According to Snowflake documentation and the community discussion consensus, only security administrators (users with SECURITYADMIN role or higher) or roles with the global ATTACH POLICY privilege can activate and enforce a network policy for all users in an account. Option B (SECURITYADMIN or higher role) directly addresses the security administrator requirement, while option C (role with ATTACH POLICY privilege) covers the privilege-based approach. Option A (USERADMIN) is incorrect as USERADMIN manages users but not security policies. Option D (role with NETWORK_POLICY parameter) is incorrect as this parameter doesn't grant activation rights. Option E (OWNERSHIP of network policy) is insufficient as ownership alone doesn't grant account-wide enforcement capabilities.