CCNA AI Technologies And Controls Questions

Extraction attacks often involve systematic querying to reconstruct training data. By monitoring for repeated, structured, or high-volume queries that target specific information, security teams can detect and alert on potential extraction attempts. This behavioral analysis is effective because it focuses on the attacker's methodology rather than the content of individual prompts.

FactSheets in IBM watsonx.ai is the governance artefact that records model lineage, training data, and audit metadata, providing the traceability the stem requires. It is the primary mechanism for tracking model provenance and supporting auditability across the AI lifecycle.

Rate limiting and query throttling reduce the volume of queries an attacker can make, making it harder to gather enough data to replicate the model. By limiting the number of calls, the attacker cannot efficiently map the model's decision boundaries. This control directly increases the cost and time required for a successful extraction attack.

429 responses are the HTTP status returned when a throttling policy rejects excess calls. API rate limiting caps request volume per client or key, directly constraining the automated query rates that model extraction and denial-of-service attempts depend on.

Diagnostic settings stream inference request and response logs from the Azure OpenAI resource to a Log Analytics workspace, satisfying the logging half of the requirement. Without this routing, audit records of model inference remain unavailable for review, so identity-based access alone cannot be evidenced.

Model stealing reconstructs a proprietary model by systematically querying its inference API and training a substitute on the returned outputs, exfiltrating intellectual property without direct access. It is a security incident because it breaches confidentiality of the model and enables further attacks such as evasion.

Ingesting model inference logs into a SIEM satisfies the requirement for continuous detection across cloud AI workloads. Inference logs capture prompts, outputs and anomaly signals, which the SIEM correlates against threat intelligence and behavioural baselines, enabling real-time alerting on prompt injection, data exfiltration or model abuse that standalone model tooling would miss.

Data provenance records the origin, lineage and handling of training data, letting you verify its source and integrity. This exposes tampered, poisoned or unlicensed datasets, which is why provenance is critical before and during model training.

IAM governs authentication and authorisation, binding identities to roles and policies that determine which cloud resources and AI services each principal may access. This directly fulfils the primary function of controlling who can reach what, which is the defining scope of identity and access management.

AWS Security Groups are stateful virtual firewalls attached to ECS tasks, allowing rules that permit traffic only from the specific microservices' security groups. This enforces least-privilege network access, restricting the model to authorised callers rather than the whole VPC.

RAG provides a source of truth for the model to reference.

Input sanitisation strips or escapes characters and instruction-like patterns in user text before it reaches the model, reducing the chance that injected directives are interpreted as system commands. It addresses the prompt injection vector at the entry point, complementing output filtering and least-privilege tool access.

Opacus is a library built specifically for PyTorch that implements differentially private stochastic gradient descent, clipping per-sample gradients and adding calibrated noise during training. It integrates directly with PyTorch optimisers, satisfying the requirement without altering the model architecture.

Logging records inputs, outputs, decisions and system events, creating an audit trail that supports incident investigation, forensic reconstruction and accountability. This traceability lets investigators determine what an AI system did, when, and on what basis.

SageMaker Model Monitor data quality monitoring compares live inference feature distributions against a baseline captured from training data and raises violations on statistical drift, even when schema and data types remain valid. That is exactly the silent-shift condition described here, so it detects the problem before degraded claim decisions accumulate.

Removing personally identifiable information and poisoned or malicious samples from the training corpus directly satisfies the sanitisation objective: it prevents privacy breaches and adversarial manipulation before the model learns. This preprocessing step ensures regulatory compliance and model integrity, distinguishing sanitisation from later controls such as access management in Microsoft Entra ID or runtime filtering.

Poisoned training data corrupts the learned parameters, so the model fails to converge normally, producing erratic loss curves or unstable accuracy across epochs. Inconsistent convergence during training is therefore a recognised indicator that the training set has been manipulated.

Insecure output handling occurs when model-generated text is passed downstream without scrutiny, enabling injection or script execution. Enforcing strict output validation and sanitisation treats model output as untrusted input, encoding or rejecting dangerous content before it reaches browsers, shells or databases, directly satisfying that control objective.

Containment isolates the affected AI model, stopping it from producing further harmful outputs or propagating errors while the incident is investigated. This limits blast radius, a core incident response step that preserves evidence and prevents ongoing damage before eradication and recovery begin.

Isolated environments confine each pipeline stage, so a compromised dependency or poisoned artefact cannot laterally reach training data, credentials, or production models. This directly satisfies the stem's supply chain constraint by limiting blast radius across the MLOps workflow, preventing one tainted component from corrupting downstream stages.

Digital signatures verify both integrity and origin by encrypting a hash of the model file with a private key, which recipients validate using the corresponding public key. This satisfies the stem's authenticity requirement, confirming the file genuinely originated from the trusted signer and was not altered while stored in the S3 bucket.

Membership inference exploits a model's confidence differences to decide whether a particular record belonged to its training data. That privacy violation is distinct from reconstructing features or fooling predictions, and underpins regulations such as GDPR.

Attackers performing boundary reconnaissance submit many slightly perturbed inputs and observe confidence changes to map decision boundaries. This produces clustered low-confidence outputs and structured query patterns that differ from normal user traffic. Monitoring for these signals can reveal pre-attack probing before an evasion attempt is launched.

Differential privacy bounds how much any individual training record can influence the learned parameters, which directly limits verbatim regurgitation of patient text. Tracking the privacy budget quantifies cumulative leakage across training runs, so the hospital can demonstrate that the memorization risk was constrained by design rather than assumed away by de-identification alone.

Data provenance tracking records the source, lineage, and transformations of training data, allowing verification that data has not been tampered with. This helps detect unauthorized modifications or poisoned data before it affects the model. It is a proactive control that provides auditability and traceability, essential for detecting data poisoning attempts in sensitive applications like healthcare.

Shadow AI covers unsanctioned AI tools used outside governance, so data entered into those services leaves organisational control, creating unmonitored leakage and regulatory compliance exposure. This is the primary risk because no oversight, logging or data-handling controls apply to the unsanctioned usage.

Adversarial debiasing trains the model to perform the primary task while simultaneously minimizing an adversary's ability to predict the protected attribute from the model's outputs. This directly reduces disparate impact and aligns with ISACA's emphasis on fairness and ethical AI. It is a proactive control applied during model development, addressing bias without simply discarding features.

Deploying a base model to a public endpoint requires creating that endpoint, so `aiplatform.endpoints.create` is the permission that directly gates the action. Without it, unauthorised users cannot provision the endpoint at all, satisfying the policy constraint of preventing public deployment. Note that Microsoft Entra ID governs Azure, not Vertex AI.

Federating the scientist's identity into the training platform and exchanging it for short-lived, scoped tokens removes standing secrets from notebooks and preserves per-user attribution in access logs. Each job carries the originating user's identity, so auditors can trace exactly who read which features, and tokens expire quickly enough to limit the value of any intercepted credential.

Attack surface denotes the set of points where an attacker can interact with the system, including APIs, inputs, plugins and data pipelines. This definition frames where adversarial probing of the AI architecture can occur, guiding control placement and threat modelling.

Model Denial of Wallet attacks exploit excessive inference consumption, so token volume is the signal. Aggregating usage.total_tokens per caller reveals abnormal or sustained spikes that inflate cost, letting the SIEM alert on consumption anomalies rather than on request counts alone.

API key authentication restricts which callers may invoke an AI system's endpoints, verifying identity before access is granted. It is a genuine access control mechanism because it gates entry to the service rather than protecting data in transit or monitoring behaviour, satisfying the requirement for an example of AI system access controls.

Mandating security and red-teaming testing for high-risk models ensures adversarial validation before deployment, addressing model-specific threats such as prompt injection and data leakage. This satisfies the requirement for an essential AI security policy component covering risk-tiered assurance.

Defensive distillation trains a student model on softened probability outputs, flattening gradients that evasion attacks exploit. This reduces sensitivity to small input perturbations, hardening the model. The trade-off is that the smoothed decision boundary can lower accuracy on clean, unperturbed inputs, which must be measured before deployment.

A backdoor attack implants a hidden trigger during training so the model behaves normally on standard inputs but produces attacker-chosen outputs whenever that specific trigger appears. This differs from indiscriminate accuracy degradation, which is the goal of availability-focused poisoning.

Model-extraction attacks manifest as unusual query volumes, low-entropy inputs, or systematic sampling near the decision boundary. Analyzing inference logs for distributional drift and boundary-probing behavior detects these patterns without altering the model or its responses. Because the requirement is detection only, a monitoring and alerting control on existing logs is the appropriate, non-invasive choice and aligns with ISACA's emphasis on continuous monitoring.

Role-Based Access Control assigns permissions by job function, so only authorised identities can pull, modify or publish models in the registry. This enforces least privilege on the registry's API and storage, satisfying the requirement to restrict access to sensitive model artefacts and their metadata.

SHAP values provide locally accurate, additive feature attributions grounded in cooperative game theory, which satisfies the requirement for consistent instance-level explanations. Each prediction can be decomposed into feature contributions that sum to the model output, making adverse decisions explainable to applicants and regulators. It works for many model types, including tree ensembles and neural networks.

Validating model updates against a clean, golden dataset detects poisoned weights or backdoors before deployment, because tampered models diverge from expected outputs on trusted, untainted inputs. This satisfies the pipeline's need to verify integrity prior to releasing a trained model.

Differential privacy provides a formal guarantee that the inclusion or exclusion of a single individual's data does not significantly affect the model's outputs. By adding calibrated noise during training, it prevents memorization of individual records. This is a key technique for privacy-preserving machine learning and aligns with ISACA's guidance on protecting sensitive data in AI systems.

Automated alerting on anomalous request patterns detects abuse such as credential stuffing against model endpoints or unusual inference volumes. It satisfies the monitoring strategy by converting raw telemetry into timely, actionable signals, letting analysts respond before anomalies escalate into incidents.