CyberCertPrepAI Security FundamentalsSecure AI Deployment & MLOpsEASYFree question
A developer asks: "We're using LangChain to build our LLM app. Does using a reputable framework mean we don't need to do a security review?" What is the correct answer?
- A.A. Correct - reputable frameworks handle all security concerns
- B.C. Correct - LangChain has built-in security certification
- C.B. Incorrect - frameworks provide useful abstractions but do not prevent application-level vulnerabilities like prompt injection, over-permissioned tool configurations, or insecure handling of untrusted content; security review is the developer's responsibility
- D.D. Incorrect - no framework should be used for production LLM applications
Why C is correct
LLM frameworks (LangChain, LlamaIndex, Semantic Kernel, etc.) provide useful abstractions for building applications but are not security guarantees. The application developer remains responsible for: how untrusted content enters the prompt, tool permissions and scoping, output validation, and authentication of agent actions. LangChain itself has had security advisories (e.g., code execution vulnerabilities in specific chain types). Using a framework does not exempt a team from threat modeling and security review. No LLM framework carries a security certification that substitutes for application-level review.
Know someone studying for AI Security Fundamentals? Send them this one.