The correct answer is C. Rotation .
Key-pair authentication uses a public/private key pair to authenticate users or applications. To improve security, keys should be replaced periodically or when there is a possibility that a key has been exposed. This process is called key rotation .
Why C is correct:
Key rotation allows an organization to replace active keys with new keys. In Snowflake, users can have public keys assigned for key-pair authentication, and rotating keys helps maintain secure authentication practices.
Why the other options are incorrect:
A). Authentication is the overall process of verifying identity, not the specific feature for replacing keys.
B). Passkeys are a different authentication mechanism and are not the feature used to replace active key-pair authentication keys.
D). Time-based one-time passcodes are associated with MFA, not key-pair replacement.
Official Snowflake documentation reference:
Snowflake documentation describes key-pair authentication and includes key rotation as a security practice for replacing public/private key pairs.
Reference: Snowflake Documentation - Key-pair authentication; Snowflake Documentation - Key rotation; SnowPro Core Study Guide - Security and Access Control.

The correct answer is A. SECURITYADMIN .
In Snowflake's default role hierarchy, the SECURITYADMIN role is responsible for managing security- related objects and grants. This role is granted the global MANAGE GRANTS privilege, which allows it to manage object grants across the account.
Why A is correct:
SECURITYADMIN is the built-in role designed to manage users, roles, and grants. By default, it has the ability to grant and revoke privileges.
Why the other options are incorrect:
B). USERADMIN is used primarily for user and role management, but it does not have the same broad default grant management authority as SECURITYADMIN.
C). SYSADMIN is typically used to create and manage account objects such as warehouses, databases, schemas, and tables, but it is not the default security grant administrator.
D). PUBLIC is automatically granted to every user and should not be used for administrative grant management.
Official Snowflake documentation reference:
Snowflake documentation describes SECURITYADMIN as the role that manages grants globally and inherits the privileges of USERADMIN. It includes the MANAGE GRANTS privilege by default.
Reference: Snowflake Documentation - System-defined roles; Snowflake Documentation - Access control overview; SnowPro Core Study Guide - Security and Access Control.

Clustering keys in Snowflake are used to reorganize large tables based on one or more columns. This feature optimizes the arrangement of data within micro-partitions to improve query performance, especially for large tables where efficient data retrieval is crucial. References: [COF-C02] SnowPro Core Certification Exam Study Guide
https://docs.snowflake.com/en/user-guide/tables-clustering-keys.html