SnowPro Specialty: Gen AI Question 18
Single answerSecurity, privacy, access, and control principlesA healthcare company is building an internal GenAI assistant in Snowflake to summarize support tickets that may contain protected health information (PHI). The security team requires that analysts can use the assistant without being able to view raw PHI beyond what they are already authorized to access, and that any model interaction remains governed by Snowflake access controls and auditing. Which approach BEST meets these requirements?
- A
Create a secure view that masks or excludes sensitive columns, grant analysts access only to that view, and have the GenAI workflow use the secured view as its data source.
- B
Grant analysts direct SELECT access to the underlying ticket table because Snowflake logs queries, then rely on query history for compliance review.
- C
Export ticket data to an external LLM application and remove PHI there, since de-identification outside Snowflake provides stronger separation of duties.
- D
Give the GenAI application a powerful service role with broad access to all ticket data, because the model needs complete context to generate accurate summaries.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to place governed access controls in front of the sensitive source data and ensure the GenAI workflow reads from that controlled interface rather than from raw tables. In Snowflake, this commonly means applying role-based access control and exposing only approved data through secure views, potentially combined with masking policies or other governance controls where appropriate. This approach supports the core security principles of least privilege, data minimization, and centralized auditing. By contrast, relying only on logs is detective rather than preventive, exporting PHI to an external LLM expands the attack and compliance surface, and overprivileged service roles undermine access control. These practices are consistent with Snowflake guidance around RBAC, secure data sharing patterns, and governance features used to protect sensitive data while enabling analytics and AI workloads.
- A. Correct.
Correct. Using a secure view and limiting analyst access to that governed object follows least-privilege principles and keeps access enforcement inside Snowflake. If masking or column exclusion is needed, the view can expose only approved fields or transformed outputs. This aligns with Snowflake's security model, where role-based access control, secure views, and masking or governance features can be used to ensure users and applications only access authorized data.
- B. Incorrect.
Incorrect. Auditing is important, but query history does not replace preventive access control. Granting direct access to the raw table violates least privilege if analysts do not need unrestricted PHI. Logging helps detect and investigate access, but it does not stop unauthorized exposure.
- C. Incorrect.
Incorrect. Moving sensitive healthcare data to an external application increases data movement and can create additional privacy, governance, and compliance risks. It also weakens the requirement that model interaction remain under Snowflake access controls and auditing. Best practice is generally to minimize unnecessary data egress and keep governance as close to the source as possible.
- D. Incorrect.
Incorrect. Broad service-role access is the opposite of least privilege. Even if a model might benefit from more context, security requirements take precedence. The GenAI workflow should only access the minimum necessary data through governed objects and approved roles, not unrestricted base tables.