SnowPro Specialty: Gen AI Question 200
Single answerEnvironment setupA data engineering team is preparing a new Snowflake environment for a prototype that will use Snowflake Cortex LLM functions from SQL and Python worksheets. Security policy requires least-privilege access, and the team wants analysts to test prompts without granting broad administrative rights. Which setup step should the Snowflake administrator take first to enable this workload correctly?
- A
Grant the SNOWFLAKE.CORTEX_USER database role to the role that will run the Cortex functions
- B
Create a warehouse with GPU acceleration so Cortex LLM functions can execute
- C
Install external Python packages in every user schema before analysts can call Cortex functions
- D
Grant ACCOUNTADMIN to the analysts because Cortex functions require account-level privileges
Show answer and explanation
Correct answer: A
Explanation
The best first step is granting the SNOWFLAKE.CORTEX_USER database role to the role that will execute Cortex functions. In Snowflake, environment setup for Gen AI workloads should follow least-privilege design: grant only the specific privileges and roles needed, then allow users to access Cortex from supported interfaces such as SQL and Python-based development environments. Snowflake documentation for Cortex access describes the requirement to grant the SNOWFLAKE.CORTEX_USER database role before users can invoke Cortex functions. By contrast, customers do not provision GPU-backed warehouses for these managed AI functions, and broad administrative roles such as ACCOUNTADMIN should not be used for routine analyst access.
- A. Correct.
Correct. To use Snowflake Cortex AISQL/LLM capabilities, the executing role must be granted the SNOWFLAKE.CORTEX_USER database role. This is the key entitlement step for enabling users to call supported Cortex functions while still following least-privilege access patterns. Administrators can grant this role to a custom role used by analysts instead of giving broad administrative permissions.
- B. Incorrect.
Incorrect. Cortex LLM functions are managed Snowflake services and do not require the customer to provision a special GPU warehouse. A standard warehouse may still be needed for surrounding SQL or notebook/worksheet activity, but GPU infrastructure is not something the customer configures for Cortex function execution. This option reflects a common misconception based on external ML platform setup patterns.
- C. Incorrect.
Incorrect. Analysts do not need external Python packages installed in each schema just to call Cortex functions. Many Cortex capabilities are invoked directly from SQL, and Python access depends on the worksheet or runtime environment, not per-schema package installation. This confuses package management for Snowpark Python with service entitlement for Cortex.
- D. Incorrect.
Incorrect. ACCOUNTADMIN is not required for day-to-day use of Cortex functions and would violate least-privilege principles. The proper setup is to grant the specific database role required for Cortex usage to an appropriate functional role. This distractor targets the misconception that new AI features require broad account-level privileges for all users.