SnowPro Core account management and data governance

Dynamic Data Masking can keep even ACCOUNTADMIN from viewing protected column data. And by default, an object's owner cannot unset the masking policy on it.

01 What does SnowPro Core test about roles and access?

You read a scenario with four roles and a failed query, and every answer looks close. Start with the model: privileges go to roles, and roles go to users.

Where this domain sits in the exam

The whole exam

1. 1.0Snowflake AI Data Cloud Features and Architecture31%
2. 2.0Account Management and Data Governance20%
3. 3.0Data Loading, Unloading, and Connectivity18%
4. 4.0Performance Optimization, Querying, and Transformation21%
5. 5.0Data Collaboration10%

Save the 'Where this domain sits in the exam' graphic as a PNG image PNG for LinkedIn or Pinterest

Each object is owned by one role, by default the role that created it. A role's privileges are inherited by every role above it in the hierarchy. By default, SECURITYADMIN and ACCOUNTADMIN are the only roles that hold MANAGE GRANTS.

The system roles and what each can do

1. 01ACCOUNTADMINTop-level role; encapsulates SYSADMIN and SECURITYADMIN
2. 02SECURITYADMINHolds MANAGE GRANTS by default, as ACCOUNTADMIN does
3. 03USERADMINGranted CREATE USER and CREATE ROLE
4. 04SYSADMINRecommended parent of your top custom role

Privileges flow up to every role above in the hierarchy.

02 Why does a query fail when the grant looks right?

Once the roles make sense, the classic trap is a missing container grant. A role needs USAGE or another privilege on the database and schema, not just SELECT on the table.

GRANT SELECT ON ALL TABLES covers only existing tables. When a statement fails, EXPLAIN_PRIVILEGES shows exactly which privileges are missing.

Check the database and schema grants before the table grant.

03 Who decides grants in a managed access schema?

Next, ownership has limits. In a managed access schema, object owners lose grant decisions to the schema owner or a role with MANAGE GRANTS. By default, only ACCOUNTADMIN and SECURITYADMIN hold MANAGE GRANTS.

Managed access takes grant decisions away from object owners.

04 How does masking protect a column?

Governance then moves from objects to columns. Dynamic Data Masking masks plain-text column data at query time and never changes the stored data. A column can have only one masking policy.

If a column has both a direct and a tag-based policy, the direct one wins. Before your next mock exam, trace one failed query from user to role to grant.

A directly assigned masking policy beats a tag-based one.

Summary

1. Privileges go to roles, and roles go to users.
2. Querying a table also needs a privilege on its database and schema.
3. Only ACCOUNTADMIN and SECURITYADMIN hold MANAGE GRANTS by default.
4. One masking policy per column, and a direct policy beats a tag-based one.

Sources and editorial status

Research checked Nov 1, 2026.

1. Overview of Access Control | Snowflake Documentation
2. Configuring access control | Snowflake Documentation
3. Understanding Column-level Security | Snowflake Documentation
4. Understanding Dynamic Data Masking | Snowflake Documentation
5. SHOW DATABASE ROLES | Snowflake Documentation
6. Troubleshooting access control issues | Snowflake DocumentationPartially Degraded ServiceBack ButtonFilter Button
7. Tag-based masking policies | Snowflake Documentation