Snowflake ADS-B01: SnowPro Specialty: AI Governance & Security (beta)

Last checked November 10, 2026 against the official Snowflake exam page.

1. Question 1Cortex AI risk assessment

   A bank plans to let analysts ask a Cortex-powered assistant about customer complaint records, which contain names and account numbers. Before anything goes live, which step belongs first in the risk assessment?

   1. ATune the prompt wording so the assistant gives shorter answers
   2. BMeasure how many concurrent analysts the assistant can serve
   3. CIdentify which complaint fields are sensitive and who may see them
   4. DCompare response quality across several language models in a sandbox
   Show answer and explanationHide answer

   Correct answer: C

   Identifying the sensitive fields and who may view them defines the risks and the controls that are needed, so it comes first. Prompt tuning, capacity testing and model comparison are useful later but do not establish the risk baseline.

2. Question 2AI access control and agent identity

   A data engineer sets up a scheduled job that calls Cortex functions. The job currently runs under the engineer's personal user, which has broad privileges. The team wants the job to keep running if the engineer changes roles. Which approach is best?

   1. AKeep the engineer's personal user with its broad existing privileges and a password that never expires
   2. BCreate a dedicated service user with only the needed privileges, authenticated by key pair
   3. CGrant the job's role ACCOUNTADMIN so that no permission errors occur during scheduled runs
   4. DShare the engineer's password with the team and rotate it every quarter
   Show answer and explanationHide answer

   Correct answer: B

   A dedicated service identity with least-privilege grants and key-pair authentication survives staff changes and limits what a leaked credential can reach. The other options keep a personal identity, grant excessive rights or spread a shared password.

3. Question 3Cortex AI Guardrails and Cortex Guard

   Which statement best describes the purpose of a guardrail on a generative AI call?

   1. AIt limits which users and roles may call the model by enforcing role-based privileges on the function
   2. BIt caches earlier responses so that a repeated prompt is served without a new model call
   3. CIt screens inputs or outputs against a safety policy, such as unsafe content, before the response is used
   4. DIt shortens long prompts so that more of the model's context window is left for the answer
   Show answer and explanationHide answer

   Correct answer: C

   Guardrails check content against a policy, for example unsafe material, and can block or replace what fails. Access control, caching and prompt shortening are separate mechanisms that do not filter content.

4. Question 4Horizon Catalog governance and observability

   A governance team wants every email-address column to be masked for analysts, including columns that are added to new tables later. Which approach fits best?

   1. ACreate a tag for email data, attach a masking policy to that tag, and apply the tag to each column
   2. BAsk developers to prefix every new email column name with a common label so analysts can filter it out
   3. CCreate a separate masking policy for each table and update it whenever a new table is added
   4. DTrust analysts to leave email columns out of their SELECT lists in their own queries
   Show answer and explanationHide answer

   Correct answer: A

   A masking policy attached to a tag applies to every column that carries the tag, so new columns are covered as soon as they are tagged. Per-table policies need constant upkeep, naming conventions are not enforced, and relying on analysts is not a control.

5. Question 5Data residency and compliance architecture

   A European insurer must keep its customer data inside the EU, but its disaster recovery plan calls for a copy in another region. Which approach best meets both needs?

   1. AReplicate only to a second region inside the EU that the compliance team has approved for storage
   2. BReplicate the database to a region on another continent, since that offers the most distance from a disaster
   3. CStore the data in an external stage on a non-EU cloud and copy it back to Snowflake when needed
   4. DKeep one account in a single non-EU region, since the plan requires no copy inside the EU at all
   Show answer and explanationHide answer

   Correct answer: A

   Replication must stay within regions that the residency rules allow, so a second EU region satisfies both the storage requirement and recovery planning. A copy on another continent, an external stage outside the approved boundary and a single non-EU region all break the stated constraint.