AI Security Architecture and Design AAISM Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is integrating an AI-powered image recognition service into its mobile app. The service is hosted on a cloud platform and accessed via an API. The security team is concerned about attackers sending malicious images to the API to cause the model to misclassify or crash. Which control is most important to implement?

   • AEncrypt all communication between the app and the API.
   • BImplement rate limiting on the API.
   • CUse a firewall to restrict access to the API.
   • DValidate and sanitize all image inputs before they are processed by the model.
   Reveal Solution Discussion Select an answer first
2. 17foundation · medium

   In the context of secure AI architecture, which principle requires that users and processes be granted only the minimum level of access necessary to perform their functions?

   • ASecure-by-design
   • BLeast privilege
   • CDefense-in-depth
   • DSeparation of duties
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has deployed an AI model that predicts credit risk. The model is accessed via an API, and the company has noticed that some users are querying the model with many similar requests, which could indicate an attempt to extract the model's training data. The company also needs to ensure that legitimate users are not affected. Which control is most effective in this situation?

   • AImplement rate limiting and anomaly detection on API requests.
   • BEncrypt the model file and store it in a secure vault.
   • CAdd noise to the model's outputs to prevent exact reconstruction.
   • DRestrict access to the API to a whitelist of IP addresses.
   Reveal Solution Discussion Select an answer first
5. 19foundation · medium

   Which security objective for an AI data pipeline ensures that data is not altered or tampered with during collection, storage, or processing?

   • AConfidentiality
   • BIntegrity
   • CNon-repudiation
   • DAvailability
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An e-commerce company is building a recommendation engine that uses customer purchase history. The data pipeline ingests data from multiple sources, including third-party data providers. The security team requires that the data remain confidential and unaltered from ingestion to model training. Which combination of controls best meets this requirement?

   • AUse a VPN for all data transfers and restrict access to the data pipeline to authorized personnel only.
   • BEncrypt data in transit and at rest, and use cryptographic hashes to verify data integrity at each stage.
   • CImplement strong authentication for all data sources and use a firewall to protect the pipeline network.
   • DAnonymize all data before ingestion and store it in a separate database from the production system.
   Reveal Solution Discussion Select an answer first