AI Technologies And Controls practice questions

Allow all 'iam:PassRole' actions

Why it fails: Allowing all pass-role actions is a severe security risk.

Assign the 'SageMakerFullAccess' managed policy

Why it fails: SageMakerFullAccess grants broad permissions across the entire SageMaker service, directly violating least privilege for Model Monitor work. Least privilege requires a scoped custom policy limited to monitoring actions and specific resources. It is tempting because it guarantees the developer can perform every monitoring task, but that breadth is precisely the problem.

Enable root access to the underlying EC2 instance

Why it fails: Root access to the underlying EC2 instance grants unrestricted control of the host, directly violating least privilege by giving developers far more than the SageMaker Model Monitor permissions they need. Least privilege requires scoped IAM roles and policies. Root access would be the correct choice only for administrative host maintenance by authorised infrastructure owners, not developers.

Increase the learning rate

Why it fails: Raising the learning rate amplifies the poisoned gradient updates causing the train-validation gap, worsening the divergence rather than mitigating it. It is tempting because a higher rate can escape poor local minima during ordinary underfitting, but poisoning requires data sanitisation, robust aggregation or outlier filtering instead.

Enable Model Versioning in MLflow

Why it fails: Model versioning tracks and stores model artefacts and metadata; it does not detect or prevent poisoned training data, so validation accuracy would still collapse. It is tempting because versioning supports rollback and audit, and would be the right control when you need to reproduce or revert a previously trained model.

Switch to a pre-trained Transformer architecture

Why it fails: Architecture change does not inherently fix existing poisoning in the training pipeline.

Vertex AI 'Feature Store' access control

Why it fails: Feature Store manages data for training, not output filtering.

Vertex AI 'Model Registry' IAM roles

Why it fails: IAM roles control access to models, not output content.

Vertex AI 'Pipeline' execution logs

Why it fails: Pipeline logs track execution history, not real-time content filtering.

Set 'Log Analytics' retention to 365 days

Why it fails: Retention settings impact storage duration, not real-time detection.

Configure 'Conditional Access' policies for API keys

Why it fails: Conditional Access manages authentication, not prompt content analysis.

Enable 'Azure Policy' for resource tagging

Why it fails: Azure Policy for resource tagging governs resource compliance and metadata, and has no bearing on prompt injection detection, which requires the AI threat detection setting in Defender for Cloud Apps. It is tempting because policy enforcement is a genuine Defender for Cloud capability, but it addresses governance, not AI attack telemetry.

Microsoft Entra ID

Why it fails: Microsoft Entra ID handles authentication, authorisation and identity governance; it does not inspect prompt or completion content, so it cannot intercept or mask credit card numbers. Content filtering requires a dedicated data-loss-prevention or content-safety feature. Microsoft Entra ID would be the correct choice for controlling which identities may call the Azure OpenAI deployment.

Azure Monitor

Why it fails: Azure Monitor collects metrics, logs and diagnostics about resource health and usage; it observes telemetry rather than inspecting prompt payloads, so it cannot mask credit card numbers before they reach the model. A content-filtering or data-loss-prevention feature performs that interception. Azure Monitor would be the correct choice for alerting on latency, token usage or failed requests.

Azure Key Vault

Why it fails: Key Vault stores secrets, it does not scan live traffic.

Membership inference attack testing

Why it fails: Membership inference attacks determine whether a specific data record was part of the training set, but they do not directly identify if sensitive information is leaked in model outputs. While related to privacy, this technique assesses the model's vulnerability to inference rather than detecting actual leakage in generated text. For detecting leakage in outputs, a different approach is needed.

Differential privacy during training

Why it fails: Differential privacy adds noise to training to prevent the model from memorizing individual data points, reducing leakage risk. However, it is a preventive control applied during training, not a detection technique for outputs. The scenario asks for identifying leakage in generated outputs, so a detection method is required.

Output watermarking

Why it fails: Output watermarking embeds a hidden pattern in generated text to trace its origin, not to detect sensitive information leakage. It is useful for provenance and copyright, but it does not scan for or flag confidential data. Implementing watermarking would not satisfy the requirement to identify when the model reveals training data secrets.

Request the model's source code and training data from the vendor to build a surrogate model

Why it fails: Vendors rarely provide source code or training data due to intellectual property concerns. Building a surrogate model is complex, may not faithfully replicate the original, and does not directly provide explanations for individual decisions. This approach is impractical and does not guarantee regulatory compliance.

Implement LIME (Local Interpretable Model-agnostic Explanations) to approximate the model locally

Why it fails: LIME can generate local explanations, but its approximations are less stable and consistent than SHAP, and it may not provide the rigorous, legally defensible explanations required for regulatory compliance. In a loan approval context, inconsistent explanations could lead to challenges, making SHAP a more reliable choice.

Replace the third-party model with an inherently interpretable model like logistic regression

Why it fails: While logistic regression is interpretable, replacing the model may not be feasible if the third-party model provides superior predictive performance. The requirement is to explain decisions, not necessarily to change the model. Post-hoc explanation methods can meet regulatory needs without sacrificing accuracy.

Use the prompt engineering instruction 'Do not output PII' in the System Prompt field.

Why it fails: A system prompt is natural-language guidance the model may ignore; it enforces no deterministic filter. Bedrock Guardrails' sensitive-information policy applies PII detection and masking to both input and output. Prompt instructions suit steering tone or style, not guaranteeing regulatory PII redaction.

Set the content moderation filter level to 'High' in the model configuration.

Why it fails: Content moderation filters harmful categories such as hate or violence, not personally identifiable information. Raising the level to High tightens those categories only. PII detection requires the separate sensitive-information filter with prompt and response both enabled.

Apply an IAM policy to the Bedrock execution role restricting access to PII-containing datasets.

Why it fails: An IAM policy on the Bedrock execution role governs which AWS resources the model may call; it does not inspect prompt or response text for PII. It is the right control for least-privilege resource access, not for content filtering.

Enable 'AccessControl' logging in Entra ID

Why it fails: Entra ID sign-in and audit logging records identity events like token issuance and directory changes, not the prompt content evaluated by Azure OpenAI's content filters. It is tempting because Entra ID logs are the usual first stop for security investigations, and they would be correct for tracing suspicious authentication to the Azure OpenAI resource.

Enable 'MetricAlerts' at the subscription level

Why it fails: Metric alerts evaluate numeric platform metrics and fire notifications; they neither capture nor forward prompt text, so injection attempts remain unlogged. Subscription-level metric alerting is tempting because it is the standard mechanism for CPU, latency and error-rate thresholds, and would be correct for detecting anomalous consumption rather than content-level attacks.

Enable 'AuditLogs' in the Storage Account settings

Why it fails: Azure OpenAI prompt-injection telemetry surfaces through the resource's own diagnostic categories (such as RequestResponse and Audit) routed to Log Analytics, not Storage Account audit logs, which record blob and queue access. Storage 'AuditLogs' is tempting because storage diagnostics do capture access events, but that scope never sees model inference payloads.

Vertex AI Pipelines caching

Why it fails: Pipelines caching stores and reuses step outputs to speed reruns; it does not verify dataset integrity or provenance. Detecting poisoning requires lineage and artefact tracking, such as Vertex ML Metadata, which records dataset origins and versions. Caching would be correct for reducing pipeline execution time, not for validating training data authenticity.

Cloud Data Loss Prevention (DLP) API

Why it fails: The DLP API detects and redacts sensitive data such as personally identifiable information in content; it does not record artefact lineage or cryptographic hashes, so it cannot verify training-data integrity. It is tempting because it inspects data, but provenance requires Vertex AI ML Metadata or dataset versioning records.

Cloud Armor WAF

Why it fails: Cloud Armor WAF filters inbound HTTP/S traffic against web exploits at the edge; it never inspects Vertex AI training artefacts, so it cannot verify dataset integrity or provenance. It is tempting because it protects internet-facing applications, but the required control is artefact lineage and hash verification within the ML pipeline.

Enable the 'Prompt Injection' toggle in the Azure Portal global settings.

Why it fails: No such toggle exists; prompt injection is mitigated through content filtering, system message design and input validation, not a portal global setting. It tempts because prompt injection is a genuine Azure OpenAI risk, but identity-based access and logging require Microsoft Entra ID authentication and diagnostic logging configuration.

Create a shared API key for all users to simplify service account management.

Why it fails: A shared API key is static credential-based access, not identity-based, and provides no per-user audit trail. Shared keys are tempting because they simplify service account management, and would suit anonymous or non-attributable workloads where individual identity and logging are not required.

Set the model to 'Public Access' in the Networking tab for easier debugging.

Why it fails: Public access exposes the endpoint without identity checks, defeating the requirement for identity-based access and auditable inference logging. It is tempting because disabling private endpoints can simplify connectivity troubleshooting, and would suit a non-production sandbox where authentication and logging are not mandated.

Increasing model quantization

Why it fails: Quantization compresses weights and activations for inference, operating after training, so it cannot detect tampered training samples. It is tempting because it is a genuine PyTorch optimisation step, but it would be the right choice when reducing model size or latency, not for verifying data integrity.

Reducing the number of training epochs

Why it fails: Epoch count governs how long training runs, not whether the input data was altered; poisoned samples still influence gradients in every epoch. It is tempting because fewer epochs limit exposure to bad data, but it would be the correct choice for controlling overfitting or compute cost.

Enabling 'Multi-Factor Authentication' on the training cluster

Why it fails: Multi-Factor Authentication governs who may access the training cluster, not whether the datasets themselves were modified; an authorised insider can still poison data. It is tempting because it is a strong access control, but it would be the correct choice for protecting cluster login credentials.

AWS Glue

Why it fails: Glue is a serverless ETL service for cataloguing and transforming data; its IAM role governs Glue jobs, not Bedrock inference. Least privilege for Bedrock is enforced through IAM policies on the calling principal. Glue is tempting as another IAM-integrated service, but it authorises data pipelines, not model API access.

AWS CloudFront

Why it fails: CloudFront is a content delivery network that caches and distributes HTTP content at edge locations; it does not evaluate Bedrock API authorisation. Least privilege at the API layer is enforced by IAM policies attached to identities calling Bedrock. CloudFront is tempting for shielding origins, but it controls content delivery, not API permissions.

Amazon S3

Why it fails: Amazon S3 stores objects and enforces bucket policies and ACLs on data, not on Bedrock model-invocation API calls, so it cannot gate InvokeModel actions. It is tempting as the default AWS authorisation surface, and it would be correct for restricting access to training datasets or model artefacts held in buckets, not the API layer.

Model Inversion attacks

Why it fails: Model Inversion reconstructs training data from model outputs, a confidentiality attack that Adversarial Training does not mitigate; it only improves robustness to input perturbations. It is tempting because both concern model exploitation, and ART's privacy defences would be correct for inversion or membership-inference threats.

Model Theft attacks

Why it fails: Adversarial training hardens a classifier against perturbed inputs at inference time; it does not prevent an attacker from querying the model to build a substitute. Model theft is countered by rate-limiting or watermarking prediction APIs, so this option addresses extraction rather than evasion.

Supply Chain attacks

Why it fails: Adversarial Training retrains a model on perturbed examples to harden it against evasion at inference; supply chain attacks compromise artefacts, dependencies or pipelines, which training cannot address. It is tempting because ART covers many threat categories, and would be correct for detecting poisoned training data.

Setting 'API Rate Limits'

Why it fails: Rate limits cap query volume but do not alter what each response reveals, so an adversary can still reconstruct training data given enough patient queries. They are tempting because they blunt bulk extraction and denial-of-service abuse, yet model inversion is countered by output perturbation, confidence masking or differential privacy.

Enabling 'VPC Service Controls'

Why it fails: VPC Service Controls build a network perimeter around Google Cloud APIs, restricting data exfiltration, but they do not reduce the information contained in model responses. They are tempting because perimeter controls are standard cloud security practice, yet model inversion is defeated by output minimisation and differential privacy, not network boundaries.

Using 'Hardware Security Modules' (HSM)

Why it fails: HSMs protect cryptographic keys and signing operations, not the statistical information a model's predictions expose. They are tempting because hardware-backed key storage is a recognised AI security control, but model inversion is mitigated by limiting output detail, such as rounding confidences or returning only top labels.

Model Drift Monitoring

Why it fails: Drift monitoring compares input and output distributions over time to detect degradation; it takes no action on request volume and cannot emit 429 responses. It would be the right control when investigating accuracy decay or data-distribution shift in a deployed model.

Data Encryption at Rest

Why it fails: Encryption at rest protects stored data and model artefacts from disk-level disclosure; it has no role in request throttling and never produces 429 responses. It would be the correct control when addressing data confidentiality or compliance requirements for stored information.

Input Sanitization

Why it fails: Input sanitisation validates and cleans request payloads to block injection or malformed data; it does not count requests or enforce rate limits, so it cannot generate 429 errors. It would be correct when defending against prompt injection or adversarial inputs.

Model Poisoning

Why it fails: Model poisoning corrupts training data to degrade or bias the model; it does not concern authorisation checks on external sources at access time. Poisoning is correct when an adversary tampers with the training pipeline, not when the model reads data without permission validation.

Model Inversion

Why it fails: Model inversion reconstructs training data from model outputs; it does not describe missing authorisation checks on external sources. It is the right answer when an attacker exploits prediction confidence to recover sensitive training records, not when access control on data is absent.

Evasion Attack

Why it fails: Evasion attacks craft inputs that cause misclassification at inference time, which is unrelated to authorising access to external data. Evasion is the correct choice when adversarial samples bypass a deployed detector, not when the flaw is absent authorisation checks on data sources.

AWS Config

Why it fails: AWS Config records resource configuration changes and compliance, not model prediction distributions, so it cannot surface drift. It is tempting because it monitors deployed AWS resources, and would be correct for tracking infrastructure configuration drift, but detecting model drift requires comparing input and output statistics over time.

Amazon GuardDuty

Why it fails: GuardDuty detects anomalous or malicious activity in AWS accounts and workloads, not gradual degradation in model prediction quality. It is tempting because it is the standard AWS threat-detection service, and would be correct for identifying compromised credentials or crypto-mining rather than statistical drift.

AWS CloudTrail

Why it fails: CloudTrail records AWS API activity, capturing who called which service, not statistical changes in model inputs, outputs, or accuracy over time. It is tempting because it is the default AWS auditing tool for security investigations, and would be correct for tracing suspicious API calls rather than measuring drift.

Store model training data in plaintext

Why it fails: Plaintext training data offers no protection against injected instructions and exposes sensitive corpora; prompt-injection mitigation instead requires input sanitisation, instruction hierarchy and output filtering. It is tempting because plaintext storage is convenient for rapid model retraining and debugging, which suits isolated research environments without untrusted input.

Increase the model's temperature parameter

Why it fails: Temperature controls output randomness, not instruction trust boundaries; raising it increases unpredictable responses and can worsen injection outcomes. It is tempting because temperature tuning is a familiar generative-AI parameter, and in creative-writing or brainstorming deployments higher values genuinely produce the desired varied output.

Grant IAM access to the model file

Why it fails: Model Cards are documentation artefacts describing a model's purpose, evaluation results and constraints; they do not grant identity or access permissions. IAM policies govern access to model files, and would be the correct mechanism when the requirement is restricting who can retrieve or invoke a model.

Enable encryption for the model weights

Why it fails: Model Cards document intended use, training data, performance metrics and limitations for governance and transparency; they do not perform cryptographic operations on weights. Encryption of model weights is handled by key management services, and would be the right control when protecting model artefacts at rest.

Automatically patch the model software

Why it fails: Model Cards provide structured documentation for governance and disclosure; they do not execute software updates on models or their dependencies. Automated patching is performed by configuration management or CI/CD pipelines, and would be the right answer if the requirement concerned keeping model-serving software current.