AIF-C01 Practice Test 14 — 15 Questions

Question 1

A data scientist is training a model using Amazon SageMaker and needs to ensure the training data is encrypted at rest and in transit. The data is stored in S3. Which combination of steps meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an S3 bucket with SSE-KMS encryption and configure the SageMaker training job to use a VPC with no internet access. S3 server-side encryption (SSE-S3 or KMS) protects data at rest. SageMaker uses HTTPS for data in transit between S3 and the training instance, and VPC configuration can enforce network isolation.

Answer

Enable S3 Transfer Acceleration and use a public SageMaker training job

Answer

Use client-side encryption before uploading to S3 and disable SageMaker internet access

Answer

Enable default S3 bucket encryption and use a SageMaker notebook instance in a private subnet

Question 2

A company uses Amazon Bedrock to generate content and wants to prevent the model from producing harmful or biased responses. Which AWS service should they configure to enforce content safety policies?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails provides content filtering, PII redaction, topic restrictions, and other safety controls. It is purpose-built for content safety in Bedrock.

Answer

Amazon Comprehend for toxicity detection

Answer

Amazon SageMaker Clarify

Answer

AWS WAF to filter model responses

Question 3

An organization is implementing governance for machine learning models using SageMaker. They need to track model versions, monitor for drift after deployment, and automatically decommission models that have been deprecated for over 30 days. Which THREE services or features should they use?

Accepted Answer

Amazon SageMaker Model Registry. SageMaker Model Registry tracks versions, Model Monitor detects drift, and SageMaker Projects with MLOps can automate decommissioning. Clarify is for bias, not lifecycle management. Ground Truth is for labeling.

Answer

Amazon SageMaker Ground Truth

Answer

Amazon SageMaker Clarify

Question 4

A company wants to use a third-party foundation model from Amazon Bedrock but is concerned about data privacy because the model provider might store prompts and responses. How should they address this concern?

Accepted Answer

Review the third-party model provider's data handling policy and choose a model that does not retain data. Each third-party model provider in Bedrock has its own data handling policies. Customers should review those policies and can choose models that do not store data or use Bedrock features like Guardrails to redact sensitive data. However, the direct action is to review the provider's policy and select a model that meets privacy requirements.

Answer

Enable Amazon Bedrock model invocation logging to capture all interactions

Answer

Use Amazon Macie to scan prompts before they are sent

Answer

Use AWS KMS to encrypt the prompts and responses before sending to the model

Question 5

A data scientist needs to use Amazon SageMaker to train a model and must ensure that the training data and the model artifacts are encrypted using customer-managed KMS keys. Which TWO resources can be encrypted with KMS keys in this scenario? (Select TWO.)

Accepted Answer

SageMaker ML storage volume (attached to training instances). SageMaker can use KMS keys to encrypt the ML storage volume (attached to training instances) and S3 buckets storing training data. Model artifacts in S3 can also be encrypted with KMS.

Answer

SageMaker notebook instances

Answer

Amazon SageMaker Model Registry

Answer

Amazon CloudWatch Logs

Question 6

A company is deploying a real-time inference endpoint using Amazon SageMaker. The security team requires that all data sent to the endpoint be encrypted in transit and that the endpoint is only accessible from within the company's VPC. Which configuration should be used?

Accepted Answer

Deploy the endpoint in a private subnet with a VPC endpoint for SageMaker Runtime. SageMaker endpoints can be deployed in a VPC and configured to use a private VPC endpoint (AWS PrivateLink) so that they are accessible only from within the VPC. HTTPS ensures encryption in transit; SageMaker endpoints automatically use HTTPS.

Answer

Deploy the endpoint in a public subnet and use a security group to restrict source IPs

Answer

Enable network isolation on the endpoint

Answer

Use an AWS Lambda function to proxy requests and restrict access via IAM

Question 7

A company is using Amazon SageMaker to manage the lifecycle of their machine learning models. They need to implement a governance framework that includes model versioning, monitoring for drift, and decommissioning of outdated models. Which THREE AWS services or features should they use together to meet these requirements? (Select THREE.)

Accepted Answer

SageMaker Pipelines. SageMaker Model Registry handles versioning, SageMaker Model Monitor detects drift, and SageMaker Pipelines can orchestrate decommissioning workflows. Together they cover the governance lifecycle.

Answer

AWS CloudTrail

Answer

SageMaker Role Manager

Question 8

A company is using Amazon Bedrock to generate text summaries of customer emails. The compliance team requires that any email containing a Social Security Number (SSN) must be blocked from being sent to the model for summarization. Which Bedrock Guardrail configuration should be used?

Accepted Answer

Use a content policy with a PII filter set to 'Deny' for SSN. Bedrock Guardrails can be configured to filter content before it is sent to the model. PII redaction with a deny action will block the input if SSNs are detected. The guardrail is applied at invocation time.

Answer

Configure a topic restriction to block 'PII' topics

Answer

Enable model invocation logging and manually review all inputs

Answer

Add a word filter with a list of common SSN patterns

Question 9

A financial services firm needs to ensure that all calls to Amazon Bedrock APIs are logged for audit purposes. Which AWS service should they enable to capture API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in AWS accounts, including Bedrock API calls, providing audit logs.

Answer

Amazon S3 server access logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 10

A company using Amazon Bedrock needs to redact personally identifiable information (PII) from user inputs before sending them to the foundation model. Which Bedrock Guardrails component should be configured?

Accepted Answer

Sensitive information filters. PII redaction in Guardrails automatically detects and redacts PII in user inputs or model responses.

Answer

Content filters

Answer

Topic restrictions

Answer

Word filters

Question 11

A company needs to audit all API calls made to Amazon Bedrock, including model invocations and guardrail evaluations. Which AWS service should they enable to capture these API calls for compliance?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for all AWS services, including Bedrock. It captures the caller identity, API, parameters, and response elements, which can be used for auditing and compliance.

Answer

Amazon Macie

Answer

AWS Config

Answer

Amazon GuardDuty

Question 12

A financial services firm uses Amazon Bedrock to generate investment summaries. They need to prevent the model from generating content containing personally identifiable information (PII) such as social security numbers. Which feature should they configure in Bedrock Guardrails?

Accepted Answer

Sensitive information filters with PII redaction. Bedrock Guardrails include a PII redaction filter that can detect and block or mask PII in model inputs and outputs.

Answer

Contextual grounding checks

Answer

Content filtering with category-based harmful content filters

Answer

Word filters with a custom list of terms

Question 13

A machine learning team wants to detect bias in a deployed model's predictions on new data. They use Amazon SageMaker. Which service should they use to generate bias reports after deployment?

Accepted Answer

Amazon SageMaker Clarify. Amazon SageMaker Clarify provides bias detection and explainability for ML models, both during training and after deployment. SageMaker Model Monitor detects data drift but not bias. SageMaker Debugger is for training debugging. SageMaker Role Manager is for managing IAM roles.

Answer

Amazon SageMaker Debugger

Answer

Amazon SageMaker Model Monitor

Answer

Amazon SageMaker Role Manager

Question 14

A security engineer is configuring logging for Amazon Bedrock model invocations. They need to capture both the input and output of all API calls for compliance audits. Which set of steps should they take?

Accepted Answer

Enable Bedrock model invocation logging and specify an S3 bucket and optionally CloudWatch Logs as the destination. Bedrock model invocation logging captures inputs and outputs to S3 and/or CloudWatch Logs. CloudTrail records API calls but not the model inputs/outputs.

Answer

Enable CloudTrail for the Bedrock API and configure S3 event notifications

Answer

Use VPC Flow Logs to capture network traffic and reconstruct model inputs from packet data

Answer

Enable AWS Config rules for Bedrock and stream logs to Amazon Kinesis

Question 15

A company wants to enforce strict data residency for training data used in SageMaker. The data must never leave a specific AWS Region. Which THREE actions should they take? (Choose 3)

Accepted Answer

Use KMS customer managed keys specific to the region. To enforce data residency, the company must use a VPC in the desired region, configure S3 bucket policies to block cross-region access, and use KMS keys regional to that region.

Answer

Use AWS KMS multi-Region keys to encrypt data

Answer

Enable cross-region replication for the S3 bucket