Exam GES-C01 Topic 1 Question 277 Discussion

Option A is correct. This sequence of commands first sets an account-level allowlist for 'mistral-large? and 'snowflake-arctic' , thereby restricting general access to other models for plain-name string lookups. The 'CALL ensures the changes are applied. It then explicitly grants the DATA SCIENCE_TEAM ROLES access to the 'claude-3-5-sonnet' model object using its dedicated application role 'SNOWFLAKE."CORTEX-MODEL-ROLE-CLAUDE-3-5-SONNET"'. This ensures 'claude-3-5-sonnet is accessible only to that specific role and not globally through the allowlist, fulfilling the granular access requirement. Option B is incorrect because 'ALTER ACCOUNT operations require the 'ACCOUNTADMIW role, not 'SYSADMIN'. Additionally, setting to 'claude-3-5-sonnet' would make it globally available, contradicting the requirement for restricted access. Option C is incorrect because model-level RBAC for base models in 'SNOWFLAKE.MODELS' is primarily applied using application roles (e.g., 'CORTEX-MODEL-ROLE'), not directly with 'GRANT USAGE ON MODEL'. Option D is incorrect. While clearing the allowlist is a valid part of a strategy, 'GRANT USAGE ON ALL MODELS IN SCHEMA SNOWFLAKE.MODELS' would grant access to 'all' models in that schema, which contradicts the requirement for 'claude-3-5-sonnet' to be exclusive to the data science team and not generally available. Option E is incorrect because SALTER ACCOUNT requires the 'ACCOUNTADMIN& role, not 'SECURITYADMIN', and setting the allowlist to 'claude-3-5-sonnet' would make it generally available, violating the isolation requirement.