Misconfigured Cloud AI Services (AWS Bedrock, Azure OpenAI, Google Vertex AI) COASP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A data science team uses Google Vertex AI to train a model on customer data. The training data is stored in a Cloud Storage bucket that is publicly readable, and the Vertex AI pipeline uses a custom service account with broad permissions. The compliance team requires that training data be encrypted and access restricted to the project. Which action should be taken first?

   • AEnable customer-managed encryption keys (CMEK) on the Cloud Storage bucket.
   • BCreate a new service account with minimal permissions and attach it to the Vertex AI pipeline.
   • CRemove public access from the Cloud Storage bucket and apply a VPC Service Controls perimeter.
   • DEnable Data Loss Prevention (DLP) inspection on the bucket to identify sensitive data.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company uses Google Vertex AI for a text generation model. They notice that the model's training data is stored in a Cloud Storage bucket with 'allUsers' as a member. What is the most likely risk?

   • AThe model will be slower because of public access.
   • BThe model will be publicly accessible for inference.
   • CUnauthorized users can access and download the training data.
   • DThe bucket will be automatically deleted by Google.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is investigating a potential data breach involving an Azure OpenAI service. The service has a private endpoint configured, but the team cannot determine who accessed the service or what prompts were submitted. The diagnostic settings for the service are not configured. Which action should the team take to enable the necessary audit trail?

   • AEnable Network Security Group flow logs for the private endpoint.
   • BEnable Azure Activity Logs for the resource.
   • CEnable diagnostic settings for the Azure OpenAI service to send logs to a Log Analytics workspace.
   • DEnable Azure AD sign-in logs to see who authenticated.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company uses Google Vertex AI for a model that processes customer data. The data is stored in a Cloud Storage bucket with a retention policy of 30 days. The company wants to ensure that the data is not accessible after the retention period. What should they do?

   • AEncrypt the bucket with a customer-managed key and rotate it every 30 days.
   • BUse IAM conditions to restrict access after 30 days.
   • CUse a signed URL with a 30-day expiration.
   • DEnable object versioning and set a lifecycle rule to delete objects after 30 days.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company uses Google Vertex AI to run batch predictions. The prediction output is stored in a Cloud Storage bucket with uniform bucket-level access disabled, and the bucket has a lifecycle rule that deletes objects after 30 days. The security team wants to ensure that prediction outputs are not publicly accessible and that access is audited. Which action should they take?

   • AEnable uniform bucket-level access on the bucket and enable Cloud Audit Logs for data access.
   • BRemove the lifecycle rule to prevent data deletion.
   • CApply a VPC Service Controls perimeter to the bucket.
   • DEnable customer-managed encryption keys (CMEK) on the bucket.
   Reveal Solution Discussion Select an answer first