A is incorrect: Static rules that block specific departments from accessing specific resources are access control policies, not behavioral analytics. UEBA uses dynamic, machine-learning-built baselines that continuously learn from entity behavior over time rather than relying on manually configured static rules. This dynamic approach allows UEBA to detect subtle behavioral anomalies that static rules cannot capture.

B is incorrect: UEBA is a detective analytics platform, not a preventive enforcement tool. Blocking cross-departmental access is an access control function managed by identity and access management systems or data loss prevention tools. UEBA identifies anomalies by comparing behaviors against learned baselines and generates alerts for investigation rather than automatically blocking actions.

C is incorrect: UEBA does not use signature databases to identify insider threats. Signature-based detection relies on known indicators of compromise and attack patterns, which cannot identify novel or context-dependent anomalies. UEBA's strength lies in its machine-learning-driven behavioral baselines that dynamically adapt to each entity and their peers, detecting deviations that signatures would miss.

D is correct: UEBA detects anomalies based on dynamic baselines created for each entity. Each entity's baseline behavior is set according to its own historical activities, those of its peers, and those of the organization as a whole. The marketing user's behavior deviates from both their own typical patterns and those of their peer group, enabling UEBA to flag this as anomalous without relying on static rules or known attack signatures.

A is incorrect: Forwarding all raw telemetry to a SIEM for manual review does not address the efficiency challenge described in the scenario. With 15,000 endpoints generating large volumes of telemetry data, centralized manual review would overwhelm the security team without AI-driven prioritization. The EDR's built-in behavioral risk scoring automates prioritization more effectively than manual SIEM analysis.

B is correct: AI-driven behavioral risk scoring is the correct capability for this requirement. Behavioral risk scoring uses machine learning to analyze endpoint telemetry and assign risk scores based on the severity and frequency of observed behavioral anomalies. This enables the security team to efficiently prioritize investigation efforts by focusing on the highest-risk endpoints first, rather than manually reviewing all alerts across 15,000 endpoints.

C is incorrect: Increasing antivirus scan frequency relies on signature-based detection, which is limited to identifying known malware variants. This approach does not address the need to identify subtle behavioral anomalies indicative of advanced compromise. More frequent scanning does not improve detection of unknown threats and does not help prioritize which endpoints require immediate investigation.

D is incorrect: Network-based intrusion detection sensors monitor network traffic for suspicious patterns but do not provide the endpoint-level behavioral analysis needed to identify specifically which endpoints are compromised. The scenario requires endpoint-level telemetry analysis and prioritization, which is a function of the AI-augmented EDR rather than network perimeter detection sensors deployed at regional offices.

A is correct: Unified role-based access controls ensure that a user's permissions are consistent across all tools in the MLOps pipeline, preventing privilege escalation through cross-tool inconsistencies. By enforcing uniform access policies across data versioning, CI/CD platforms, model registries, and deployment tools, organizations eliminate the gaps that allow users to bypass restrictions in one system by exploiting elevated privileges in another.

B is incorrect: Encrypting model deployment artifacts protects the confidentiality and integrity of model files stored in the CI/CD repository. However, encryption does not control who can initiate or modify deployment workflows. The user would still be able to alter model deployments using their elevated CI/CD privileges regardless of whether the stored deployment artifacts are encrypted at rest.

C is incorrect: Multi-factor authentication strengthens identity verification for accessing the CI/CD platform but does not address the underlying issue of inconsistent permission levels across different MLOps tools. A user could successfully authenticate with MFA yet still retain elevated privileges in the CI/CD platform that exceed their intended access scope, allowing the same cross-tool privilege exploitation to continue.

D is incorrect: Network segmentation isolates the data versioning system from the CI/CD platform at the network layer but does not address user permission inconsistencies at the application level. The user's elevated privileges in the CI/CD platform are an access control issue, and network segmentation would not prevent an authenticated and authorized user from accessing that platform and manipulating deployments.

A is incorrect: Data poisoning involves injecting malicious or misleading data into training datasets to corrupt model behavior. While the developer could potentially exploit the CI/CD permissions gap to access data pipelines, the scenario specifically describes an access control inconsistency across tools rather than active data manipulation. The primary risk identified in the audit is the permission discrepancy, not confirmed data poisoning activity. Reference: https://cloudsecurityalliance.org/blog/2025/09/11/the-hidden-security-threats-lurking-in-your-machine-learning-pipeline

B is correct: Cross-tool access exploitation is the correct risk. This occurs when adversaries exploit differences in access controls across multiple MLOps tools to escalate privileges or perform unauthorized actions. The developer could leverage elevated CI/CD permissions to indirectly manipulate model deployments, bypassing the restricted data access. Consistent access controls must be enforced across all MLOps tools to prevent this attack. Reference: https://cloudsecurityalliance.org/blog/2025/09/11/the-hidden-security-threats-lurking-in-your-machine-learning-pipeline

C is incorrect: Adversarial input manipulation involves crafting specially modified inputs designed to mislead a model into producing incorrect predictions. This attack targets the inference layer of a deployed model and does not involve exploiting inconsistent permissions across MLOps tools. The scenario describes an access control misconfiguration within the pipeline infrastructure, not an attack against model predictions. Reference: https://cloudsecurityalliance.org/blog/2025/09/11/the-hidden-security-threats-lurking-in-your-machine-learning-pipeline

D is incorrect: Model extraction involves reconstructing a model by systematically querying its inference API and analyzing the outputs. This attack targets a deployed model at the inference layer rather than exploiting mismatched permissions between internal MLOps tools. The scenario describes an internal access control gap between data versioning and CI/CD systems, not an external model theft attempt. Reference: https://cloudsecurityalliance.org/blog/2025/09/11/the-hidden-security-threats-lurking-in-your-machine-learning-pipeline

A is incorrect: Model poisoning involves corrupting the training data or training process to manipulate model behavior, causing the model to learn incorrect patterns or produce targeted misclassifications. While a malicious package could ultimately lead to model poisoning as a downstream effect, the specific attack described involves a public package replacing an internal one based on naming conflicts, which is classified as dependency confusion.

B is incorrect: Adversarial evasion involves crafting specially designed inputs that cause a deployed model to make incorrect predictions or classifications at inference time. This attack targets the inference layer of a running model, not the dependency resolution process of a CI/CD pipeline during model building. The scenario describes a supply chain compromise during the build phase, not an attack on model predictions.

C is correct: Dependency confusion is the correct answer. This attack occurs when an attacker publishes a malicious package to a public repository using the same name as an organization's internal package. When the CI/CD build system resolves dependencies, it may fetch the attacker's public package instead of the intended private one, leading to malicious code execution in the build environment. This is a recognized supply chain attack vector in ML pipelines that use both internal and external package sources.

D is incorrect: Model extraction involves an attacker systematically querying a deployed model's API to reconstruct its parameters or decision boundaries, creating a functional copy of the model. This attack targets deployed models through inference endpoints, not the CI/CD build pipeline or dependency resolution process. The scenario describes a build-time supply chain attack rather than a runtime attack against a serving endpoint.

A is correct: Natural language processing (NLP) is the AI technique most applicable to processing unstructured threat intelligence data such as written analyst reports. NLP models can interpret text-based reports, extract indicators of compromise, threat actor names, and attack techniques, and normalize this information into structured formats for the TIP. This automation significantly reduces manual effort and enables faster operationalization of threat data from diverse sources.

B is incorrect: Generative AI can create synthetic content for training and simulation purposes, but this does not address the operational challenge of extracting actionable intelligence from real unstructured threat reports received from external feeds. The scenario requires processing existing unstructured data into usable structured indicators, not generating new synthetic content for analyst development.

C is incorrect: Supervised classification uses labeled training data to categorize inputs into predefined classes. While useful for sorting already-structured STIX indicators into categories, supervised classification alone does not address the specific challenge of extracting actionable information from unstructured text-based analyst reports. Processing natural language content requires language understanding capabilities that standard classifiers do not provide.

D is incorrect: Reinforcement learning uses reward-based feedback loops to optimize sequential decision-making over time. While applicable to some network defense optimization scenarios, it does not address the text processing challenge of extracting and normalizing indicators from unstructured analyst reports. The scenario specifically requires an AI technique capable of interpreting and processing natural language text.

A is correct: The intended operational model for agentic AI in security operations is a human-on-the-loop approach where AI agents autonomously handle high-volume, repetitive investigation tasks such as initial triage, evidence gathering, and data correlation at machine speed. Humans retain strategic oversight and final decision-making authority, particularly for high-impact remediation actions. This model acts as a force multiplier, freeing analysts to focus on complex threat hunting and strategic response activities requiring human judgment.

B is incorrect: Generating text summaries for manual human review and execution describes an AI assistant model rather than an agentic AI operational model. While AI assistants provide information and recommendations that require human action at each step, agentic AI systems take a more active role by autonomously investigating, correlating evidence, and reaching conclusions. The agentic model involves independent reasoning and action, not just passive summarization.

C is incorrect: Serving exclusively as data pipelines for log collection and forwarding describes basic data ingestion functionality, not agentic AI capabilities. Agentic AI systems are designed to go beyond data collection by actively reasoning through the data, identifying patterns, making triage decisions, and executing investigation workflows. Reducing agentic AI to a data pipeline role negates its core capabilities of autonomous reasoning and adaptive action.

D is incorrect: Agentic AI in security operations is not intended to operate without any human involvement. Responsible deployment of agentic AI maintains human oversight, especially for high-impact containment and remediation actions. The operational model includes governance boundaries where agents operate autonomously within defined parameters, but humans review critical decisions, intervene when needed, and maintain accountability for outcomes.

A is incorrect: Scanning inference API responses for PII addresses data leakage through model outputs at the inference layer. While this is a valid security control, it targets a different threat than the exfiltration of training datasets. The scenario specifically asks about detecting the theft of training data stored on-premises, which requires monitoring data access and movement rather than scanning inference outputs.

B is incorrect: Tracking authentication attempts is important for detecting unauthorized access and credential-based attacks. However, authentication monitoring alone does not detect data exfiltration. A legitimate authenticated user or compromised account could exfiltrate data without generating failed authentication events. Exfiltration detection requires monitoring what happens after authentication, specifically data access and transfer patterns.

C is correct: Correlating data access events with outbound transfer volumes across both environments is the most critical SIEM capability for detecting data exfiltration of AI training datasets. Data exfiltration detection requires visibility into who accessed the training data on-premises and whether unusual volumes of data were subsequently transferred to external destinations. By correlating access logs from on-premises storage with network transfer metrics and cloud egress events, the SIEM can identify suspicious patterns such as bulk data reads followed by large outbound transfers.

D is incorrect: Monitoring GPU utilization tracks the computational resource consumption of model training infrastructure. While GPU metrics are useful for performance monitoring and detecting unauthorized training workloads, they do not directly indicate data exfiltration. An attacker exfiltrating training datasets would generate data access and network transfer events, not necessarily changes in GPU utilization patterns. This metric addresses availability, not data confidentiality.

A is incorrect: Adversarial training improves robustness but does not eliminate the requirement for continuous robustness evaluation. New attack techniques emerge over time, and training against one class of adversarial examples may not protect against novel or more sophisticated methods. Ongoing robustness evaluation remains a critical practice throughout the AI model lifecycle. Reference: https://csrc.nist.gov/pubs/ai/100/2/e2023/final

B is correct: Adversarial training augments training data with adversarial examples, teaching the model to correctly handle inputs that have been intentionally perturbed. This strengthens the model's decision boundaries and increases resilience against evasion attacks encountered during inference. As documented in NIST AI 100-2, adversarial training is empirically one of the most effective defenses for hardening AI models against adversarial input manipulation. Reference: https://csrc.nist.gov/pubs/ai/100/2/e2023/final

C is incorrect: Adversarial training does not protect the model's architecture or hyperparameters from unauthorized access. Protecting model internals requires access controls and infrastructure security measures. Adversarial training specifically focuses on improving the model's classification accuracy when confronted with perturbed inputs, not on preventing reconnaissance against the model's internal structure. Reference: https://csrc.nist.gov/pubs/ai/100/2/e2023/final

D is incorrect: Adversarial training does not encrypt gradient information. Gradient masking is a separate and distinct defense technique that attempts to obscure gradient information from attackers. Adversarial training works by exposing the model to adversarial examples during training to build resilience in the decision boundaries, not by hiding the model's gradient computations. Reference: https://learn.microsoft.com/en-us/security/engineering/threat-modeling-aiml

A is incorrect: Rate limiting restricts how frequently uploads can occur but does not validate the content, quality, or authorization status of what is being uploaded to the production registry. An unauthorized team member could still push unapproved model artifacts to production at a slower rate. The identified risk requires authorization gates and validation checks, not throughput restrictions on upload operations.

B is correct: Implementing an approval gate with automated security validation before promotion is the correct answer. An approval gate requires that model artifacts pass through automated compliance checks, security scans, and designated reviewer approval before they can be promoted to the production registry. This ensures only validated and authorized model artifacts reach production by combining automated verification with governance oversight across the hybrid pipeline.

C is incorrect: Deploying individual registry instances for each team member would create significant operational overhead and management complexity without solving the core governance problem. The issue is that the production registry lacks access control gates, not that team members share a registry. Multiple registries would still require promotion controls to manage what artifacts ultimately reach the production environment.

D is incorrect: Encryption at rest protects the confidentiality of model artifacts stored in the production registry by preventing unauthorized reading of the stored data. However, it does not address the issue of unrestricted push access, since any team member with write permissions can still upload unreviewed artifacts regardless of whether encryption is enabled. The core risk is unauthorized promotion, not unauthorized reading of artifacts.