An organization uses Azure OpenAI to process sensitive documents. The security team finds that the Azure OpenAI resource allows both key-based and Azure AD authentication, and the resource is accessible from all networks. They want to enforce a single, more secure authentication method and restrict network access. Which combination of actions should they take?

Enable Azure AD authentication and leave key-based auth enabled for fallback.

Regenerate the keys and rotate them monthly, while keeping network access open to all networks.

Disable key-based authentication and enable Azure AD authentication, then disable public network access and configure a private endpoint.

Use a network security group to restrict access to the Azure OpenAI endpoint.

A company uses Google Vertex AI for a model that is accessed by multiple teams. The security team discovers that the model endpoint is publicly accessible and that there is no logging enabled. What is the most immediate risk?

Unauthorized users can invoke the model and incur costs.

The model will be slower because of public access.

The model's training data will be exposed.

The model will be automatically deleted by Google.

Which configuration aligns with security best practices for a cloud AI service?

Allowing all IP addresses to access the AI service.

Disabling audit logs to save storage costs.

Storing API keys in the source code for convenience.

Using a private endpoint to access the AI service.

A company uses Google Vertex AI and wants to implement security best practices. They currently use a user-managed service account with broad permissions, and the endpoint is publicly accessible. Which set of actions aligns with least-privilege and network security best practices?

Use the default compute engine service account and enable VPC Service Controls.

Rotate the service account keys and keep the endpoint public.

Enable Cloud Audit Logs and rely on monitoring to detect issues.

Create a least-privilege service account for Vertex AI and enable Private Service Connect for the endpoint.

Which of the following is a common misconfiguration in Azure OpenAI that could lead to data leakage?

Setting the content filter to the default 'Low' severity level.

Enabling network access only from selected virtual networks.

Leaving the 'Enable public network access' option set to 'All networks'.

Using Azure AD authentication for the OpenAI resource.

EC-CouncilCertified Offensive AI Security Professional

Domain 6Objective 4

Misconfigured Cloud AI Services (AWS Bedrock, Azure OpenAI, Google Vertex AI) COASP Practice Questions (Page 1)

Part of the AI Infrastructure and Supply Chain Attacks domain, which makes up ~13% of our current practice bank.

34questions here

7free pages

6concepts

6 Concepts in This Objective

Identify misconfigured cloud AI services
Assess access control and authentication settings
Review network exposure and endpoint security
Inspect data storage and privacy configurations
Detect logging and monitoring gaps
Apply security best practices for cloud AI

Questions 1–5

1application · medium
An organization uses Azure OpenAI to process sensitive documents. The security team finds that the Azure OpenAI resource allows both key-based and Azure AD authentication, and the resource is accessible from all networks. They want to enforce a single, more secure authentication method and restrict network access. Which combination of actions should they take?
Select an answer first
2application · medium
A company uses Google Vertex AI for a model that is accessed by multiple teams. The security team discovers that the model endpoint is publicly accessible and that there is no logging enabled. What is the most immediate risk?
Select an answer first
3foundation · medium
Which configuration aligns with security best practices for a cloud AI service?
Select an answer first
4application · medium
A company uses Google Vertex AI and wants to implement security best practices. They currently use a user-managed service account with broad permissions, and the endpoint is publicly accessible. Which set of actions aligns with least-privilege and network security best practices?
Select an answer first
5foundation · medium
Which of the following is a common misconfiguration in Azure OpenAI that could lead to data leakage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to COASP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “COASP” is a trademark of its owner, used for identification only.