Misconfigured Cloud AI Services (AWS Bedrock, Azure OpenAI, Google Vertex AI) COASP Practice Questions (Page 7)

Questions 31–34

1. 31expert · hard

   A company uses Google Vertex AI and has a requirement to allow only authenticated users from a specific Google Cloud project to access the service. The current configuration uses an IAM policy that allows all authenticated users to access Vertex AI. The security team wants to enforce the project restriction. Which action should they take?

   • AEnable VPC Service Controls to restrict access to the project's VPC.
   • BEnable Cloud Audit Logs to monitor access.
   • CCreate a new service account and grant it access to Vertex AI.
   • DModify the IAM policy to include a condition that restricts access to users from the specific project.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A healthcare organization uses Azure OpenAI to process patient data. The compliance team requires that all data be encrypted at rest and in transit, and that access to the service be restricted to a specific virtual network. The organization also needs to audit all requests to the service. Which combination of configurations meets all requirements?

   • AUse a service endpoint and enable diagnostic logging.
   • BDisable public network access and rely on Azure's default encryption.
   • CEnable Azure AD authentication and rely on Azure Policy for auditing.
   • DEnable a private endpoint, configure the service to use customer-managed keys (CMK), and enable diagnostic logging.
   Reveal Solution Discussion Select an answer first
4. 33foundation · medium

   In Google Vertex AI, what indicates that an endpoint is publicly accessible?

   • AThe endpoint is only accessible from within a VPC.
   • BThe endpoint has no firewall rules restricting access.
   • CThe endpoint is configured with a private service connection.
   • DThe endpoint uses a shared VPC.
   Reveal Solution Discussion Select an answer first
5. 34foundation · medium

   In Google Vertex AI, which authentication setting is considered overly permissive?

   • AUsing API keys with restrictions to allowed IP addresses.
   • BUsing a service account with the 'Vertex AI User' role.
   • CGranting a service account the 'Owner' role on the project.
   • DEnabling OAuth 2.0 for end-user authentication.
   Reveal Solution Discussion Select an answer first