Question
A security engineer needs to monitor an AI-based system for runtime operations. The engineer is mostly concerned about the visibility of internal activity. Which of the following is the most appropriate monitoring solution?
- A. Deploying a security information and event management (SIEM) tool
- B. Implementing a web application firewall (WAF) with header logging
- C. Relying on vendor model controls and monitoring prompt inputs
- D. Enabling stack call and debugging level traces at the function level Correct
Explanation
Function-level call stack and debug traces expose what the application is doing internally at runtime, which is exactly the visibility the engineer wants. A SIEM aggregates and correlates logs but only sees what is sent to it, a WAF with header logging sees requests at the edge rather than internal activity, and vendor controls plus prompt monitoring cover inputs, not the system's internal behavior.
