ADA-C01 Question 163
Single answerEnable Cortex AI features for usersA Snowflake administrator needs to enable Cortex AI capabilities for a group of analysts who use Snowsight to summarize support cases and classify customer feedback. The analysts already have access to the required databases and warehouses, but when they try to use Cortex AI functions they receive an authorization error. The administrator wants to grant only the minimum additional access required so the analysts can use Cortex AI without giving them unnecessary account-level administrative privileges. What should the administrator do?
- A
Grant the SNOWFLAKE.CORTEX_USER database role to the analysts' role.
- B
Grant the ACCOUNTADMIN role to the analysts' role so Cortex AI services can be invoked.
- C
Grant USAGE on the SNOWFLAKE database and CREATE MODEL on the target schema to the analysts' role.
- D
Grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the analysts' role.
Show answer and explanation
Correct answer: A
Explanation
The correct solution is to grant the SNOWFLAKE.CORTEX_USER database role to the role used by the analysts. Snowflake documents Cortex AISQL access through this database role, which is the appropriate least-privilege method to enable users to call supported Cortex AI functions. Since the analysts already have warehouse and object access, the missing piece is the Cortex-specific authorization. Best practice is to grant only the required database role rather than broad administrative roles such as ACCOUNTADMIN. Administrators should also ensure users continue to have the necessary warehouse privileges and object-level permissions for the data they are querying, but those do not replace the need for the Cortex-specific role.
- A. Correct.
Correct. To use Snowflake Cortex AISQL functions, a role must be granted the SNOWFLAKE.CORTEX_USER database role. This is the least-privilege approach for enabling Cortex AI features for end users. It allows access to Cortex capabilities without broadly elevating administrative privileges.
- B. Incorrect.
Incorrect. ACCOUNTADMIN is far more privilege than required and violates least-privilege principles. Cortex AI usage does not require assigning top-level account administration to business users. Choosing this option reflects a common but unsafe assumption that new platform features require powerful built-in roles.
- C. Incorrect.
Incorrect. USAGE on the SNOWFLAKE database and CREATE MODEL on a schema do not enable Cortex AISQL access for users. CREATE MODEL is related to model objects in ML workflows, not simply invoking Cortex functions such as summarize or classify text. This option mixes unrelated privileges and would not address the specific authorization error.
- D. Incorrect.
Incorrect. IMPORTED PRIVILEGES on the SNOWFLAKE database is not the recommended mechanism for enabling Cortex AISQL functions for end users in this scenario. Cortex AI access is controlled through the SNOWFLAKE.CORTEX_USER database role. This distractor targets the misconception that access to all shared Snowflake-provided objects in the SNOWFLAKE database is sufficient.