Secure AI Deployment Environments CY0-001 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A healthcare organization is deploying an AI model that processes patient records. The model is hosted in a cloud environment, and the organization must comply with data protection regulations that require personal health information to be encrypted both in transit and at rest. The organization also wants to ensure that the encryption keys are managed by their own security team, not the cloud provider. Which configuration BEST meets these requirements?

   • AImplement a network access control list (ACL) that only allows traffic from the organization's IP range, and rely on the cloud provider's physical security for data protection.
   • BUse a VPN tunnel for all traffic and rely on the cloud provider's default encryption for data at rest.
   • CEncrypt the data before sending it to the cloud using the organization's own encryption algorithm, and store the decryption key on the same server as the model.
   • DEnable TLS for all network communications and use server-side encryption with customer-managed keys stored in the organization's own key management system.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which practice is part of secure configuration management?

   • AAllowing unrestricted access to configuration files
   • BDisabling all security logs
   • CDocumenting and approving all configuration changes
   • DUsing default passwords for all services
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A data science team is working on a new AI model in a shared development environment. The team wants to ensure that only the lead data scientist can deploy the model to production, while other team members can only view the model's code and data. Which access control mechanism is BEST suited for this requirement?

   • ARole-based access control (RBAC) with roles such as 'Data Scientist' (view) and 'Lead Data Scientist' (deploy).
   • BDiscretionary access control (DAC) where each data scientist can set permissions on the model files.
   • CMandatory access control (MAC) with security labels on the model, but allow all data scientists to change the labels.
   • DAttribute-based access control (ABAC) that grants access based on the time of day and the user's department.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of an incident response plan for an AI deployment environment?

   • ATo automatically patch vulnerabilities
   • BTo prevent all security incidents from occurring
   • CTo provide a structured approach to detect, respond to, and recover from security incidents
   • DTo replace the need for monitoring
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial services firm is deploying a customer-facing AI chatbot that uses a proprietary recommendation model. The model was trained on sensitive customer data, and the firm must ensure that the development team's experimental changes cannot affect the production environment. The team also needs to restrict access to the production model to only the senior data scientists. Which two actions together BEST satisfy these requirements?

   • AEncrypt the model artifacts with a customer-managed key and store the key in a hardware security module (HSM) accessible to all developers.
   • BDeploy the model to a separate production environment with network isolation from development, and configure RBAC so only the senior data scientists have write access to the production model registry.
   • CImplement a continuous integration/continuous deployment (CI/CD) pipeline that automatically deploys every code change to production, and rely on audit logs to detect unauthorized changes.
   • DUse the same environment for development and production to ensure consistency, but add a firewall rule that blocks all inbound traffic to the model server.
   Reveal Solution Discussion Select an answer first