Transit exposes rider-assistant model endpoints behind a public load balancer without WAF rules tuned for prompt abuse patterns. What edge control is missing?
Select an answer to reveal the explanation.
Short Explanation
You can think of a public GenAI endpoint without abuse-aware edge rules as an open ticket window with no bouncer. Add application-layer protections for prompt-style abuse; FTP transcripts and removing authentication do not protect the edge, and private-subnet hosting alone does not filter prompt abuse at the public edge.
Full Explanation
Transit rider-assistant model endpoints behind a public load balancer are internet-reachable civic GenAI APIs. Without WAF or equivalent application-layer rules tuned for prompt abuse—flooded requests, jailbreak-like payloads, oversized prompts, scraping, or anomalous client patterns—the edge lacks protections that traditional HTTP WAFs and API gateways provide for public services. The missing control is application-layer protection for publicly reachable municipal GenAI endpoints, sized to abuse patterns that hit inference APIs rather than only classic SQLi signatures. Mandatory FTP for rider chat transcripts addresses neither edge abuse nor secure transport; FTP is an outdated channel and is unrelated to protecting the inference API. Removing authentication weakens identity and rate-limiting context and invites anonymous abuse; reducing tracked sessions is not a security control. Private-subnet hosting may improve isolation, but it does not filter prompt abuse at the public edge while the endpoint is publicly reachable. Exam caveat: a generic WAF profile may miss GenAI-specific abuse; tune rules and limits for prompt size, rate, and authentication-failure patterns without blocking legitimate riders. Practical check: confirm the public GenAI VIP terminates behind WAF or API-gateway policies, review blocked-versus-allowed request metrics, and verify authentication remains enforced while edge protections are active.