SnowPro Advanced: Administrator free question 2 / 10 · Domain 1: Snowflake Security, RBAC, and User Administration
The audit role r_audit was granted the SNOWFLAKE database role GOVERNANCE_VIEWER. With r_audit, the ACCOUNT_USAGE QUERY_HISTORY view can be queried with SQL, and Grouped Queries appear in Snowsight Query History, but other users' queries do not appear under Individual Queries. Without granting IMPORTED PRIVILEGES, what should be added so that all user queries are visible?
- A grant of the READER_USAGE_VIEWER database role in the SNOWFLAKE database
- The MONITOR USAGE privilege on the account, then refresh Snowsight
- MONITOR on the users and MONITOR on the warehouses, for every one or for chosen ones
- USAGE on the relevant warehouses, then run a query on each of them
Show the answer and explanation
Answer: C
Why this is correct
In Snowsight Query History you can always see your own queries, and what else you see depends on the active role. The documentation says GOVERNANCE_VIEWER is sufficient for querying the ACCOUNT_USAGE views with SQL and shows Grouped Queries, but alone it does not grant the ability to see Individual Queries by other users. To view all user queries, the role must be ACCOUNTADMIN or have IMPORTED PRIVILEGES on the SNOWFLAKE database. Alternatively, two privileges can replace IMPORTED PRIVILEGES: MONITOR on all or specific users, and MONITOR on all or specific warehouses.
Why the other options are wrong
"A grant of the READER_USAGE_VIEWER database role in the SNOWFLAKE database" … READER_USAGE_VIEWER is the database role for viewing the query history of reader accounts. It does not open the Individual Queries of other users in this account.
"USAGE on the relevant warehouses, then run a query on each of them" … USAGE lets a role run queries on a warehouse. Seeing other users' queries on a warehouse requires MONITOR or OPERATE on that warehouse.
"The MONITOR USAGE privilege on the account, then refresh Snowsight" … MONITOR USAGE is a global privilege for account-level usage information. The documented replacement for IMPORTED PRIVILEGES is MONITOR on users together with MONITOR on warehouses, which are privileges on those objects.
Key point
MONITOR or OPERATE on a single warehouse is already enough to see other users' queries that used that warehouse. Choose where to cut visibility, by warehouse or by user, and grant the matching MONITOR privileges.