Objective 4.2 Secure a Pipeline (includes Maintenance) AIP-210 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of setting up alerts in an ML pipeline's monitoring system?

   • ATo automatically patch vulnerabilities in the pipeline
   • BTo improve the accuracy of the ML model
   • CTo notify administrators of potential security incidents in real time
   • DTo replace the need for regular log reviews
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A European bank's ML pipeline processes customer data that is subject to GDPR. The pipeline runs in a public cloud region in the EU, and the bank must demonstrate to a regulator that only authorized personnel can access the raw data and that all access is logged. The bank also needs to prove that data is not transferred outside the EU. What should the ML platform team implement?

   • AEncrypt the data with a key stored in the same region and grant all employees read access to the raw data for transparency.
   • BUse Azure RBAC to restrict raw data access to a specific data engineering group, enable diagnostic logs for all data access, and confirm the pipeline uses only EU-region resources for storage and compute.
   • CUse a single global region for all resources to simplify management, and rely on the cloud provider's GDPR compliance certification.
   • DMove all data to an on-premises database and disable all cloud logging to reduce the attack surface.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A government contractor's ML pipeline processes classified data. The pipeline uses Azure Blob Storage for raw data and model artifacts. The security policy requires that data be encrypted with customer-managed keys (CMK) and that the keys be rotated every 90 days. The ML team is concerned that key rotation could break the pipeline if the old key is not available when the data is accessed. What should the team implement to ensure data remains accessible during and after key rotation?

   • ADisable the old key immediately after creating the new key to ensure only the new key is used.
   • BUse a single key version for the lifetime of the pipeline and document the exception to the rotation policy.
   • CStore a copy of the old key in a separate storage account and manually re-encrypt all data with the new key before rotation.
   • DEnable soft delete and purge protection on the Key Vault, and configure key rotation so that the new key version is enabled before the old version is disabled, allowing Azure to re-encrypt data with the new key.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which technique is used to verify the integrity of a model artifact by generating a unique fixed-size string from its contents?

   • ACompression
   • BEncryption
   • CHashing
   • DTokenization
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A manufacturing company runs a computer-vision model on Azure Kubernetes Service (AKS) for quality inspection. The Kubernetes cluster and the model's base Docker image are several versions behind, and the security team has identified critical vulnerabilities in both. The ML team wants to update the cluster and the image without disrupting the production service. What is the most appropriate approach?

   • AUpdate the base image in the Dockerfile and rebuild, but do not update the AKS cluster because it is not directly related to the model.
   • BApply the cluster patches manually to each node via SSH, and update the image tag in the deployment manifest without rebuilding.
   • CPerform a rolling update of the AKS node pool to the patched version, rebuild the model image from a patched base image, and use a blue/green deployment strategy to validate the new image before shifting traffic.
   • DDelete the existing AKS cluster and recreate it with the latest version, then redeploy the model using the same old image.
   Reveal Solution Discussion Select an answer first