SnowPro Advanced: Administrator free question 1 / 10 · Domain 1: Snowflake Security, RBAC, and User Administration
Two accounts have the ORGADMIN role enabled: account_123 and account_456. The organization wants to stop using account_123 for organization-level tasks. Which procedure is correct?
- Sign in to account_456, use ACCOUNTADMIN, and run ALTER ACCOUNT account_123 SET IS_ORG_ADMIN = FALSE
- Sign in to account_123, use ORGADMIN, and run ALTER ACCOUNT account_123 SET IS_ORG_ADMIN = FALSE
- Ask Snowflake Support to remove ORGADMIN from account_123, since removal is reserved for Support
- Sign in to account_456, use ORGADMIN, and run ALTER ACCOUNT account_123 SET IS_ORG_ADMIN = FALSE
Show the answer and explanation
Answer: D
Why this is correct
To prevent a regular, ORGADMIN-enabled account from being used for organization-level tasks, the documented steps are: sign in to a different ORGADMIN-enabled account, assume the ORGADMIN role, and run ALTER ACCOUNT <account> SET IS_ORG_ADMIN = FALSE. Here that means signing in to account_456 and removing the role from account_123. The organization role is removed from the organization side, not from inside the account that loses it.
Why the other options are wrong
"Sign in to account_123, use ORGADMIN, and run ALTER ACCOUNT account_123 SET IS_ORG_ADMIN = FALSE" … The first documented step is to sign in to a different ORGADMIN-enabled account. Running the command from account_123 itself is not the procedure.
"Sign in to account_456, use ACCOUNTADMIN, and run ALTER ACCOUNT account_123 SET IS_ORG_ADMIN = FALSE" … Signing in to the other ORGADMIN-enabled account is right, but the documented steps then assume the ORGADMIN role before running ALTER ACCOUNT ... SET IS_ORG_ADMIN = FALSE. The step is USE ROLE ORGADMIN, so running it as ACCOUNTADMIN is not the procedure.
"Ask Snowflake Support to remove ORGADMIN from account_123, since removal is reserved for Support" … Support is needed when the account is the last ORGADMIN-enabled account in the organization. Here account_456 is still enabled, so the organization administrator can remove the role from account_123.
Key point
If the account is the last ORGADMIN-enabled account, the role cannot currently be removed by the administrator and Snowflake Support must be contacted. When moving to an organization account, create the organization account first and then disable ORGADMIN in the old accounts.