Home labs & practical projects

Review access to a cloud-hosted AI workload

A project to do with your own tools, with guidance on what to create and capture.

Design project Suggested time: 2–3 hoursNo hardware required for the design

What you could create

A team proposes an Azure AI assistant that retrieves internal documents. Security must examine the application identity, retrieval boundary and handling of sensitive data.

Example evidence format

Project evidence map (example)

AI workload threat and access diagramScope and inputs

Control validation planDecisions and reasoning

Evidence record (example)

Evidence	What to capture
AI workload threat and access diagram	Show the inputs, scope and decisions behind this record. The user’s document entitlement is not replaced by the application’s broad access.
Control validation plan	Include the evidence supporting your conclusion. Logging avoids retaining sensitive prompt contents without a reason.

What you'll need

Document, spreadsheet or diagram tool

Draw a fictional client, application, retrieval store and model endpoint. Include documents with two access levels and one operational administrator.

Project record

Keep the working files for ai workload threat and access diagram and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.

The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.

Suggested milestones

1
Plan and investigate
Trace user identity and workload identity through each trust boundary.
2
Develop your approach
Define controls for secrets, network exposure, retrieval permissions and logs.
3
Verify and explain
Design negative tests for an unauthorised document request and a leaked application credential.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
AI workload threat and access diagram
Show the inputs, scope and decisions behind this record. The user’s document entitlement is not replaced by the application’s broad access.
2
Control validation plan
Include the evidence supporting your conclusion. Logging avoids retaining sensitive prompt contents without a reason.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your ai workload threat and access diagram needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Draw a fictional client, application, retrieval store and model endpoint. Include documents with two access levels and one operational administrator.

What a good result looks like

The user’s document entitlement is not replaced by the application’s broad access.
Logging avoids retaining sensitive prompt contents without a reason.
Each proposed control has a test and a responsible owner.

Finish the project

Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.