What does Snowflake recommend regarding database object ownership? (Select TWO).

Snowflake's best practices for access control recommend a hierarchical role structure to enforce the principle of least privilege and separation of duties. The SYSADMIN role is designated for creating account-level objects like databases and warehouses. For objects within databases (e.g., schemas, tables), the recommended approach is to create them using a custom role. This custom role, which owns the objects, is then granted to the SYSADMIN role. This model separates object ownership from the administrative privileges of SYSADMIN, creating a more manageable and secure environment. Using ACCOUNTADMIN for object creation is strongly discouraged as it is the most powerful role, intended only for account-level management.

A. The ACCOUNTADMIN role is overly privileged for routine object creation; its use should be limited to high-level account management tasks.
C. The SECURITYADMIN role's purpose is to manage users, roles, and grants, not to own or create database objects.
E. Managed access schemas centralize privilege management but are not exclusively for objects owned by ACCOUNTADMIN; in fact, ACCOUNTADMIN should not own such objects.

1. Snowflake Documentation: Configuring Access Control. This guide explicitly recommends the model described in option D. It states, "In this model, custom roles... are created and used to create objects in the database. These object-owning roles are then granted to the SYSADMIN role, creating a hierarchy of roles."

2. Snowflake Documentation: System-Defined Roles. This document outlines the intended purpose of each system role. It specifies that SYSADMIN "has privileges to create warehouses and databases in an account," supporting option B. It also clarifies that ACCOUNTADMIN is for top-level control and SECURITYADMIN is for user and role management, invalidating options A and C.