake; you cannot revoke it on a per-table basis. Option C fails for the same reason - there is no grantable privilege called "grant decisions" that can be revoked at the schema level.

Memory tip: Think of MANAGED ACCESS as putting the schema under a "lock box" - users can own keys (objects) inside the box, but only the box manager controls who else can use them.

No community discussion yet for this question.