A company is deploying a Retrieval Augmented Generation (RAG) AI system that retrieves documents from Azure AI Search and uses Azure OpenAI to generate responses. The security team needs to implement defense-in-depth for this architecture. Which combination of controls provides comprehensive protection across the retrieval and generation layers?
Select an answer to reveal the explanation.
Short Explanation
You need to cover both sides of the RAG pipeline. Scan retrieved documents for hidden prompt-injection payloads before they hit the context window, filter generated responses for policy-violating content, and make sure users can only retrieve what they're authorized to see.
Full Explanation
The correct combination is the one that implements Prompt Shield document scanning on documents retrieved from Azure AI Search before they are included in the context window, applies content filtering on Azure OpenAI completions, and enforces role-based access to AI Search indexes aligned with user permissions. A RAG system has two distinct attack surfaces requiring separate controls: the retrieval layer, where malicious documents in the index could contain indirect prompt injection payloads, and the generation layer, where Azure OpenAI content filtering prevents the model from generating harmful or policy-violating responses. Prompt Shield document scanning detects injected instructions in retrieved documents before they enter the context window, while content filtering addresses unsafe output. Role-based access to AI Search indexes ensures users can only retrieve documents they are authorized to see, preventing unauthorized data disclosure through AI-generated summaries. Together, these controls form a defense-in-depth architecture for RAG.
The option that enables HTTPS for all RAG component communications and applies a WAF policy is wrong because HTTPS and WAF protect transport security and web application vulnerabilities, not the AI-specific threats in a RAG system such as indirect prompt injection or unauthorized content retrieval.
The option that applies sensitivity labels to Azure AI Search index documents and configures a DLP policy is wrong because sensitivity labels and DLP protect against data leakage through labeling, but do not protect against prompt injection in retrieved documents or content policy violations at generation time.
The option that deploys Azure API Management in front of the RAG API with rate limiting and IP filtering is wrong because API Management with rate limiting and IP filtering controls API access and prevents abuse, but does not address the AI-layer threats of prompt injection and harmful content generation.