312-41 practice question 4 of 35

Elara, the CTO, is conducting an analysis on a service outage caused by unverified AI-generated SQL code. The investigation shows that the engineer’s…

Choose your answer, then check it against the explanation.

Elara, the CTO, is conducting an analysis on a service outage caused by unverified AI-generated SQL code. The investigation shows that the engineer’s prompt was compliant, and no sensitive data was leaked. The failure occurred solely because the AI generated a syntactically correct but logically flawed query that locked the database, and this bad code passed through to the repository unchecked. Elara wants to implement a specific automated gate that analyzes the generated response text for known risk patterns such as infinite loops or deprecated syntax before the user can even copy it. Which Technical Control addresses this specific post-generation validation need?

Answer options

Correct Answer:

Explanation

Output scanning is the specific technical control designed to analyze the content generated by an AI model before it is delivered to the user or a downstream system. This control directly addresses the scenario's requirement to inspect the generated SQL code for known risk patterns, such as logical flaws, infinite loops, or deprecated syntax, thereby acting as an automated gate to prevent harmful code from being used.

Why Incorrect

B. Content filtering is a broader term, typically used for blocking entire categories of undesirable content (e.g., hate speech) rather than analyzing the logical integrity of generated code.

C. DLP (Data Loss Prevention) integration is focused on detecting and preventing the unauthorized exfiltration of sensitive data, which the scenario explicitly states was not the issue.

D. Prompt monitoring involves analyzing the user's input (the prompt) for risks before it is sent to the AI model, not analyzing the AI's subsequent output.

References

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). The framework's GOVERN function includes "Policies, processes, procedures, and practices for AI system output" and the PROTECT function in the Secure and Resilient AI Systems profile (Draft NIST AI 600-1) discusses controls for validating system outputs.

2. OWASP. (2023). OWASP Top 10 for Large Language Model Applications. The vulnerability "LLM04: Model Poisoning" and its countermeasures relate to ensuring the integrity of model outputs, which is achieved through mechanisms like output scanning and validation.

Question 4 of 35

Keep practicing

Take the free 312-41 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test