Domain 2 of 4 · Chapter 2 of 3

Secure AI Deployment Environments

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing CompTIA SecAI+ premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Placement: on-premises, cloud, and hybrid
  • What the provider does for you, and what stays yours
  • Isolating experimentation, training, and inference
  • The network path: private ingress, controlled egress
  • Hardening the runtime: image to accelerator
  • The MLOps pipeline is production infrastructure
  • Identity and secrets for pipeline and inference workloads
  • Operating the deployment: monitoring and rollback
  • Exam patterns: reading a deployment-environment question

Placement options: what each one fixes, and what you must still configure

Placement questionOn-premisesCloud infrastructure, model you hostManaged model serviceAPI-only model provider
Who chooses where weights and prompts physically sitYou, down to the rackYou, by region and availability zoneYou by region or geography, but some deployment types process outside itThe provider, unless a contract or a regional endpoint pins it
Tenancy at the acceleratorYours alone, though internal teams may still share a hostDedicated to the instance you rent; shared once teams share a clusterMulti-tenant service, isolation is logical and described in the provider's data-handling docMulti-tenant service you never see
Who patches host, runtime, and accelerator driversYou, including the firmware nobody remembersYou, for everything above the hypervisorProvider, up to the model endpointProvider, entirely
What you must still configure yourselfSegmentation, egress control, registry, promotion gates, monitoringSegmentation, egress control, image provenance, promotion gates, monitoringPrivate endpoint, region or deployment type, logging, quotas, key choiceEgress allowlist to the provider, secret handling, request and response logging
Typical failure when the boundary is assumedThe accelerator host goes unpatched because the network is internalThe training container keeps its default internet access and the corpus leavesA deployment type chosen for capacity processes prompts in another geographyRegulated data rides out in prompts over an egress path nobody logs

Decision tree

Must you control the weights as your own artifact? Yes No Do you own accelerators that can run it? Must it sit in your network and audit trail? Yes No Yes No On-premises you patch everything Cloud infrastructure model you host Managed model service private endpoint API-only model provider Always, whichever placement: pin the region or deployment type, read the provider data-handling doc, control egress
Cheat sheet

Cheat sheet

  • Placement fixes residency and tenancy, and no later control undoes it
  • A hosted model's processing location depends on the deployment type, not just the region
  • A provider that does not train on your data may still retain some of it
  • With a managed model service you still own region, path, logging, quotas, and keys
  • Hybrid risk lives at the crossings, and the grounded prompt is the forgotten one
  • Training and inference belong in separate trust zones
  • Orchestrators mix sensitivity levels on one host unless a rule stops them
  • Artifacts promote forward, and production data must not travel back
  • Managed training and inference containers have outbound internet access by default
  • Network isolation blocks every outbound call, including to object storage
  • For an AI workload, egress control outranks ingress control
  • An agent deployment needs a destination allowlist, because blanket deny is not available
  • A container with accelerator access sits closer to the host than a plain one
  • Shared accelerators carry the resource-reuse problem
  • Whatever can write the model registry decides what serves your customers
  • SSDF SP 800-218A adds AI model training to the environments that must be protected
  • Bring third-party models and images in through one staging path, then your own registry
  • Give every pipeline job its own identity and none of them a long-lived key
  • A secret baked into an image is in every copy of that image, forever
  • The secure AI lifecycle has four stages, and deployment is not the last
  • Roll back the model and its components together, never the weights alone
  • A model with no non-AI fallback cannot actually be switched off
  • Patch the environment on its own clock, separately from model updates
  • Sort container-layer questions into the five NIST SP 800-190 layers

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. CompTIA SecAI+ (CY0-001) certification
  2. Data, privacy, and security for Foundry Models sold by Azure
  3. Protect your data using Amazon VPC and AWS PrivateLink (Amazon Bedrock)
  4. NIST SP 800-190, Application Container Security Guide Whitepaper
  5. NIST SP 800-218A: Secure Software Development Practices for Generative AI and Dual-Use Foundation Models Whitepaper
  6. Run Training and Inference Containers in Internet-Free Mode (Amazon SageMaker AI)
  7. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1 Whitepaper
  8. LLM03:2025 Supply Chain Whitepaper
  9. Guidelines for Secure AI System Development Whitepaper
  10. Joint Guidance on Deploying AI Systems Securely Whitepaper
  11. Artificial Intelligence (CISA)