A company uses AWS Bedrock for a model that handles sensitive data. The security team wants to ensure that the data is encrypted at rest and in transit. What is the correct configuration?

Use a VPC endpoint and a security group to restrict access.

Enable AWS KMS encryption for the Bedrock model and use TLS for API calls.

Enable AWS CloudTrail to log all API calls.

Use an IAM role with least-privilege permissions.

A company uses AWS Bedrock for a production application. The security team is concerned about unauthorized use of the service. Which configuration would be most effective in detecting and alerting on suspicious activity?

Enable AWS Config rules to check for public access on Bedrock resources.

Enable VPC Flow Logs for the Bedrock VPC endpoint.

Enable AWS CloudTrail for Bedrock and configure CloudWatch Alarms on 'InvokeModel' API calls.

Use AWS Trusted Advisor to review Bedrock security checks.

In AWS Bedrock, which setting could lead to unintended exposure of training data?

Setting the S3 bucket policy to allow public read access.

Using a VPC endpoint to access the S3 bucket.

Configuring the S3 bucket to use versioning.

Enabling server-side encryption with AWS KMS for the model artifacts.

A developer created an Azure OpenAI resource for testing and left the endpoint publicly accessible with the default key. The resource is now used by a production application. The security team wants to identify and remediate the misconfiguration. Which action should they take?

Enable Azure AD authentication and disable key-based auth.

Disable public network access, regenerate the API key, and enable diagnostic logging.

Create a private endpoint and leave the public endpoint enabled for failover.

Use Azure Policy to audit the resource configuration.

Which practice is a recommended security best practice for cloud AI services?

Implementing least-privilege access for AI service permissions.

Using public endpoints for easy access.

Granting all users the 'Owner' role to simplify management.

Disabling logging to reduce costs.

EC-CouncilCertified Offensive AI Security Professional

Domain 6Objective 4

Misconfigured Cloud AI Services (AWS Bedrock, Azure OpenAI, Google Vertex AI) COASP Practice Questions (Page 5)

Part of the AI Infrastructure and Supply Chain Attacks domain, which makes up ~13% of our current practice bank.

34questions here

7free pages

6concepts

6 Concepts in This Objective

Identify misconfigured cloud AI services
Assess access control and authentication settings
Review network exposure and endpoint security
Inspect data storage and privacy configurations
Detect logging and monitoring gaps
Apply security best practices for cloud AI

Questions 21–25

21application · medium
A company uses AWS Bedrock for a model that handles sensitive data. The security team wants to ensure that the data is encrypted at rest and in transit. What is the correct configuration?
Select an answer first
22application · medium
A company uses AWS Bedrock for a production application. The security team is concerned about unauthorized use of the service. Which configuration would be most effective in detecting and alerting on suspicious activity?
Select an answer first
23foundation · medium
In AWS Bedrock, which setting could lead to unintended exposure of training data?
Select an answer first
24application · medium
A developer created an Azure OpenAI resource for testing and left the endpoint publicly accessible with the default key. The resource is now used by a production application. The security team wants to identify and remediate the misconfiguration. Which action should they take?
Select an answer first
25foundation · medium
Which practice is a recommended security best practice for cloud AI services?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to COASP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “COASP” is a trademark of its owner, used for identification only.