SnowPro Advanced: Administrator free question 10 / 10 · Domain 6: Disaster Recovery, Backup, and Data Replication
In the source account, the FAILOVER privilege on failover group FG1 was granted to role DR_OPS. DR_OPS is replicated to the target through ROLES in FG1's OBJECT_TYPES. In a disaster, you want to promote FG1 in the target using DR_OPS. What needs to be in place beforehand, according to the documentation?
- Transfer OWNERSHIP of FG1 to DR_OPS in the source, so that the next refresh enables promotion in the target
- FAILOVER cannot be granted in the target, so promotion has to be run by ACCOUNTADMIN there
- No step is needed; the FAILOVER privilege on FG1 is replicated to the target together with DR_OPS
- Privileges on groups are not replicated, so grant FAILOVER on FG1 to DR_OPS in the target as well
Show the answer and explanation
Answer: D
Why this is correct
Even when roles are replicated, privileges on replication groups and failover groups are not replicated. The documentation says that if the REPLICATE or FAILOVER privilege has been granted on replication or failover groups, these privileges need to be granted in both the source and target accounts. For DR_OPS to promote FG1 in the target, FAILOVER on FG1 must also be granted to DR_OPS in the target account.
Why the other options are wrong
"No step is needed; the FAILOVER privilege on FG1 is replicated to the target together with DR_OPS" … The documentation says privileges on replication groups and failover groups are not replicated. A REPLICATE or FAILOVER grant has to be made in both the source and the target.
"FAILOVER cannot be granted in the target, so promotion has to be run by ACCOUNTADMIN there" … The documentation tells you to grant REPLICATE or FAILOVER on groups in the target account as well, so the privilege can be granted there, and promotion is not tied to ACCOUNTADMIN.
"Transfer OWNERSHIP of FG1 to DR_OPS in the source, so that the next refresh enables promotion in the target" … Privileges on groups are not replicated, so nothing granted on FG1 in the source reaches the target. Privileges used in the target are granted in the target.
Where it goes wrong
A team may rehearse promotion with DR_OPS in the source and then forget the grant in the target, so the promotion statement fails there during a real outage. Rehearse in the target account that will actually be promoted, with the role that will be used.