You have a custom role named 'TRANSFORM ROLE that needs to load data into a table called 'ORDERS'. You want to ensure that this role can only load data into this specific table and has no other privil

Question

Options

• AGRANT INSERT, SELECT ON TABLE SALES DB.PUBLIC.ORDERS TO ROLE TRANSFORM
• BGRANT ALL PRIVILEGES ON TABLE SALES DB.PUBLIC.ORDERS TO ROLE TRANSFORM
• CGRANT INSERT ON TABLE SALES DB.PUBLIC.ORDERS TO ROLE TRANSFORM ROLE;
• DGRANT OWNERSHIP ON TABLE SALES DB.PUBLIC.ORDERS TO ROLE TRANSFORM ROLE;
• EGRANT INSERT ON TABLE SALES DB.PUBLIC.ORDERS TO ROLE TRANSFORM ROLE;

• A
  23% (9)
• B
  15% (6)
• C
  8% (3)
• D
  5% (2)
• E
  49% (19)

Explanation

Option E is correct because COPY INTO in Snowflake only requires INSERT privilege on the target table - nothing more - and option E grants exactly that to the correctly named role TRANSFORM ROLE.

Why the distractors fail:

• A adds SELECT, which is unnecessary for a write-only load operation, violating the least-privilege principle.
• B grants ALL PRIVILEGES, which is the opposite of least privileged - it gives far more access than needed.
• C looks identical at first glance, but targets a role named TRANSFORM, not TRANSFORM ROLE - the wrong role entirely.
• D grants OWNERSHIP, which confers full control over the table including the ability to drop it or reassign privileges - massively over-privileged.

Memory tip: Think "COPY INTO = INSERT only." The command copies data in - it writes, never reads - so SELECT is never required. When you see a least-privilege question for data loading in Snowflake, the answer is always the option with INSERT alone, and always verify the role name matches exactly.

No community discussion yet for this question.