A is incorrect: Expanding risk tolerance to accommodate degraded performance contradicts sound risk management practice. The NIST AI RMF establishes that risk tolerances should be based on organizational priorities, potential impacts, and regulatory requirements, not adjusted to avoid addressing identified risks. Changing tolerance levels to match declining performance would increase organizational risk exposure rather than manage it effectively. Reference: https://airc.nist.gov/airmf-resources/playbook/manage/

B is correct: Deactivating or decommissioning the AI system is the correct answer. According to the NIST AI RMF Manage function, when impending risk is detected during continual monitoring and feasible mitigation cannot be identified or implemented in a timely fashion, disengaging, deactivating, or decommissioning the AI system may be necessary. This prevents negative impacts while the organization evaluates remediation or replacement options. Reference: https://airc.nist.gov/airmf-resources/playbook/manage/

C is incorrect: Suspending measurement activities during a period of performance degradation reduces visibility into the AI system's risk profile at a critical time. The NIST AI RMF emphasizes that measurement should continue throughout the AI lifecycle, especially during periods of instability. Pausing measurement prevents the organization from understanding the scope and severity of the risk and delays appropriate treatment decisions. Reference: https://airc.nist.gov/airmf-resources/playbook/manage/

D is incorrect: Reducing monitoring resources during active performance degradation diminishes the organization's ability to track the evolving risk. While the NIST AI RMF emphasizes that the Map function should be applied iteratively as context changes, diverting resources away from monitoring during an impending risk does not address the immediate threat. The Manage function's risk treatment procedures should take priority. Reference: https://airc.nist.gov/airmf-resources/playbook/manage/

A is incorrect: Rotating API tokens on a regular schedule is a sound security practice that limits the window of exposure for any compromised credential. However, if the rotated tokens are still stored in plaintext within configuration files, the fundamental vulnerability remains unaddressed. Rotation without changing the insecure storage method does not remediate the core audit finding of plaintext secret storage in the pipeline. Reference: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html

B is correct: Storing tokens in a centralized secrets manager and retrieving them dynamically at pipeline runtime is the most appropriate remediation. This approach removes secrets from configuration files entirely, provides centralized access control and audit logging, and ensures secrets are only available to authorized pipeline processes at execution time. OWASP best practices for CI/CD secrets management recommend using dedicated solutions such as HashiCorp Vault or cloud-native secrets managers rather than storing credentials in pipeline configuration files. Reference: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html

C is incorrect: Restricting the CI/CD repository to read-only access for non-administrators reduces the number of users who can modify the plaintext tokens, but does not address the fundamental issue of storing secrets in configuration files. Administrators and automated pipeline processes still have access to the exposed tokens, and the credentials remain vulnerable to exposure through repository clones, backup systems, or pipeline execution logs. Reference: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html

D is incorrect: Encoding API tokens with Base64 does not provide any meaningful security protection. Base64 is a reversible encoding scheme, not an encryption method, and can be trivially decoded by anyone who encounters the encoded value. This approach creates a false sense of security while leaving the tokens effectively exposed in the configuration files, failing to address the root cause of the plaintext storage vulnerability identified in the audit. Reference: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html

A is incorrect: A threat modeling report identifies potential security threats, attack surfaces, and vulnerabilities in a system's architecture and design. While useful for understanding risks facing AI systems, it focuses on analyzing adversary capabilities and attack vectors rather than providing a structured inventory of AI components and their provenance for supply chain visibility.

B is correct: An AI Bill of Materials (AIBOM) is the correct answer. AIBOM extends the traditional software bill of materials concept to provide transparency into how AI models are built, trained, and deployed. It documents AI-specific components including ML frameworks, pre-trained model origins, training datasets, fine-tuning parameters, and data provenance information. This enables organizations to track all dependencies, assess supply chain risks, and maintain an accurate record of the AI system's complete component lineage. Reference: https://owasp.org/www-project-aibom/

C is incorrect: A model card provides documentation about a single AI model's intended use, performance metrics, evaluation results, and known limitations. While model cards are valuable for transparency about individual model behavior and fairness considerations, they do not provide a comprehensive inventory of all components, third-party dependencies, and datasets used across the organization's AI supply chain.

D is incorrect: A data classification policy defines how an organization categorizes and handles data based on sensitivity levels such as public, internal, confidential, and restricted. While important for data governance and protection, it does not provide a structured component inventory documenting AI-specific artifacts, their origins, or supply chain relationships.

A is incorrect: An action from a geographic location that is highly unusual compared to peer group behavior would typically result in a high anomaly score, not a low one. UEBA compares geolocation attributes against both the entity's own baseline and the peer group baseline. If the location is unusual for the peer group, the anomaly score reflects that significant deviation. This scenario does not match the low anomaly score described in the question.

B is correct: This is the correct explanation for a high investigation priority score with a low anomaly score. UEBA provides two scores for layered detection. The investigation priority score is high because a first-time event for an individual entity warrants attention. However, the anomaly score is low because the UEBA engine compares the activity against organizational and peer group baselines and determines that occasional first-time actions of this type are common and not inherently risky. These dual scores help security teams differentiate between events that are new to an entity versus events that are truly unusual in organizational context.

C is incorrect: Expected daily tasks during normal hours from a typical workstation would result in both a low investigation priority score and a low anomaly score, since nothing deviates from the entity's established behavioral baseline. This routine activity would not trigger a high investigation priority score because there is no first-time or unusual element to warrant investigation, which contradicts the high investigation priority described in the question.

D is incorrect: Repeated failed authentications that exceed both the individual and peer group behavioral baselines would generate elevated anomaly scores because the activity represents a significant statistical deviation from established patterns. This pattern is associated with credential-based attacks like brute force or password spraying and would typically result in both a high investigation priority and a high anomaly score, not the low anomaly score described in the question.

A is incorrect: Network segmentation isolates the registry at the network level but does not control which authenticated users or automated pipelines can promote models to production within the registry. An authorized user with excessive privileges accessing the registry through an approved network path could still promote untested or unauthorized models. Authorization controls within the registry itself are required. Reference: https://cheatsheetseries.owasp.org/cheatsheets/CI_CD_Security_Cheat_Sheet.html

B is incorrect: Multifactor authentication for development notebook access strengthens identity verification during development activities but does not address the specific risk of unauthorized model promotion within the registry. MFA improves authentication but must be paired with granular authorization controls that restrict which actions users can perform on model artifacts at each stage of the deployment lifecycle. Reference: https://cheatsheetseries.owasp.org/cheatsheets/CI_CD_Security_Cheat_Sheet.html

C is incorrect: Encryption at rest protects the confidentiality of stored model artifacts by preventing unauthorized access to data on disk. However, encryption does not control which users or systems are authorized to promote models from staging to production. An encrypted model artifact can still be promoted to production by any user with write access if proper role-based promotion controls and approval workflows are not enforced. Reference: https://cheatsheetseries.owasp.org/cheatsheets/Secure_AI_Model_Ops_Cheat_Sheet.html

D is correct: Enforcing role-based access with mandatory approval gates is the most appropriate control for preventing unauthorized model promotion. RBAC ensures that only authorized roles can transition models from staging to production, while approval gates add a required human review step that validates model readiness and security compliance. This approach provides standardized model approval and deployment processes across hybrid environments. Reference: https://cheatsheetseries.owasp.org/cheatsheets/Secure_AI_Model_Ops_Cheat_Sheet.html

A is correct: Membership inference attack is correct. A membership inference attack determines whether a specific data record was part of the model's training dataset by exploiting differences in how the model responds to training data versus unseen data. The described behavior of submitting records similar to training data and systematically analyzing prediction confidence levels is a characteristic pattern of membership inference, where higher confidence scores typically indicate training set membership. Inference runtime anomaly detection is essential for identifying these suspicious query patterns.

B is incorrect: Adversarial evasion attacks craft inputs designed to cause the model to misclassify data at inference time, such as adding imperceptible perturbations to images. The attacker's goal in an evasion attack is to fool the model into producing incorrect predictions, not to analyze confidence score patterns to determine training data membership. The described behavior of systematically recording confidence levels for training-like samples does not align with evasion attack objectives.

C is incorrect: Training data poisoning involves an attacker corrupting or manipulating the dataset used to train the model, which occurs during the training phase rather than at inference time. The scenario describes suspicious query behavior against a deployed model's API, not unauthorized modification of training data. The attacker is analyzing model outputs through legitimate queries, which is an inference-time privacy attack, not a training-time integrity attack.

D is incorrect: Model backdoor attacks involve triggers that were planted during the training phase and activate under specific input conditions at inference time to produce attacker-controlled outputs. The scenario describes a user analyzing the model's confidence behavior across multiple queries rather than submitting specific trigger patterns to activate hidden functionality. Backdoor activation follows a trigger-response pattern, not the systematic confidence analysis pattern described.

A is incorrect: Rate limiting controls the volume and frequency of API requests to prevent abuse or denial-of-service conditions. While rate limiting can mitigate certain automated attacks, it does not address the fundamental issue of a user having inappropriately elevated permissions in the CI/CD pipeline. The user would still be able to execute unauthorized deployment actions within whatever rate limits are configured.

B is incorrect: Encrypting data in transit protects the confidentiality and integrity of data moving between systems, preventing eavesdropping and tampering during transmission. However, encryption does not address the access control inconsistency that allowed the user to perform unauthorized deployment actions. The vulnerability is caused by mismatched permission levels across integrated tools, not by insecure data transfers between them.

C is correct: Enforcing consistent RBAC policies across all integrated MLOps tools is the correct approach. Cross-tool access exploitation occurs when adversaries exploit differences in access controls across multiple MLOps tools. A user may have limited permissions in one system but elevated access in another, enabling indirect manipulation of protected resources. Consistent RBAC enforcement across all tools combined with regular cross-tool permission audits ensures that access boundaries are uniformly maintained throughout the environment.

D is incorrect: A web application firewall inspects and filters HTTP traffic to protect against common web-based attacks such as injection and cross-site scripting. However, the described vulnerability is an access control misconfiguration across integrated MLOps tools, not a web-layer attack. A WAF would not detect or prevent a user from leveraging legitimate but excessive CI/CD permissions to modify production model deployments.

A is incorrect: The Restricted Pod Security Standard enforces runtime security controls such as non-root execution, read-only root filesystems, and privilege escalation prevention. However, it does not verify the origin or authenticity of container images being deployed. An unauthorized container image could comply with all Restricted policy requirements while still containing compromised AI model code or backdoors. Reference: https://kubernetes.io/docs/concepts/security/pod-security-standards/

B is incorrect: Vulnerability scanning identifies known security weaknesses in container images but does not verify that an image was built by the approved CI/CD pipeline. An attacker could create a malicious container image with no known vulnerabilities that would pass scanning but was not built through the authorized pipeline. Image scanning and image signing address different supply chain security concerns. Reference: https://kubernetes.io/docs/concepts/security/

C is correct: Signing container images with a tool such as Cosign during the CI/CD build process creates a cryptographic proof of the image origin and integrity. Deploying an admission controller such as Kyverno or the Sigstore policy-controller that validates these signatures before allowing pods to run ensures that only images built and signed by the approved pipeline are permitted. This approach enforces supply chain integrity for AI model containers at the Kubernetes API admission point. Reference: https://kubernetes.io/docs/tasks/administer-cluster/verify-signed-artifacts/

D is incorrect: While restricting registry push access to specific IP addresses reduces the risk of unauthorized images being uploaded to the registry, it does not prevent unauthorized images already in the registry from being deployed to the cluster. An attacker who gains registry access or modifies an existing image could still deploy it. This approach secures the image push path but does not verify image authenticity at deployment time. Reference: https://docs.docker.com/engine/security/trust/

A is correct: Indirect prompt injection is the correct answer. This attack occurs when an adversary embeds malicious instructions within external content that a large language model processes, such as emails, documents, or web pages. Unlike direct prompt injection where the attacker interacts with the model directly, indirect prompt injection exploits the model through the data it consumes, causing it to execute unintended actions without the user's knowledge or interaction. Reference: https://genai.owasp.org/llmrisk/llm01-prompt-injection/

B is incorrect: Training data poisoning involves corrupting the data used to train a model before or during its training phase, embedding malicious patterns that influence its future behavior. In this scenario, the attack occurs at inference time through malicious content in an email, not during the model's training process. The model's underlying training data and learned weights are not being modified.

C is incorrect: Direct prompt injection, also known as jailbreaking, occurs when a user directly provides crafted inputs to the model to override its system instructions or bypass safety guardrails. In this scenario, the malicious instructions are embedded in external email content processed by the model, not entered directly by the user. The attack vector is the external data source, not the user's own prompt. Reference: https://genai.owasp.org/llmrisk/llm01-prompt-injection/

D is incorrect: Model extraction is an attack that attempts to steal or replicate a model's architecture, parameters, or functionality by systematically querying the model and analyzing its responses. This scenario describes an attempt to manipulate the model's output behavior through embedded instructions in external content, not an effort to copy or reverse-engineer the model itself.

A is correct: According to the NIST glossary, an attribute inference attack is an attack against machine learning models that infers sensitive attributes of a training data record given partial knowledge about the record. The scenario precisely describes this attack: the adversary submits partial records with non-sensitive attributes and analyzes the model outputs to discover sensitive attribute values of individuals in the training data. Reference: https://csrc.nist.gov/glossary/term/attribute_inference_attacks

B is incorrect: A model extraction attack aims to replicate or steal the model's functionality by systematically querying it to approximate its parameters or decision boundaries. The described scenario focuses on inferring sensitive attributes of individuals in the training data rather than cloning the model. While both attacks involve querying the API, their objectives differ: model extraction targets model functionality, while attribute inference targets individual privacy. Reference: https://csrc.nist.gov/pubs/ai/100/2/e2025/final

C is incorrect: An adversarial evasion attack crafts inputs designed to cause the model to produce incorrect predictions, such as adding imperceptible perturbations to cause misclassification. The scenario describes an attacker analyzing model outputs to learn sensitive information about individuals in the training data, not attempting to cause misclassification. Evasion attacks target model accuracy, while attribute inference attacks target data privacy. Reference: https://csrc.nist.gov/pubs/ai/100/2/e2025/final

D is incorrect: A prompt injection attack involves embedding malicious instructions within inputs to manipulate a generative AI model into producing unauthorized or harmful outputs. The described scenario involves analyzing model outputs to infer sensitive attributes from structured data queries against a classification model, which is a privacy attack on the inference layer rather than an attempt to hijack instruction-following behavior. Reference: https://csrc.nist.gov/pubs/ai/100/2/e2025/final