ADA-C01 Question 131
Single answerManage access to AI features and modelsA Snowflake administrator is enabling Cortex AI features for a development team that will build internal summarization and Q&A tools. The security team has two requirements: only a specific custom role should be able to use Cortex LLM functions, and developers must be restricted to an approved subset of models for cost and governance reasons. Which action should the administrator take to meet both requirements?
- A
Grant the SNOWFLAKE.CORTEX_USER database role to the custom role, and set the CORTEX_MODELS_ALLOWLIST account parameter to the approved models.
- B
Grant USAGE on the SNOWFLAKE database to the custom role, and set a network policy that lists the approved Cortex models.
- C
Grant the SNOWFLAKE.CORTEX_EMBED_USER database role to the custom role, and create a masking policy that blocks unapproved models.
- D
Grant imported privileges on the SNOWFLAKE database to the custom role, and use a resource monitor to prevent calls to unapproved models.
Show answer and explanation
Correct answer: A
Explanation
To manage access to AI features and models in Snowflake, administrators should use the Snowflake-provided database roles for Cortex access together with the account-level model allowlist controls. In this scenario, the correct pattern is to grant the appropriate Cortex database role, such as SNOWFLAKE.CORTEX_USER, to the approved custom role so only that role can invoke Cortex LLM functionality. Then the administrator should set the CORTEX_MODELS_ALLOWLIST account parameter to constrain usage to approved models. This aligns with Snowflake best practices for least-privilege access and centralized governance over model availability. Other controls such as network policies, masking policies, imported privileges, or resource monitors serve different purposes and do not directly enforce Cortex model authorization.
- A. Correct.
Correct. Access to Snowflake Cortex LLM functions is controlled through Snowflake-provided database roles such as SNOWFLAKE.CORTEX_USER. Granting that database role to the custom role enables use of the relevant Cortex capabilities. To restrict which models can be used, administrators can configure the CORTEX_MODELS_ALLOWLIST account parameter with the approved model names. This combination satisfies both the role-based access requirement and the model-governance requirement.
- B. Incorrect.
Incorrect. USAGE on the SNOWFLAKE database does not by itself authorize use of Cortex AI functions. In addition, network policies control network access characteristics such as allowed IP addresses; they do not govern which Cortex models a role may invoke.
- C. Incorrect.
Incorrect. SNOWFLAKE.CORTEX_EMBED_USER is intended for embedding-related access, not general access to Cortex LLM functions used for summarization and question answering. A masking policy controls data visibility in query results and does not restrict which Cortex models can be selected in function calls.
- D. Incorrect.
Incorrect. Imported privileges on the SNOWFLAKE database are not the mechanism used to grant Cortex function access in this scenario. Resource monitors manage credit consumption for warehouses and are not designed to allow or deny specific Cortex models. They may help control spend indirectly, but they do not meet the stated governance requirement.