The city's cloud landing zone uses the same identity for AI inference jobs and training jobs. What integration control is missing?
Select an answer to reveal the explanation.
Short Explanation
You're still using one master key for the lab and the lobby if you just rotate keys on a shared train-and-serve account. Split the roles.
Full Explanation
Centralized rotation of keys for the shared inference and training account omits segregated identities and privileges—an integration control cities need in landing zones. Separating training and inference identities limits blast radius if either pipeline is compromised, supports least privilege (train may need dataset write paths that serve should never have), and clarifies audit trails for municipal cloud AI. A shared inference and training account with rotated keys is still an integration risk; diagram styling does not segregate credentials.
Restating the problem — centralized key rotation for the shared inference and training account, shared encrypted artifact storage between training and inference environments, or consolidated activity monitoring and detailed audit logging for training and inference jobs — describes symptoms of the same missing control rather than naming the fix the city actually needs: technically segregated identities and privileges for inference versus training.
Exam caveat: segregating identities without segregating secrets, storage roles, and network paths leaves residual shared power—align identity, key vault access, and dataset ACLs together.
Operational check: create distinct service principals or workload identities for train and serve, grant train-only dataset write and serve-only model-read roles, attempt a cross-role access test that must fail, and confirm cloud audit logs attribute each job type to its own identity.