An airline corporation wants to implement a chatbot application using a large language model (LLM)
so its customers can ask questions and receive answers about flight details and have the option to
upload files.
Which of the following security controls should the airline use to protect against malicious input and unauthorized use beyond the service-level agreement? (Choose two.)
Show answer and explanation
Correct answer: D
Basic Concept: LLM-based chatbots accepting user-uploaded files face two critical risk categories:
malicious input injection and resource or cost abuse. CompTIA SecAI+ Study Guide highlights prompt
security controls and resource management as key defensive layers for public-facing LLM
applications.
Why A is Correct: Prompt guardrails intercept and filter user inputs and model outputs, blocking
malicious prompts, prompt injection attempts, and harmful file content before affecting model
behavior. Since users can upload files, guardrails are essential for sanitizing and validating that
content before processing.
Why D is Correct: Model token quotas directly limit how much of the LLM's processing capacity a
user can consume. This prevents abuse beyond the SLA, including denial-of-wallet attacks or
resource exhaustion through excessively large inputs or repeated requests.
Why B is Wrong: Role-based access controls manage who can access what resources. While useful for
internal systems, they do not address malicious input content or enforce LLM resource consumption
limits for a public-facing chatbot.
Why C is Wrong: Firewall rules operate at the network layer and can block unauthorized IPs or ports
but cannot inspect or filter the semantic content of prompts or control token-level LLM usage.