A hospital tuned a model from a storage account the whole company can read, including files meant only for that tuning job. What should security change?
Select an answer to reveal the explanation.
Short Explanation
You keep tuning files private by locking the storage so only the tuning job and its owners can read them. That access control is the protection that matters; a confidential label does not stop company-wide readers from opening the account.
Full Explanation
Who can read tuning data is part of model security. Because the hospital used an account the whole company can read, lock the tuning storage so only the tuning job and its owners can read those files. Copying the files to a second account with the same company-wide access duplicates the exposure rather than reducing it. Adding a confidential label while leaving that access in place documents sensitivity but does not change who storage allows to read the files. Removing access reviews and trusting the finished model to forget sensitive information abandons oversight and does not protect the original tuning files. The tuning job's identity and its owners should be the only readers; remove company-wide read permission before the next job runs. A label communicates intent, but permissions enforce access. Exam caveat: restricting the tuning storage is separate from controlling who can use the deployed model; tightening storage access does not itself restrict model use. Practical check: sign in as a staff account that should not tune models and confirm the tuning files are unreadable, then verify that the tuning job can still read them.