SnowPro Specialty: Gen AI Question 167
Single answerSet up the Snowflake environmentA data engineering team is preparing a new Snowflake account for an internal generative AI application that will use Cortex LLM functions from SQL and Python worksheets. The security team requires least-privilege access and wants to avoid granting broad account-level administrative rights to developers. Which action should the platform administrator take FIRST to enable the environment correctly for the development team?
- A
Grant the SNOWFLAKE.CORTEX_USER database role to the developers' custom role, then grant that custom role access to the required warehouse, database, and schema objects.
- B
Grant the ACCOUNTADMIN role to all developers so they can enable Cortex features and create any required objects during development.
- C
Create an external access integration so the developers can call Snowflake-hosted LLM functions from SQL without additional privileges.
- D
Enable cross-cloud replication for the database that will store prompts and responses, because Cortex functions require replicated databases before use.
Show answer and explanation
Correct answer: A
Explanation
For setting up a Snowflake environment for GenAI development, a key prerequisite is granting access to Cortex capabilities through the appropriate role-based model. Snowflake documents that use of Cortex LLM functions requires the SNOWFLAKE.CORTEX_USER database role. In practice, administrators should grant this to a custom functional role used by developers, then grant standard privileges for warehouses, databases, schemas, and objects needed by the application. This aligns with Snowflake best practices for RBAC and least privilege. Broad administrative roles such as ACCOUNTADMIN should be avoided for routine development access. Likewise, external access integrations are for reaching services outside Snowflake, not for using native Cortex functions, and replication settings are not a prerequisite for Cortex usage.
- A. Correct.
Correct. To use Snowflake Cortex LLM functions, the role used by the developer must have the SNOWFLAKE.CORTEX_USER database role granted. In a least-privilege setup, the recommended approach is to grant this database role to a custom developer role, then separately grant the normal privileges needed to use a warehouse and access the relevant database and schema objects. This enables Cortex usage without over-privileging users.
- B. Incorrect.
Incorrect. ACCOUNTADMIN is far broader than necessary and violates least-privilege principles. Developers do not need full account administration rights just to use Cortex functions in SQL or Python worksheets. Granting ACCOUNTADMIN is a common shortcut in test environments, but it is not an appropriate first step for a governed production or enterprise setup.
- C. Incorrect.
Incorrect. External access integrations are used when Snowpark code needs to reach external network locations. Snowflake-hosted Cortex functions do not require an external access integration simply to be invoked from SQL. Choosing this option reflects a confusion between calling external APIs from Snowpark and using built-in Snowflake AI capabilities.
- D. Incorrect.
Incorrect. Cross-cloud replication is unrelated to basic Cortex function access. Databases that store prompts, inputs, or outputs do not need replication enabled for developers to use Cortex LLM functions. This distractor targets the misconception that AI features depend on advanced account replication or failover configuration.