GCP Generative AI Leader Practice Question 20: Secure AI Framework Adoption
Google Cloud Generative AI Leader · Test 2 · question 10 of 10
A telecom's CISO has been handed eleven gen AI pilots that grew up in different business units. Each team secured its own pilot its own way, so the board cannot tell which risks are covered, detection stops at the edge of each project, and no one can compare one pilot's controls against another's. The CISO wants a single conceptual framework to structure the programme, rather than buying another point tool or drafting a policy from scratch.
What should the CISO adopt, and why?
Show answer and explanation
Answer:
Google introduced the Secure AI Framework (SAIF) as a conceptual framework to secure AI systems, and its six core elements map onto the CISO's three complaints precisely: *extend detection and response* to bring AI into the organization's threat universe (detection stopping at each project's edge), *harmonize platform-level controls* to ensure consistent security across the organization (pilots secured eleven different ways), and *contextualize AI system risks in surrounding business processes* (the board not knowing which risks are covered). SAIF also covers expanding security foundations to the AI ecosystem, automating defenses, and adapting controls with faster feedback loops. It is a framework, not a product, which is exactly what was asked for.
- A is wrong because IAM is one control within a programme. Least privilege is necessary but it does not give the board a structure for reasoning about AI risk across eleven pilots. - B is wrong because Security Command Center is a tool that reports findings. The CISO explicitly did not want another point tool, and a console cannot tell you which risks a framework says you should be covering in the first place. - D is wrong because responsible AI principles address fairness, transparency, and accountability in how AI behaves. They are essential, but they are a different discipline from securing AI systems against attack and misuse.
Reference: Google's Secure AI Framework (SAIF)