Task 4.2: Define secure AI and its importance in protecting AI systems from malicious attacks and misuse.

• AGoogle Cloud Armor

  Incorrect

  Cloud Armor is a network and web application security service; it does not interpret what a prompt asks the model to do.

• BIdentity and Access Management (IAM)

  Incorrect

  IAM controls who can call a resource; the attacker here is a legitimate chatbot user sending a malicious message.

• CSecurity Command Center

  Incorrect

  Security Command Center gives posture visibility and threat detection across Google Cloud; screening each chatbot message is Model Armor's job.

• DModel Armor

  Correct

  Model Armor screens prompts and responses, and one of its uses is blocking prompt injection and jailbreak attempts before they reach the LLM.

Prompt injection is an AI-specific attack, and Model Armor is the Google Cloud service built to screen prompts for it.

• AThe Secure AI Framework (SAIF) risk self-assessment

  Correct

  SAIF is Google's framework for securing AI systems, addressing AI/ML model risk management, security and privacy; its Risk Self Assessment helps organizations see which risks apply to them.

• BGoogle's AI Principles applied to each project

  Incorrect

  The AI Principles set out how Google develops and deploys AI boldly and responsibly; they are not a security risk assessment for a company's systems.

• CThe cost optimization pillar of the Well-Architected Framework

  Incorrect

  That pillar helps control the cost of AI workloads, not their security risks.

• DThe Gen AI evaluation service on Agent Platform

  Incorrect

  The evaluation service measures output quality against metrics; it does not map security risks to controls.

SAIF gives security teams a shared vocabulary for AI risks and maps them to controls across the AI lifecycle.

• AModel Armor templates applied to the endpoint

  Incorrect

  Model Armor does not decide which identities may call the endpoint.

• BCloud Audit Logs turned on for every service in the project

  Incorrect

  Audit logs are a record of activity, not a control; they do not prevent the access.

• CLeast-privilege IAM roles for that service's identity

  Correct

  IAM decides who can do what on which resource; granting the invoke permission only to the claims service's identity applies the principle of least privilege.

• DSecurity Command Center findings for the endpoint

  Incorrect

  Security Command Center surfaces misconfigurations and threats; the access rule itself is set in IAM.

Prevention starts with identity: grant the permission only to the identity that needs it.

• ADenial of ML service

  Incorrect

  Denial of service floods a model with requests to make it unavailable; editing the dataset is a different risk.

• BPrompt injection by end users

  Incorrect

  Prompt injection happens at runtime through user inputs, not through the tuning dataset.

• CData poisoning of the tuning data

  Correct

  Data poisoning is malicious or accidental change to training, tuning or evaluation data; broad edit access without tracking makes it hard to prevent or detect.

• DModel reverse engineering through the API

  Incorrect

  Reverse engineering probes a deployed model to copy it; the exposure here is in the data used to build it.

Securing AI starts before deployment: control and track access to the data that trains and tunes models.

• ACloud Armor security policies

  Incorrect

  Cloud Armor filters attacks such as DDoS and SQL injection against internet-facing services; it does not stop data leaving through Google APIs.

• BModel Armor templates

  Incorrect

  Model Armor screens prompt and response content; it does not draw a perimeter around storage and services.

• CVPC Service Controls

  Correct

  VPC Service Controls create isolation perimeters around cloud resources and sensitive data to prevent data exfiltration, including for AI platform services.

• DContent filters on the model

  Incorrect

  Content filters block harmful categories of generated text, not data movement.

Identity decides who may act; perimeters decide where data may go. Both matter for AI workloads.

• AAI Protection in Security Command Center

  Correct

  AI Protection in Security Command Center gives a view of AI security across the environment, assesses the AI asset inventory and helps detect threats and mitigate risks, including for agents.

• BModel Armor floor settings for each project

  Incorrect

  Model Armor screens prompts and responses for known applications; it does not discover unknown AI assets.

• CThe Agent Platform Model Registry

  Incorrect

  Model Registry lists the models a team registers itself; unregistered assets are exactly what the CISO cannot see.

• DCloud Armor

  Incorrect

  Cloud Armor protects web-facing services from attacks; it is not an AI inventory.

Security Command Center is the posture view; AI Protection extends it to AI workloads and agents.

• AVPC Service Controls around the data

  Incorrect

  Perimeters stop data from leaving; they do not find out which tables contain sensitive data.

• BSensitive Data Protection discovery

  Correct

  Sensitive Data Protection discovers, classifies and de-identifies sensitive data, and its discovery service profiles data assets across BigQuery, Cloud SQL and Cloud Storage.

• CIdentity and Access Management roles on each table

  Incorrect

  IAM controls who can access the data, not what the data contains.

• DGemini Enterprise analytics on data usage

  Incorrect

  Analytics reports on how employees use Gemini Enterprise; it does not scan data stores for sensitive data.

You can only protect sensitive data you know about; discovery comes before controls in the AI data lifecycle.

• AGoogle Cloud Armor

  Correct

  Cloud Armor protects Google Cloud deployments from threats such as distributed denial-of-service attacks; Google's SAIF guidance points to it against denial of ML service.

• BModel Armor

  Incorrect

  Model Armor inspects what prompts say, such as injection attempts; it is not built to absorb floods of requests.

• CSensitive Data Protection

  Incorrect

  Sensitive Data Protection finds and de-identifies sensitive data; it does not stop traffic floods.

• DCustomer-managed encryption keys

  Incorrect

  Encryption keys protect stored data; they do nothing against request floods.

AI services are still internet services: classic protections such as Cloud Armor defend availability while Model Armor defends content.