CCNA AI Technologies And Controls Questions

Versioning AI models in production creates an immutable record of each model artifact, its training data lineage, hyperparameters, and evaluation metrics. The primary operational benefit is enabling rapid rollback: if a newly deployed model exhibits degraded performance, harmful outputs, or a security issue, the team can immediately revert to the last known-good version without retraining. This minimizes downtime and blast radius during incidents.

Output filtering is the most effective control because it directly inspects and blocks generated content that violates policy or contains sensitive information. It works with any third-party LLM API and can be customized to enforce specific rules. This control provides a consistent enforcement layer independent of the model's training or behavior.

Indirect prompt injection through retrieved documents is best contained by removing the malicious instructions before they reach the model and by ensuring retrieval only returns content the requesting user is entitled to see. Sanitization attacks the vector, while authorization limits the consequence. Sampling parameters and retrieval breadth do not block instruction following, and logging observes rather than prevents the disclosure.

A VPC Interface Endpoint (powered by AWS PrivateLink) creates an elastic network interface with a private IP address in your subnet that serves as an entry point for traffic destined to the AWS service or your own endpoint service. Because the endpoint is reachable only via private IPs inside the VPC, model inference requests are routed over the AWS private backbone and never traverse the public internet. This is the defining characteristic of PrivateLink connectivity.

The scenario describes a distributional shift in input data due to a promotional period, leading to model performance degradation. Drift detection is the AI-specific control that monitors for such changes and enables timely intervention, such as retraining. Other controls like differential privacy, input validation, or adversarial training do not directly address natural data drift and would not prevent the false positive spike.

The main objective of red teaming an LLM is to proactively identify safety and security vulnerabilities before adversaries exploit them. Red teaming involves adversarial testing—crafting prompts designed to bypass guardrails, elicit harmful outputs, or extract sensitive information—to uncover weaknesses that can then be remediated. It is a defensive exercise focused on discovery, not on model improvement or cost reduction.

Homomorphic encryption allows computations to be performed directly on encrypted data without decrypting it first, producing an encrypted result that, when decrypted, matches the result of the same computation on the plaintext. In secure AI, this enables model inference or training on sensitive data while the data remains encrypted end-to-end, protecting privacy even from the compute provider. This is the defining property of homomorphic encryption.

SageMaker Model Registry provides versioned model groups with approval statuses (PendingManualApproval, Approved, Rejected), and deployment pipelines can be gated to only deploy models in the Approved state. This creates an auditable, policy-enforced promotion path from training to production.

A sandboxed execution environment for agents is the correct control because prompt injection attacks aim to make an LLM-driven agent execute unintended actions (e.g., calling tools, accessing files, or making network requests). Sandboxing constrains what the agent can actually do even if the prompt is manipulated, enforcing least privilege at the execution layer. This is a defense-in-depth control that limits blast radius rather than trying to perfectly filter malicious prompts.

On-device processing with anonymized feature vectors is the most appropriate control because it minimizes the collection and storage of sensitive biometric data. By processing locally and discarding raw images, the system reduces the risk of unauthorized surveillance and helps comply with privacy regulations that mandate data minimization and purpose limitation.

Model validation before production verifies that the model meets defined performance, fairness, robustness, and safety benchmarks on representative data, ensuring it behaves as intended in real-world conditions. It is a governance gate that catches degradation, bias, or unsafe behavior before customers or critical processes are affected. Removing users, encrypting weights, and reducing GPU costs are unrelated to validation's purpose.

Output perturbation deliberately adds noise or rounds confidence scores returned by the API, degrading the fidelity of the information an adversary can use to train a clone. Model extraction relies on precise output signals, so perturbing them reduces clone accuracy while preserving acceptable utility for legitimate users. This is a direct, low-cost mitigation at the inference boundary.

Instruction hierarchy and output filtering are specifically designed to prevent prompt injection attacks that aim to extract system prompts. Instruction hierarchy enforces that system-level directives cannot be overridden by user inputs, while output filtering scans and redacts sensitive content. These controls together provide a robust defense against system prompt disclosure, unlike input sanitization which can be bypassed.

Differential privacy is the only technique listed that provides a formal guarantee limiting the influence of any single training record on the model. By adding noise during training, it directly prevents reconstruction and membership inference attacks, which is exactly what the team needs to protect sensitive customer data in a fraud detection model.

Differential privacy is the only technique listed that provides a formal, mathematical guarantee that an individual's data cannot be re-identified from the model. It works by injecting noise into the training process, ensuring that the model's behavior is statistically similar whether or not any single record is included. Other techniques like data masking, homomorphic encryption, and secure multi-party computation address different aspects of privacy but do not offer this guarantee.

The Fast Gradient Sign Method (FGSM) is a well-known evasion attack that generates adversarial examples by adding small perturbations to input data to fool a classifier. It is specifically designed to test a model's vulnerability to evasion, where the attacker manipulates inputs at inference time to cause misclassification. Therefore, simulating FGSM with ART is the correct choice for assessing evasion vulnerabilities.

Differential privacy is the technique that bounds how much any single individual's data can influence a query result, which is exactly the guarantee needed when analysts may run many queries against a model trained on sensitive records. Encryption, authenticated access, and identifier hashing all protect the data at rest or at the gate but leave the information content of legitimate outputs unconstrained, so they do not prevent reconstruction.

Statistical outlier detection on training feature sets is the most effective technique because poisoning attacks introduce anomalous data points that deviate from the expected distribution of legitimate training data. By applying statistical methods (e.g., z-score, IQR, isolation forests) to feature distributions, contaminated samples can be flagged and removed before they influence model weights. This directly targets the integrity of the training pipeline at the data ingestion stage.

The attack exploits memorization of rare training sequences, so the effective control must act during training to limit how much any single record shapes the weights. Differential privacy via DP-SGD clips per-example gradients and adds calibrated noise, mathematically bounding individual record influence. Inference-time filters, watermarking, and longer training do not remove the memorized data and therefore cannot reliably stop extraction.

SageMaker Model Monitor is designed to continuously monitor deployed models for data quality, model quality, bias drift, and feature attribution drift. It can detect statistical deviations in ground truth data by comparing live data to a baseline and trigger CloudWatch alarms. This directly addresses the requirement to monitor and alert on drift.

FGSM and PGD are both adversarial attack techniques used to generate perturbed inputs that can fool a model. They are standard methods for testing a model's robustness, especially in security-sensitive applications like intrusion detection. By applying these attacks, analysts can identify vulnerabilities and improve defenses.

An adversarial example attack occurs when an attacker intentionally modifies input data at inference time to cause the model to produce incorrect outputs. Here, the attacker alters camera feed pixels to make defective products appear non-defective. This is a direct example of an adversarial example attack, which is a key concern in AI security and requires defenses like input validation and robust model training.

Broken Access Control (A) is violated when an AI model accesses external data sources without proper authorization checks on the data itself — the model is effectively bypassing the access control layer that should govern which data it can read. This is the OWASP Top 10 #1 category and applies directly to AI systems that pull from APIs, databases, or file stores without enforcing per-resource authorization. The model should only reach data its service identity is explicitly permitted to access.

To log prompt injection attempts against Azure OpenAI in Microsoft Defender for Cloud, the 'RequestResponse' diagnostic logs must be enabled for the AI resource, as these capture the actual prompts and completions where injection patterns appear. This setting routes request and response data to the Log Analytics workspace, enabling Defender for Cloud's AI threat protection to detect and alert on prompt injection. Other logging categories do not capture the prompt-level content needed for this detection.

A Blind Spot attack in adversarial machine learning exploits regions of the input space where the model has low confidence or sparse training coverage, crafting inputs that force incorrect predictions. By targeting these under-trained regions, the attacker can cause misclassification without needing large perturbations, because the model has not learned robust decision boundaries there. This is distinct from evasion attacks that rely on gradient signals in high-confidence regions.

Differential Privacy (DP) is a mathematical framework that adds calibrated noise to data or computations so that the inclusion or exclusion of any single individual's data has a negligible effect on the output. In ML, it prevents attackers from determining whether a specific person was in the training set or inferring their attributes, thereby protecting individual privacy while still allowing aggregate statistical learning.

Differential privacy is the only technique listed that provides a formal privacy guarantee by adding noise during training, making it difficult for an attacker to determine if a specific record was used. Homomorphic encryption, secure multi-party computation, and federated learning address different privacy aspects but do not directly prevent a model from revealing training data.

AWS IAM is the primary control plane for authentication and authorization across AWS services, including Amazon Bedrock, and it is where least-privilege policies are defined for who can invoke which models and actions. Bedrock integrates with IAM so that permissions like bedrock:InvokeModel are granted or denied at the API layer through identity-based and resource-based policies. Glue, CloudFront, and S3 serve different purposes and do not govern Bedrock API access.

A physical adversarial patch defeats the model's decision, and retraining is off the table in the near term. The pragmatic control is to ensure no single model output can release a defective item, which an independent sensor or human sampling accomplishes. Adversarial retraining, threshold tuning, and camera resolution all either take too long or fail to address the perturbation's effect on the classifier.

Cryptographic hashing with signature verification provides a proactive integrity check that detects any modification to the model artifact before it is loaded into production. The other controls address access management, confidentiality at rest, or post-deployment behavior, none of which verify artifact integrity at deployment time.

Data lineage with checksum validation is the most effective technical control because it creates a verifiable cryptographic chain of custody for training data. Checksums (e.g., SHA-256) detect any tampering or corruption of datasets between their source and the training job, while lineage tracks provenance, transformations, and access. Together they allow an MLOps pipeline to detect poisoned or substituted data before it influences model weights.

HashiCorp Vault is purpose-built for secrets management, offering dynamic secrets, encryption as a service, leasing and revocation, and detailed audit logs. It integrates with identity providers and cloud IAM to issue short-lived credentials for databases, API keys, and AI pipeline components, so no static secret ever lives in code or config. For an AI training pipeline that touches sensitive datasets and third-party model APIs, Vault's centralized policy engine and audit trail directly support governance and least-privilege requirements.

Model extraction detection is fundamentally a monitoring problem: you must observe the sequence and shape of queries reaching the model. The endpoint's gap is that it discards payloads, so no downstream analytics can identify systematic probing. Capturing inference requests and responses with caller identity and timestamps restores that visibility, while validation, privacy training, and mutual TLS all address different concerns and leave the detection gap open.

AWS Bedrock Guardrails provides a dedicated PII filter that must be explicitly enabled in the sensitive information policy settings, with separate configuration for input (prompt) and output (response) flows. Enabling PII filtering on both flows ensures detection and masking/blocking of PII in either direction, which is the only configuration that satisfies the requirement.

An evasion attack on a computer vision model involves crafting inputs that are misclassified by the model while appearing normal to humans. Adding adversarial noise — small, often imperceptible perturbations to pixel values — is the canonical example: the modified image looks unchanged to a human but causes the model to output an incorrect label. This is a test-time attack that exploits the model's learned decision boundaries without altering the model itself.

Tagging retrieved chunks with source, time, and sensitivity, and surfacing citations, creates an auditable chain from answer back to document. That supports investigating incorrect or harmful outputs, verifying which authoritative source was used, and applying classification-based handling. It is a governance and traceability control, distinct from generation quality, storage optimization, and injection defense.

Data anonymization directly addresses the privacy risk by removing or altering PII before training, preventing the model from memorizing identifiable information. The other techniques are standard preprocessing steps but do not mitigate privacy concerns.

Model signing provides cryptographic integrity verification, ensuring that any modification to the model file is detected before loading. Watermarking proves ownership, encryption ensures confidentiality, and versioning tracks changes but does not verify integrity.

A CAPTCHA or similar bot detection challenge is the most effective way to mitigate non-human API traffic without blocking legitimate users. It presents a challenge that is easy for humans but difficult for automated scripts, thereby filtering out bots while allowing genuine users to continue accessing the service. This approach is targeted and minimally disruptive, aligning with the goal of not completely blocking the service.

The scenario describes a model exhibiting disparate impact despite removal of sensitive attributes, indicating bias through proxy features. Fairness-aware machine learning techniques like adversarial debiasing or reweighting are designed to mitigate such bias by adjusting the training process. Other options like SHAP values help detect bias but do not mitigate it, while differential privacy and watermarking are unrelated to fairness.

Adversarial Training is a defense specifically designed to mitigate evasion attacks by augmenting the training set with adversarial examples so the model learns to classify perturbed inputs correctly. The Adversarial Robustness Toolbox (ART) implements this defense to improve robustness against evasion, where an attacker crafts inputs at inference time to cause misclassification. It does not directly address model inversion, model theft, or supply chain attacks.

Runtime guardrails that inspect prompts and completions, combined with strict separation of system instructions from untrusted user content, directly counter instruction-override and context-leakage attempts. The other controls address unrelated concerns such as output randomness, training-data privacy, or user authentication, none of which stop an attacker from manipulating the model's instruction hierarchy during inference.

Human-in-the-Loop (HITL) means a human reviews, approves, or overrides model outputs before they take effect, which is a direct risk control for high-stakes decisions. Requiring human approval for high-risk model outputs ensures accountability and catches errors, bias, or unsafe recommendations before harm occurs. This is a core control in AI risk management frameworks for high-impact use cases.

Attacks that place crafted data into the training pipeline to influence what the model learns are poisoning attacks, and the multi-cycle, boundary-shifting nature described here is their signature. Evasion acts only at inference against a fixed model, model inversion extracts information rather than injecting it, and prompt injection applies to instruction-following generative systems, so none matches the described manipulation of training data.

Reproducing a model requires more than the trained artifact: you need the lineage that connects the artifact to the data snapshot, code commit, hyperparameters, and environment used to produce it. A versioning practice that records all of those elements enables retraining or reloading the identical model. Artifact-only storage, access logging, and committing the binary to Git each capture only part of the picture.

Membership inference testing is designed to quantify whether an adversary can infer that a specific record was used in training, which is exactly the memorization risk described. The other techniques address explainability, adversarial robustness, or operational drift, none of which measure privacy leakage from training data.

The EU AI Act classifies certain AI systems as 'High-Risk' (e.g., in critical infrastructure, employment, education, or law enforcement) and imposes mandatory requirements including human oversight, risk management, technical documentation, logging/traceability, and transparency. Human-in-the-loop design combined with logging ensures that a human can interpret outputs, intervene, and that decisions are auditable — directly satisfying the transparency and oversight obligations under Articles 13-14.

When ground truth labels are delayed, monitoring input feature distributions and prediction score distributions against a baseline is the most practical way to detect concept drift. Statistical metrics like PSI can signal when the data or model behavior deviates from the training distribution, prompting investigation or retraining. This approach is proactive and does not depend on immediate labels.

Data encryption at rest protects AI datasets by rendering stored data unreadable without the correct cryptographic keys, preventing unauthorized parties who gain access to storage media (stolen disks, misconfigured buckets, compromised backups) from reading the data. It is a confidentiality control, not a performance, detection, or patching mechanism.

Amazon SageMaker Model Monitor is purpose-built to detect data drift, model quality drift, bias drift, and feature attribution drift in production endpoints. It captures inference data, compares it against baselines, and emits CloudWatch alarms when drift exceeds thresholds. This directly addresses the need to detect performance degradation over time in a deployed model.

Strict egress (outbound) traffic rules control what data can leave the AI environment, directly preventing unauthorized exfiltration of training data or model artifacts. By defaulting to deny and allowing only approved destinations, ports, and protocols, you block covert channels an attacker might use to send stolen data out. This is the highest-priority firewall control for data exfiltration prevention.

The most effective control to mitigate the risk of vulnerable code from an LLM is to implement SAST that scans generated code before it is committed. SAST provides a deterministic, rule-based check that can catch known vulnerabilities, acting as a critical safety net. While fine-tuning, prompt engineering, and curated libraries can help, they are not foolproof and do not provide the same level of assurance as automated scanning.

Vertex AI ML Metadata tracks the lineage, provenance, and integrity of training artifacts, including datasets, models, and pipelines. It records metadata such as artifact versions, parameters, and execution details, enabling verification of whether a dataset was tampered with. This makes it the correct tool for investigating adversarial poisoning.

Isolating the model endpoint from the network (C) is the containment step that stops an active incident from spreading, exfiltrating data, or continuing to serve manipulated outputs. In incident response, containment always precedes eradication, recovery, or any retraining activity, because you cannot safely investigate or remediate a system that is still reachable and live. Cutting network access preserves forensic state while halting ongoing harm.

Adversarial debiasing is designed to reduce bias by training an adversary to predict the protected attribute and penalizing the model if it can. This directly mitigates discrimination. Data augmentation, pruning, and cross-validation do not specifically address fairness concerns.

A Model Card is a structured document that discloses a model's intended use, training data, performance metrics, limitations, and ethical considerations, providing transparency to stakeholders. Its primary governance role is to communicate what the model can and cannot do so that consumers, auditors, and risk teams can make informed decisions. This transparency function is the defining purpose of model cards in AI governance frameworks.

Model signing uses cryptographic signatures (typically via PKI or keyless frameworks like Sigstore) to bind a model artifact to a verified identity, providing both integrity — proving the weights were not altered after signing — and non-repudiation, since only the holder of the private key could have produced the signature. This lets downstream consumers verify provenance before deployment, which is essential for supply chain trust in MLOps.

The scenario highlights the need for trust and explainability in a healthcare AI system. Interpretability techniques like LIME and SHAP provide local explanations for predictions, enabling radiologists to understand and validate the model's outputs. Other controls such as encryption, federated learning, or rate limiting address different concerns (security, privacy, availability) and do not fulfill the requirement for explainable predictions.

An AI Firewall or LLM Gateway sits between users/applications and the underlying model, acting as an inline policy enforcement point that inspects, filters, and sometimes transforms prompts and responses. Its core purpose is to intercept traffic to block prompt injection, jailbreaks, data leakage, toxic content, and policy violations before they reach the model or the end user.

Prompt Shield is the Azure AI Content Safety feature specifically designed to detect and block prompt injection and jailbreak attempts, including both user prompt attacks and indirect attacks embedded in documents. Enabling it applies a dedicated detection model that flags adversarial prompts before they reach the underlying LLM. This is the only option that directly addresses jailbreak and prompt injection mitigation.

The requirement is that confidential documents must not leave the organization's network. A self-hosted inference server inside the virtual private cloud ensures that both training and inference occur locally, with no external data transmission. Public APIs, serverless calls to third-party services, and provider-hosted fine-tuned models all involve sending data outside the network boundary, so they cannot meet the requirement.