{
  "lesson": "25-security-secrets-audit",
  "title": "Security — Secrets, API Key Rotation, Audit Logs, Guardrails",
  "questions": [
    {
      "stage": "pre",
      "question": "What is the 2026 standard pattern for LLM service credentials?",
      "options": [
        "Hardcode API keys in config files for speed",
        "Email the key to each engineer",
        "Store keys in a Slack channel",
        "Centralized vault pulled by an AI gateway at runtime via IAM role; rotate in vault and all apps pick up in minutes"
      ],
      "correct": 3,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "What rotation cadence does the lesson recommend for API keys, vault root tokens, and CI/CD credentials?",
      "options": [
        "Within 90 days, automated where possible, logged and tracked when manual",
        "Only when leaked",
        "Never",
        "Every 5 years"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "Why is consistent tokenization (Mesh approach) used for PII scrubbing?",
      "options": [
        "It encrypts the prompt to the model",
        "It is required by ISO 27001",
        "Same source value maps to the same placeholder, so the LLM preserves code and relationship semantics across the prompt",
        "It uses less memory than regex"
      ],
      "correct": 2,
      "explanation": ""
    },
    {
      "stage": "check",
      "question": "What egress posture does the lesson recommend for LLM service subnets?",
      "options": [
        "Whitelist a small set of domains (api.openai.com, api.anthropic.com, vector DB, vault) and drop everything else, with an allowlist-only DNS resolver",
        "Block all egress including providers",
        "Allow DNS but block HTTP",
        "Allow all outbound traffic"
      ],
      "correct": 0,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "What did the 2026 Vercel supply-chain incident teach about CI/CD credentials?",
      "options": [
        "CI/CD credentials are low-risk and can stay in env files",
        "CI/CD secrets cannot be stolen",
        "Vercel was unaffected",
        "CI/CD credentials are prod-equivalent — store in vault, scope narrowly, rotate aggressively"
      ],
      "correct": 3,
      "explanation": ""
    },
    {
      "stage": "post",
      "question": "Which audit log fields does the lesson recommend keeping for every LLM call?",
      "options": [
        "Only the cost",
        "Timestamp, user/tenant, prompt hash (not raw), model + version, token counts, cost, response hash, any guardrail trips",
        "Just the raw prompt",
        "Only the response"
      ],
      "correct": 1,
      "explanation": ""
    }
  ]
}