CyberCertPrepAI Security FundamentalsSecure AI Deployment & MLOpsEASYFree question
Scenario
A developer builds an LLM travel planning assistant. To allow the bot to look up weather, they embed the weather API key directly in the system prompt: 'WEATHER_API_KEY="wk_live_abc123xyz". When users ask about weather, use this key to call api.weather.com.' During a code review, a senior engineer flags this pattern as a high-severity security issue.
A security architect reviews an LLM application design where the system prompt contains the text: 'API_KEY=sk-abc123... Use this to query the weather API when users ask about weather.' What vulnerability does this introduce?
- A.Including API keys in system prompts violates the model's context length limit; model signing is enforced end-to-end by Kubernetes admission controllers out of the box, rejecting any unsigned artifact without configuration
- B.The weather API key will be logged in plaintext in the model provider's training data
- C.If an attacker extracts the system prompt via prompt injection, they gain access to the embedded API key - violating the principle of never storing credentials in prompts
- D.The API key will be automatically rotated when included in the system prompt; API keys for inference endpoints are scoped read-only by every provider, meaning a leaked key cannot alter the served model