Public-health PHI models must not share the same zone as open-data 311 models. What architecture fits?
Select an answer to reveal the explanation.
Short Explanation
You protect public-health AI by placing it in a separate air-gapped or tightly controlled zone, away from open 311 models. You avoid a flat VLAN or publishing PHI through the public 311 API, and developer laptops without zone controls are not a secure architecture.
Full Explanation
Public-health PHI models carry regulated data and must not share a blast radius with open-data 311 models. Place health AI in a separate air-gapped or tightly controlled zone, with distinct network segments, identity, storage, and administrative planes, so a compromise or misconfiguration in the open tier cannot freely reach PHI. This zoning is the primary control required here. Collapsing PHI and open data onto one flat, unsegmented VLAN maximizes lateral movement and fails segmentation expectations. Publishing PHI datasets through the public 311 API for convenience is a direct confidentiality breach. Storing PHI only on developer laptops with no zone controls decentralizes risk, weakens custody, and is not a data-center architecture. Exam caveat: an “air-gapped or tightly controlled” zone still needs operational paths for patching and model promotion; define controlled break-glass or transfer procedures rather than relying on shadow USB workflows that bypass the zone. Practical check: verify PHI training and inference endpoints cannot route to the open 311 VLAN, confirm separate identity and storage policies, and test that open-tier credentials cannot list PHI buckets or model registries.