A Snowflake administrator needs to audit all grants and revocations performed on a specific table named 'EMPLOYEES' within the DATABASE. They want to capture the timestamp, grantor, grantee, and the p

Question

Options

• A(PRIVILEGE, GRANTEE, GRANTOR), and TABLE_PRIVILEGES (TABLE_NAME, PRIVILEGE)
• BOBJECT GRANTS (PRIVILEGE, GRANTEE NAME, GRANTOR NAME, GRANTED ON, NAME)
• C(PRIVILEGE, GRANTEE, GRANTOR), and USAGE_PRIVILEGES (OBJECT_NAME, PRIVILEGE)
• DACCOUNT_USAGE.GRANTS HISTORY (PRIVILEGE, GRANTEE_NAME, GRANTOR NAME,
• EQUERY HISTORY and filter for GRANT and REVOKE commands

• A
  2% (1)
• B
  4% (2)
• C
  11% (5)
• D
  65% (30)
• E
  17% (8)

Explanation

ACCOUNT_USAGE.GRANTS_TO_ROLES (and GRANTS_TO_USERS) with the GRANTED_ON, PRIVILEGE, GRANTEE_NAME, and GRANTOR columns is the correct choice because it is specifically designed as a historical audit view - it retains records of past grants and revocations with timestamps, unlike INFORMATION_SCHEMA views which only reflect the current state of privileges.

Why the distractors fail:

• A & C reference INFORMATION_SCHEMA views (TABLE_PRIVILEGES, USAGE_PRIVILEGES) which show current grants only - they have no history of revocations or timestamp data, making them useless for auditing past actions.
• B (OBJECT_GRANTS) is not a standard Snowflake view; it's a fabricated option designed to mislead with plausible-sounding column names.
• E (QUERY_HISTORY) captures the raw SQL text of GRANT/REVOKE commands, but requires parsing unstructured query text and may not surface all metadata cleanly - it's a workaround, not the purpose-built audit tool.

Memory tip: Think "ACCOUNT_USAGE = history, INFORMATION_SCHEMA = now." Any audit question asking about past grants, revocations, or timestamps should point you to ACCOUNT_USAGE views, which have a 365-day retention window versus INFORMATION_SCHEMA's real-time-only snapshot.

No community discussion yet for this question.