Building Secure Python AI Applications

Final Quiz

Connecting to LMS... Progress: in progress

Assessment

1. What is a secure Python AI application primarily concerned with? A. Only choosing the largest model available. B. Safely combining models, prompts, data, tools, users, outputs, and application controls. C. Replacing all application security with prompts. D. Making every model response public.

2. Why is AI application security not only model security? A. The application controls data access, tools, permissions, storage, logging, user experience, and downstream actions. B. Models always enforce business authorization by themselves. C. Prompt wording replaces access control. D. AI applications do not use normal software components.

3. What is a trust boundary in an AI application? A. A visual separator in the chat interface. B. A model temperature setting. C. A point where data, instructions, identity, or control moves between components with different trust levels. D. A storage folder for images.

4. Why should untrusted content not be allowed to grant itself authority? A. It improves response creativity. B. It makes retrieval faster. C. It removes the need for permissions. D. External text may look like instructions even when it should be treated only as data.

5. What is data minimization in AI context handling? A. Including only the information needed for the task and avoiding unnecessary sensitive context. B. Sending every available document to the model. C. Logging all prompts forever. D. Disabling all retrieval.

6. Why can prompt and conversation logs be sensitive? A. They are always public. B. They may contain personal data, customer data, secrets, source code, decisions, or sensitive business context. C. They cannot contain credentials. D. They replace monitoring.

7. What is prompt injection at a high level? A. A password hashing method. B. A database migration pattern. C. Untrusted input influencing model behavior in an unintended way. D. A UI animation effect.

8. Why is wording alone not a reliable security boundary? A. It always blocks unsafe behavior. B. It makes all documents trusted. C. It replaces authorization. D. The model processes natural language from many sources, so application code must enforce permissions and high-impact controls.

9. What should RAG systems preserve during retrieval? A. Authorization, provenance, source context, and data boundaries. B. Only document length. C. Only model temperature. D. Only file extension.

10. Why can vector stores be security-sensitive? A. They only store public data. B. They may contain indexed sensitive content, tenant-specific material, stale data, or documents with different access rules. C. They cannot affect responses. D. They replace authentication.

11. What is a safe pattern for AI tool calling? A. Let model text directly execute any action. B. Give every tool administrator access. C. Validate tool arguments, scope permissions, use allowlists, and require approvals for high-impact actions. D. Hide all tool use from logs.

12. Why should write-capable tools receive special controls? A. They are always harmless. B. They never need authorization. C. They replace user consent. D. They can change systems, send communications, modify data, or trigger external effects.

13. How should model output be treated before using it in another system? A. As untrusted output that may need validation, encoding, policy checks, and human review depending on impact. B. As automatically correct. C. As authorization approval. D. As a secret manager.

14. Why are hallucinations security-relevant? A. They guarantee better accuracy. B. They can produce confident but incorrect claims, references, summaries, or recommendations that affect decisions. C. They replace evidence. D. They only affect entertainment use cases.

15. What should AI application logs avoid? A. Event names. B. Correlation IDs. C. Secrets, credentials, tokens, unnecessary personal data, and sensitive prompt or retrieval content when not required. D. Generic outcome codes.

16. Which statement best summarizes secure Python AI application design? A. Secure AI applications rely only on stronger prompts. B. Secure AI applications should let the model decide its own permissions. C. Secure AI applications do not need monitoring. D. Secure AI applications combine trust boundaries, data minimization, prompt-injection defenses, retrieval controls, tool permissions, output validation, logging hygiene, testing, monitoring, and incident response.