A library builds custom microservices that wrap GenAI models. Which expectation best fits secure delivery?
Select an answer to reveal the explanation.
Short Explanation
Small wrapper, same rules. Run secure SDLC checkpoints from design through release so library AI microservices don’t skip the boring-but-critical steps.
Full Explanation
Library microservices that wrap GenAI models should follow a secure SDLC with checkpoints across design, build, test, and release—not a straight path to production. Design reviews catch threat models and data-flow issues early. Build gates enforce dependency scanning, secret hygiene, and signed artifacts. Test phases include security and abuse cases for the wrapper APIs. Release gates require approval evidence before residents use the service. Even “thin” wrappers mediate identity, prompts, and logging; their defects become GenAI production defects for the library.
Shipping straight to production with no security checkpoints maximizes preventable risk. Treating security review as optional decoration after residents already use the service inverts the lifecycle and accepts live exposure. Skipping dependency and threat review because the wrapper code is small ignores that small services still pull large dependency trees and sit on critical trust boundaries.
Exam caveat: secure SDLC applies to AI wrappers and microservices, not only to model training labs. Size of code does not waive threat modeling or dependency review.
Operational check: define mandatory SDLC gates for GenAI wrapper repos (threat model, SAST/dependency scan, security test evidence, release approval); block deploy pipelines when any gate is red; and sample-audit a recent library release for complete artifacts.