Plan and manage an Azure AI solution 1.3 Manage, monitor, and secure AI systems
A security operations team wants real-time security alerts when users attempt jailbreaks…
Study guide skill: Monitor model performance, drift, safety events, and grounding quality
Question B4-010
A security operations team wants real-time security alerts when users attempt jailbreaks or data leakage against the company's Azure OpenAI deployments, and wants to correlate those alerts with other incidents in Microsoft Defender XDR. What should you enable?
Select one answer.
Answer: D
Defender for Cloud's AI threat protection works with Prompt Shields and Microsoft threat intelligence to raise security alerts for threats such as jailbreak and data leakage, and it integrates with Defender XDR so alerts can be correlated with other incidents. Security posture recommendations alone don't raise these alerts; the threat protection plan must be enabled. Purview Audit records support investigation alongside Defender alerts, and leaderboard safety benchmarks compare models on public datasets.
Deep dive
How it works
Threat protection for AI services is a Microsoft Defender for Cloud plan that identifies threats to generative AI applications in real time. It works with Azure AI Content Safety Prompt Shields and Microsoft threat intelligence to raise security alerts for threats like data leakage, data poisoning, jailbreak and credential theft.
It also integrates with Defender XDR: security teams can centralize AI workload alerts in the Defender XDR portal and correlate them with other alerts and incidents to see the full scope of an attack. That covers both requirements.
Practical notes from the page:
- Supported services include Azure OpenAI and Azure AI Model Inference models. Only text tokens are scanned; image and audio tokens aren't.
- Enabling threat detection at subscription level needs the Owner role at subscription scope, or roles with the corresponding data actions.
- There's a 30-day free trial, capped at 75 billion tokens scanned.
In Foundry Control Plane, the compliance workspace's Security posture tab is where you review Defender for Cloud recommendations and manage Purview enablement. The jailbreak and prompt attack detections appear as Defender alerts and can be correlated with Purview Audit records.
The other options, and when you'd use them
- Leaderboard safety benchmarks: They help you understand how safe models are against harmful behavior generation, before you choose one. They don't watch your deployments or raise alerts.
- Purview integration and Audit: Purview covers auditing, classification and data security posture. Microsoft positions Audit records as something Defender alerts can be correlated with during investigation, not as the alert source.
- Defender for Cloud posture recommendations: Recommendations identify misconfigurations. Detecting jailbreak and user input attacks is the threat protection part.
Exam tip
Real-time AI attack alerts + Defender XDR = Defender for Cloud threat protection for AI services. Posture = misconfigurations. Purview = audit and data governance.
References
Last reviewed: