A municipal tree-planting-permit program will keep an LLM in the test toolchain for years. Which set of ongoing controls best matches the syllabus mitigations?
Select an answer to reveal the explanation.
Short Explanation
Multi-year LLM use is like keeping a shared power tool in the garage—you recheck it, keep up with safety notices, and call facilities when something looks off. Audits, staying current, and escalating to security or legal leadership are the ongoing controls. A one-time demo is not a program.
Full Explanation
Tree-planting-permit programs that will keep an LLM in the toolchain for years need ongoing controls: regular security audits and vulnerability assessments, staying updated with security best practices, and involving senior security, legal, CTO, or CISO when present. Multi-year tools need multi-year governance, not a one-time demo blessing.
A one-time vendor demo with permanent trust fails by concept. Exclusive reliance on energy-simulator token counts fails because energy metrics are not security controls. Publishing every generated script publicly to crowdsource findings fails by exposing civic automation and potentially sensitive content.
Exam caveat: “ongoing” is the keyword—audits, updates, and escalation paths remain active for the life of the GenAI testing capability.
Operational check: calendar quarterly assessments of the planting-permit LLM toolchain; track CVEs and vendor advisories; define escalation to CISO/legal; revisit access scopes when staff rotate; retire abandoned GenAI integrations promptly. Tree-planting LLM toolchains should schedule quarterly vulnerability assessments, track vendor advisories, and define CISO/legal escalation triggers when new connectors touch resident data. Retire abandoned integrations promptly so multi-year sprawl does not leave unowned GenAI doors on the network.