AI Security Architecture and Design AAISM Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company has deployed an AI model that predicts customer churn. The model is used by the sales team through a web application. The security team wants to ensure that only authorized sales personnel can access the model and that the model is not misused. Which control is most appropriate?

   • AUse a VPN for all access to the web application.
   • BImplement rate limiting on the web application.
   • CEncrypt the model file and store it in a secure location.
   • DImplement role-based access control (RBAC) for the web application.
   Reveal Solution Discussion Select an answer first
2. 22foundation · medium

   Which security control is used to protect the API endpoints that expose an AI model's inference capabilities to external applications?

   • AFeature scaling
   • BModel retraining
   • CAPI authentication and authorization
   • DData anonymization
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is designing a secure AI architecture for a new product. The product will use a large language model to generate responses to user queries. The company wants to ensure that the model is not vulnerable to adversarial attacks that could cause it to generate harmful content. Which principle should be applied during the design phase?

   • ALeast privilege: restrict access to the model to only authorized users.
   • BData minimization: collect only the data necessary for the model.
   • CSecure-by-design: incorporate security considerations into the architecture from the beginning.
   • DDefense-in-depth: implement multiple layers of security controls.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is threat modeling an AI system that uses a public dataset for training. The team is concerned that an attacker could insert malicious data into the dataset to cause the model to misclassify certain inputs. Which threat is this, and what is the most appropriate control?

   • APrompt injection; implement input sanitization.
   • BAdversarial attack; implement adversarial training.
   • CData poisoning; implement data provenance and integrity checks.
   • DModel inversion; implement differential privacy.
   Reveal Solution Discussion Select an answer first
6. 25foundation · medium

   Which activity is typically part of an AI security architecture review?

   • ATuning hyperparameters to improve model accuracy
   • BComparing the architecture against regulatory requirements such as GDPR or HIPAA
   • CWriting application code for the AI model
   • DSelecting the best cloud provider for cost savings
   Reveal Solution Discussion Select an answer first