Misconfigured Cloud AI Services (AWS Bedrock, Azure OpenAI, Google Vertex AI) COASP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company uses Google Vertex AI for a model that processes personal data. The data is stored in a Cloud Storage bucket with no encryption enabled. What is the most important security measure to implement?

   • ASet a retention policy on the bucket.
   • BEnable VPC Service Controls for the bucket.
   • CRestrict access to the bucket using IAM roles.
   • DEnable encryption at rest for the bucket using Google-managed or customer-managed keys.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company uses AWS Bedrock to generate marketing content. The security team discovers that model invocation logs are not being sent to CloudTrail, and there are no alerts for unusual invocation patterns. Which action would best address the logging and monitoring gap?

   • ARotate the API keys used by the application to invoke Bedrock.
   • BEnable AWS Config rules to detect public access to the Bedrock endpoint.
   • CApply a resource-based policy to the Bedrock model to restrict invocation to specific IAM roles.
   • DEnable CloudTrail data events for Bedrock and create a CloudWatch alarm for high invocation rates.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An organization uses Azure OpenAI to power an internal chatbot. The Azure OpenAI endpoint is currently enabled for all networks, and the API key is embedded in a client-side web application. The security team wants to restrict access to the organization's virtual network only. Which action should they take?

   • ARegenerate the API key and store it in Azure Key Vault.
   • BDisable public network access and configure a private endpoint for the Azure OpenAI service.
   • CEnable Azure AD authentication for the Azure OpenAI service and disable key-based auth.
   • DAdd a network security group rule to block inbound traffic on port 443 from the internet.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company uses Azure OpenAI for a public-facing application. The security team wants to monitor for potential abuse, such as excessive usage or unusual patterns. What is the most effective way to achieve this?

   • AEnable Azure Security Center's recommendations for OpenAI.
   • BUse Azure Activity Log to review all API calls.
   • CEnable Azure Monitor and create alerts on the 'Total Tokens' and 'Calls' metrics.
   • DUse Azure Policy to enforce a maximum token limit.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company uses AWS Bedrock for a confidential model. The security team wants to ensure that only the VPC can access the Bedrock endpoint. What is the correct configuration?

   • AUse a NAT gateway to route traffic to Bedrock.
   • BCreate a VPC endpoint for Bedrock and attach a security group that allows traffic only from the VPC.
   • CUse an IAM policy that restricts access to the VPC's IP range.
   • DEnable AWS WAF on the Bedrock endpoint.
   Reveal Solution Discussion Select an answer first