SnowPro Core · Domain 3 of 5

SnowPro Core Domain 3: Account Management and Data Governance

This domain covers securing and governing Snowflake. It covers role-based access control, authentication and network policies, object tagging, masking and row access policies, and continuous data protection with Time Travel, Fail-safe and cloning.

Exam format
20%
Official domains
4
Assessment estimate
~20
Suggested study time estimate
10–15 hrs

About 11 min read Reviewed October 2026

Overview

Account Management and Data Governance is 20% of the SnowPro Core exam and covers securing, governing and protecting data in Snowflake. It covers role-based access control and the system-defined roles (such as ACCOUNTADMIN, SYSADMIN, SECURITYADMIN, USERADMIN and PUBLIC), authentication methods (MFA, SSO, OAuth and key-pair), network policies, and resource monitors for cost control. It covers data governance features: object tagging, dynamic data masking and row access policies for fine-grained protection. And it covers Snowflake's continuous data protection: Time Travel (querying and restoring past data), Fail-safe (a Snowflake-managed recovery period), and zero-copy cloning (instant, storage-free copies).

The exam rewards understanding the role hierarchy and how privileges flow, the authentication and network controls, the governance features for masking and filtering data, and the data protection features, especially the Time Travel versus Fail-safe distinction and zero-copy cloning.

How it's tested

SnowPro Core questions in this domain describe an access, governance or data-protection need and ask which role, policy or feature applies. SnowPro Core questions are scenario and knowledge based, testing Snowflake platform understanding, so read the scenario and choose the Snowflake feature, command or behavior it points to.

  • Access and roles

    An access need is described, and you choose the role, privilege or authentication method.

  • Govern the data

    A fine-grained protection need is described, and you choose masking, a row access policy or tagging.

  • Protect and recover

    A recovery or copy need is described, and you choose Time Travel, Fail-safe or cloning.

Reasoning it through

A table was accidentally updated with wrong values an hour ago, and the team needs to see and restore the data as it was before the change. Fail-safe is Snowflake-managed and not directly accessible, and restoring from a backup is unnecessary. Time Travel lets you query the table AS OF a past time and restore it to that state within the retention period, which is the feature the exam expects for recovering recent accidental changes, distinct from Fail-safe.

Domains 4

Official domains from the Snowflake outline, in outline order.

3.1 Role-based access control and system-defined rolesRBAC, the role hierarchy and system roles.
What it means
This covers role-based access control in Snowflake: privileges granted to roles and roles granted to users or other roles, and the system-defined roles ACCOUNTADMIN, SECURITYADMIN, USERADMIN, SYSADMIN and PUBLIC, and how privileges flow through the role hierarchy.
What to understand
In Snowflake, privileges are granted to roles, and roles are granted to users or nested under other roles, so access flows through a hierarchy. ACCOUNTADMIN is the top role, SYSADMIN manages objects, SECURITYADMIN manages grants and roles, USERADMIN manages users and roles, and PUBLIC is granted to everyone. Understanding the hierarchy and each system role's purpose is heavily tested.
How it shows up
An access or administration need is described, and you must choose the role or privilege.
Common confusion
Confusing the system-defined roles (such as SECURITYADMIN versus SYSADMIN), or how privileges flow through the hierarchy.
3.2 Authentication, network policies, and resource monitorsAuthentication methods, network access and cost control.
What it means
This covers authentication methods (multi-factor authentication, single sign-on, OAuth and key-pair authentication), network policies that restrict access by IP range, and resource monitors that track and cap credit (compute) usage to control cost.
What to understand
Snowflake secures access with strong authentication (MFA, SSO, OAuth, key-pair) and network policies that allow or block IP ranges. Resource monitors watch credit consumption and can notify or suspend warehouses when limits are reached, controlling cost. Knowing which control fits a security or cost requirement is tested.
How it shows up
A security or cost-control need is described, and you must choose the authentication method, network policy or resource monitor.
Common confusion
Confusing a resource monitor (caps credit usage) with a network policy (restricts access by IP).
3.3 Object tagging, dynamic data masking, and row access policiesFine-grained governance and data protection.
What it means
This covers governance features: object tagging to classify and track objects, dynamic data masking to mask column values based on the querying role, and row access policies to filter which rows a role can see.
What to understand
Fine-grained governance restricts data at the column and row level: dynamic data masking obscures sensitive column values for unauthorized roles while showing them to authorized ones, row access policies filter rows by the querying role, and tags classify objects for governance and discovery. Knowing which feature masks columns versus filters rows is a frequent exam point.
How it shows up
A fine-grained protection need is described, and you must choose masking, a row access policy or tagging.
Common confusion
Confusing dynamic data masking (masks column values) with row access policies (filter which rows are visible).
3.4 Time Travel, Fail-safe, and zero-copy cloningContinuous data protection and cloning.
What it means
This covers Snowflake's continuous data protection: Time Travel, which lets you query and restore data as it was at a past point within a retention period; Fail-safe, a Snowflake-managed recovery period after Time Travel expires; and zero-copy cloning, which creates instant copies of objects without duplicating storage.
What to understand
Time Travel (up to 1 day in Standard, up to 90 days in Enterprise) lets users query historical data, restore dropped objects and recover from mistakes. Fail-safe is a non-configurable, Snowflake-managed period (typically 7 days) for disaster recovery, not directly accessible by users. Zero-copy cloning instantly clones a database, schema or table by referencing the same micro-partitions without copying data. These are distinctive, heavily tested features.
How it shows up
A recovery or copy need is described, and you must choose Time Travel, Fail-safe or cloning.
Common confusion
Confusing Time Travel (user-accessible, configurable retention) with Fail-safe (Snowflake-managed, not user-accessible), or overlooking that cloning is storage-free.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • RBAC

    Privileges to roles, roles to users.

    Remember
    Access flows through a hierarchy.
    Tested as
    Access questions.
    Trap
    Granting directly to users.

  • System-defined roles

    ACCOUNTADMIN, SYSADMIN, SECURITYADMIN, USERADMIN, PUBLIC.

    Remember
    Each has a distinct purpose.
    Tested as
    Role questions.
    Trap
    Confusing the roles.

  • ACCOUNTADMIN

    The top-level administrative role.

    Remember
    Use sparingly and secure it.
    Tested as
    Role questions.
    Trap
    Overusing it.

  • Authentication methods

    MFA, SSO, OAuth, key-pair.

    Remember
    Choose by the security need.
    Tested as
    Security questions.
    Trap
    Confusing the methods.

  • Network policies

    Restrict access by IP range.

    Remember
    Allow or block addresses.
    Tested as
    Security questions.
    Trap
    Confusing with resource monitors.

  • Resource monitors

    Track and cap credit usage.

    Remember
    Notify or suspend on limits.
    Tested as
    Cost questions.
    Trap
    Confusing with network policies.

  • Dynamic data masking

    Masks column values by role.

    Remember
    Column-level protection.
    Tested as
    Governance questions.
    Trap
    Confusing with row access policies.

  • Row access policies

    Filter which rows a role sees.

    Remember
    Row-level protection.
    Tested as
    Governance questions.
    Trap
    Confusing with masking.

  • Object tagging

    Classify and track objects.

    Remember
    For governance and discovery.
    Tested as
    Governance questions.
    Trap
    Overlooking tagging.

  • Time Travel

    Query and restore past data.

    Remember
    Up to 1 day (Standard) or 90 (Enterprise).
    Tested as
    Protection questions.
    Trap
    Confusing with Fail-safe.

  • Fail-safe

    Snowflake-managed recovery period.

    Remember
    Not user-accessible; ~7 days.
    Tested as
    Protection questions.
    Trap
    Confusing with Time Travel.

  • Zero-copy cloning

    Instant, storage-free copies.

    Remember
    References the same micro-partitions.
    Tested as
    Protection questions.
    Trap
    Thinking it duplicates storage.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Dynamic masking vs. row access policy

ConceptMeaningKey differenceCommon trap
Dynamic data masking Masks column values by role Column-level Confusing with row access
Row access policy Filters which rows are visible Row-level Confusing with masking

Time Travel vs. Fail-safe

ConceptMeaningKey differenceCommon trap
Time Travel Query and restore past data User-accessible, configurable Confusing with Fail-safe
Fail-safe Snowflake-managed recovery Not user-accessible, ~7 days Confusing with Time Travel

Network policy vs. resource monitor

ConceptMeaningKey differenceCommon trap
Network policy Restricts access by IP Security control Confusing with resource monitor
Resource monitor Caps credit usage Cost control Confusing with network policy

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Fail-safe for recent recovery

    What candidates pick
    Use Fail-safe to recover data from an accidental update an hour ago.
    Why it looks right
    Both protect data.
    Why it's wrong
    Time Travel lets users query and restore recent past data within the retention period; Fail-safe is Snowflake-managed, not directly user-accessible.

    Clue to watch for The user needs to restore recent data themselves.

  2. Masking filters rows

    What candidates pick
    Use dynamic data masking to hide certain rows from a role.
    Why it looks right
    Both restrict data.
    Why it's wrong
    Dynamic data masking obscures column values; row access policies filter which rows a role can see.

    Clue to watch for The need is to hide rows versus mask column values.

  3. Resource monitor restricts access

    What candidates pick
    Use a resource monitor to block logins from outside the office.
    Why it looks right
    Both are account controls.
    Why it's wrong
    A resource monitor caps credit usage; a network policy restricts access by IP range.

    Clue to watch for The need is to restrict access by location, not cap cost.

  4. Cloning copies storage

    What candidates pick
    Assume zero-copy cloning duplicates the data and storage.
    Why it looks right
    A clone is a copy.
    Why it's wrong
    Zero-copy cloning references the same micro-partitions, so it is instant and uses no additional storage until data changes.

    Clue to watch for The concern is the cost or time of copying a large table.

  5. ACCOUNTADMIN for everything

    What candidates pick
    Use ACCOUNTADMIN for routine object creation.
    Why it looks right
    It has all privileges.
    Why it's wrong
    SYSADMIN is intended for creating and managing objects; ACCOUNTADMIN is the top role and should be used sparingly and secured.

    Clue to watch for The task is routine object management.

Answer framework

For any Account Management and Data Governance scenario, use these steps to find the answer the exam expects.

  1. For access, grant privileges to roles and roles to users, using the right system-defined role (SYSADMIN for objects, SECURITYADMIN for grants, and so on).
  2. Secure access with strong authentication (MFA, SSO, OAuth, key-pair) and network policies, and control cost with resource monitors.
  3. For fine-grained governance, use dynamic data masking for column values, row access policies for rows, and tags to classify objects.
  4. For recovery, use Time Travel to query and restore recent past data within the retention period, knowing Fail-safe is Snowflake-managed and not user-accessible.
  5. Use zero-copy cloning for instant, storage-free copies of databases, schemas or tables. Where two options seem to fit, choose the one that most precisely matches the scenario and current Snowflake behavior.

Practice question

A table was accidentally updated with incorrect values about an hour ago. A data engineer needs to view the table as it existed before the change and restore it to that state. Which Snowflake feature should they use?

Want more like this? The SnowPro Core practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain as securing, governing and protecting data in Snowflake. Start with role-based access control, the most tested area: learn that privileges are granted to roles and roles to users, and the purpose of each system-defined role (ACCOUNTADMIN, SYSADMIN, SECURITYADMIN, USERADMIN, PUBLIC) and how privileges flow. Then learn the access and cost controls, keeping network policies (restrict by IP) distinct from resource monitors (cap credits).

Master the governance features, keeping dynamic data masking (column values) distinct from row access policies (rows), and the continuous data protection features, especially the Time Travel (user-accessible, configurable) versus Fail-safe (Snowflake-managed, not accessible) distinction, and that zero-copy cloning is instant and storage-free.

Because these are hands-on, practice RBAC, masking, Time Travel and cloning in a Snowflake trial. Because this exam rewards platform familiarity, use a Snowflake free trial to practice warehouses, loading, governance and sharing rather than only reading, and review missed practice questions by domain to find weak spots. Afterwards, move to Domain 4, Data Loading, Unloading, and Connectivity.

FAQ

How much of SnowPro Core is Domain 3?

Account Management and Data Governance is 20% of the exam, covering RBAC, security, governance and continuous data protection.

How does role-based access control work in Snowflake?

Privileges are granted to roles, and roles are granted to users or nested under other roles, so access flows through a role hierarchy. The system-defined roles include ACCOUNTADMIN, SYSADMIN, SECURITYADMIN, USERADMIN and PUBLIC, each with a distinct purpose.

What is the difference between dynamic data masking and a row access policy?

Dynamic data masking obscures the values in specific columns based on the querying role, while a row access policy filters which rows a role can see. One protects columns, the other filters rows.

What is the difference between Time Travel and Fail-safe?

Time Travel lets users query and restore data as it was in the past within a configurable retention period (up to 1 day in Standard, up to 90 in Enterprise). Fail-safe is a non-configurable, Snowflake-managed recovery period (typically 7 days) after Time Travel expires, and is not directly accessible by users.

What is zero-copy cloning?

A feature that creates an instant copy of a database, schema or table by referencing the same underlying micro-partitions rather than duplicating data, so it uses no additional storage until the clone or original is changed.

What is the difference between a network policy and a resource monitor?

A network policy restricts access to the account by allowing or blocking IP address ranges (a security control). A resource monitor tracks credit (compute) usage and can notify or suspend warehouses when limits are reached (a cost control).

How does Domain 3 connect to the rest of the exam?

Governance secures the data stored and loaded in the architecture and loading domains, controls access to the performance and querying features, and protects the data that is shared in the collaboration domain.

Test your Domain 3 knowledge

You have covered RBAC, authentication, governance and continuous data protection. Test whether you can secure and govern Snowflake under exam conditions.

Take the SnowPro Core practice test Check your SnowPro Core readiness

Keep going