COF-C03 Account Management and Data Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create and manage warehouses.

  Why it's wrong here

  Creating and managing warehouses is the responsibility of the SYSADMIN role. The SECURITYADMIN role focuses solely on security-related tasks like managing roles and permissions. Combining these roles would violate the principle of Segregation of Duties, which is essential for auditability and risk management in governance.

• ✗

  Modify account-level billing settings.

  Why it's wrong here

  Managing billing and usage for the entire account is restricted to the ACCOUNTADMIN role. The SECURITYADMIN role does not have the permissions required to view or modify financial data or system-level configuration parameters, as those tasks are reserved for the highest level of administrative control.

• ✓

  Grant and revoke privileges to other roles.

  Why this is correct

  The SECURITYADMIN role has the ability to manage grants, create roles, and manage users. This role is central to implementing RBAC within the account. Because it controls access to data and other objects, it must be carefully audited to prevent unauthorized privilege escalation and misuse of permissions.

• ✗

  Drop databases without restriction.

  Why it's wrong here

  The SYSADMIN role is the owner of databases and has the right to manage them, including dropping them. The SECURITYADMIN role lacks the privileges to interact with databases or their contents. This separation ensures that security administrators cannot inadvertently destroy data while performing their security-related duties.