SnowPro Advanced: Administrator free question 4 / 10 · Domain 2: Account Management and Data Governance
The data governance role GOV_R should be able to attach row access policies to tables and views, including policies that will be created in the future. Which grant matches the documentation?
- Transfer OWNERSHIP of each row access policy to GOV_R each time one is created
- Grant USAGE on the database and CREATE ROW ACCESS POLICY on the schema to GOV_R
- Grant APPLY on future row access policies in the schema to GOV_R with a future grant
- Grant the account-level APPLY ROW ACCESS POLICY privilege to GOV_R
Show the answer and explanation
Answer: D
Why this is correct
Future grants of privileges on row access policies are not supported. As a workaround, the documentation says to grant the APPLY ROW ACCESS POLICY privilege to a custom role so that the role can apply row access policies on a table or view. Because this privilege is granted on the account, it also covers policies created later.
Why the other options are wrong
"Grant APPLY on future row access policies in the schema to GOV_R with a future grant" … The Limitations section says future grants of privileges on row access policies are not supported, so a grant on future policies cannot be made this way.
"Transfer OWNERSHIP of each row access policy to GOV_R each time one is created" … OWNERSHIP of the policy is not enough by itself. Without the account-level APPLY ROW ACCESS POLICY, attaching a policy requires OWNERSHIP of the table or view together with APPLY on the policy.
"Grant USAGE on the database and CREATE ROW ACCESS POLICY on the schema to GOV_R" … CREATE ROW ACCESS POLICY is the privilege for creating policies. Attaching one to a table or view needs the account-level APPLY privilege, or OWNERSHIP of the object plus APPLY on the policy.
Key point
A role can add a row access policy to a table if it has APPLY ROW ACCESS POLICY on the account, or OWNERSHIP of the table together with APPLY on the policy. In a centralized model, the account-level APPLY ROW ACCESS POLICY is given to one governance role.