Misconfigured Cloud AI Services (AWS Bedrock, Azure OpenAI, Google Vertex AI) COASP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   In Azure OpenAI, what is a monitoring gap that could allow unauthorized access to go undetected?

   • AEnabling diagnostic settings to send logs to a Log Analytics workspace.
   • BNot enabling diagnostic settings for the OpenAI resource.
   • CUsing Azure Monitor to track API usage.
   • DSetting up alerts for failed authentication attempts.
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   A security auditor is reviewing an AWS Bedrock deployment. Which configuration is a common misconfiguration that could expose the AI service to unauthorized access?

   • AThe Bedrock model is deployed in a VPC with no public internet access.
   • BThe Bedrock model has CloudWatch logging enabled for all invocations.
   • CThe Bedrock model invocation is restricted to a specific IAM role.
   • DThe Bedrock endpoint is configured with a resource-based policy that allows all principals ('*') to invoke the model.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company uses Google Vertex AI to process PII. The data is stored in a Cloud Storage bucket with no lifecycle policy, and the bucket is in the same project as the Vertex AI service. The security team wants to ensure that data is not retained indefinitely and that access is logged. Which action should they take?

   • AEnable customer-managed encryption keys (CMEK) on the bucket.
   • BApply a VPC Service Controls perimeter to the bucket.
   • CEnable uniform bucket-level access to prevent per-object ACLs.
   • DAdd a lifecycle rule to delete objects after a defined period and enable Cloud Audit Logs for data access.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A developer created a Google Vertex AI endpoint for a demo and left it publicly accessible. The endpoint uses a default service account with broad permissions, and no audit logs are enabled. The security team wants to remediate the misconfiguration. Which action should they take?

   • AUse the default service account and enable Cloud Audit Logs.
   • BRotate the service account keys and enable Cloud Audit Logs.
   • CRestrict the endpoint to a private network, create a least-privilege service account, and enable Cloud Audit Logs.
   • DEnable VPC Service Controls and keep the endpoint public.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company uses AWS Bedrock for a model that is accessed by multiple teams. The security team wants to implement least-privilege access while ensuring that the model can be invoked from a specific VPC. What is the most effective configuration?

   • AUse a resource-based policy on the Bedrock model that allows only the VPC's security group.
   • BCreate an IAM policy that allows 'bedrock:InvokeModel' on the specific model ARN and attach it to a role that is assumed by the VPC's resources.
   • CUse an IAM policy that allows 'bedrock:InvokeModel' on all models and restrict access to the VPC's IP range.
   • DCreate a VPC endpoint for Bedrock and allow all IAM roles to invoke the model.
   Reveal Solution Discussion Select an answer first