Misconfigured Cloud AI Services (AWS Bedrock, Azure OpenAI, Google Vertex AI) COASP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company uses Azure OpenAI for a chatbot. The API key is stored in the application's source code, which is committed to a private GitHub repository. What is the best practice to secure the key?

   • ARotate the key every 24 hours.
   • BUse Azure Key Vault to store the key and reference it from the application.
   • CRestrict the key to the application's IP address.
   • DUse a custom header to hide the key in the source code.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An organization uses AWS Bedrock and wants to ensure that the service is only accessible from within their VPC. They have already configured a VPC endpoint for Bedrock. What additional configuration should they implement to enforce this requirement?

   • AEnable CloudTrail logging for Bedrock.
   • BAdd a condition to the IAM policy that denies access unless the request originates from the VPC endpoint.
   • CCreate a new IAM role for the application.
   • DRotate the API keys used by the application.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A healthcare company uses Google Vertex AI to train a model on patient data. The data is stored in a Cloud Storage bucket that is publicly accessible. The company wants to ensure that the data is only accessible to the Vertex AI service account and the data science team. What should they do?

   • ARemove public access and grant the Vertex AI service account and the data science team IAM roles on the bucket.
   • BUse a signed URL for the Vertex AI service to access the data.
   • CEncrypt the bucket with a customer-managed key and disable public access.
   • DEnable VPC Service Controls and add the bucket to a service perimeter.
   Reveal Solution Discussion Select an answer first
5. 29foundation · medium

   Which logging gap in Google Vertex AI could allow malicious activities to go unnoticed?

   • AEnabling data access logs for Vertex AI.
   • BSetting up alerts for unusual API activity.
   • CDisabling audit logs for Vertex AI API calls.
   • DConfiguring log sinks to export logs to a SIEM.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security architect is designing a secure AWS Bedrock deployment. The application team wants to invoke models from an on-premises data center via a VPN, and the security team requires that no traffic traverse the public internet. The architect has already configured a VPC endpoint for Bedrock. What additional configuration is required to meet both requirements?

   • ACreate a new IAM role for the on-premises application and attach the existing policy.
   • BEnable CloudTrail logging for Bedrock and create a CloudWatch alarm for unusual activity.
   • CConfigure the IAM policy to allow `bedrock:InvokeModel` only when the request originates from the VPC endpoint, and ensure the on-premises network routes through the VPN to the VPC.
   • DUse AWS PrivateLink to expose the Bedrock endpoint to the on-premises network directly.
   Reveal Solution Discussion Select an answer first