AIF-C01 Practice Test 28 — 15 Questions

Question 1

A company is using Amazon Comprehend to extract entities from customer support tickets. The compliance team requires that the text sent to Comprehend be encrypted in transit and that Comprehend does not store any data beyond the processing time. How should the company configure the API call?

Accepted Answer

Use the HTTPS endpoint for the DetectEntities API and rely on Comprehend's stateless design. Option D is correct because Amazon Comprehend's DetectEntities API is inherently stateless—it does not store any text or results beyond the processing time required to generate the response. By using the HTTPS endpoint, the company ensures encryption in transit via TLS, satisfying the compliance requirement without additional configuration. Comprehend does not persist data from synchronous API calls, so no data is retained after the response is returned.

Answer

Encrypt the text using AWS KMS before sending it to Comprehend

Answer

Use the AWS SDK with server-side encryption enabled for the API call

Answer

Create a VPC endpoint for Comprehend and send requests over the private network

Question 2

Which THREE considerations are essential for ensuring responsible AI in a model that predicts employee performance? (Choose 3)

Accepted Answer

Incorporate human review before final decisions. Option C is correct because responsible AI frameworks, such as those outlined by AWS, mandate human-in-the-loop (HITL) oversight for high-stakes decisions like employee performance predictions. This ensures that automated outputs are reviewed for context, fairness, and potential errors before affecting employment outcomes, aligning with the AIF-C01 domain's emphasis on human accountability.

Answer

Minimize the number of features to reduce cost

Answer

Publish the model's predictions publicly for transparency

Question 3

An AI team uses the IAM policy shown in the exhibit to control endpoint creation. Why does this policy support responsible AI?

Accepted Answer

It ensures data capture is enabled for model monitoring. Option C is correct because the IAM policy includes a condition that enforces the `DataCaptureConfig.EnableCapture` parameter to be set to `true` when creating a SageMaker endpoint. This ensures that model monitoring data is automatically collected, which is a key practice for responsible AI as it allows continuous monitoring of model performance, bias detection, and drift analysis. Without data capture, teams cannot audit or validate model behavior in production, undermining accountability and transparency.

Answer

It requires human approval before deploying any model

Answer

It prevents the use of GPU instances to reduce cost

Answer

It restricts endpoints to only use models built in SageMaker

Question 4

A data scientist runs the SageMaker Clarify job shown in the exhibit for a credit risk model. After reviewing the results, they find a high bias metric for the gender facet. Which action is most consistent with responsible AI?

Accepted Answer

Investigate the root cause and retrain with balanced data. Option C is correct because responsible AI requires understanding and mitigating bias at its source, not just masking it. Investigating the root cause (e.g., data collection bias, labeling bias, or proxy features) and retraining with balanced data directly addresses the high bias metric detected by SageMaker Clarify, aligning with AWS's principle of fairness. Simply removing the gender attribute may not eliminate bias if other features act as proxies, and increasing the threshold does not fix the underlying model bias.

Answer

Proceed with deployment because the model is already in production

Answer

Remove the gender attribute from the training data and retrain

Answer

Increase the acceptance threshold for the model

Question 5

A financial services company is deploying a generative AI chatbot to assist customers with account inquiries. The company wants to ensure the chatbot does not generate biased or harmful responses. Which combination of AWS services and practices should the company implement to monitor and mitigate these risks?

Accepted Answer

Use Amazon SageMaker Clarify to detect bias in model outputs and implement a human-in-the-loop workflow with Amazon A2I to review flagged responses.. Option C is correct because Amazon SageMaker Clarify is specifically designed to detect bias in machine learning models and their outputs, while Amazon Augmented AI (A2I) enables a human-in-the-loop workflow to review flagged responses. This combination directly addresses the requirement to monitor and mitigate biased or harmful responses from a generative AI chatbot, ensuring responsible AI practices.

Answer

Configure the chatbot to use a pre-trained model from SageMaker JumpStart and disable logging to avoid storing sensitive customer data.

Answer

Use Amazon Rekognition to analyze chat logs for biased language and automatically block responses with a confidence score above 90%.

Answer

Deploy Amazon Lex with built-in sentiment analysis to detect negative customer emotions and automatically escalate to a human agent.

Question 6

A healthcare company is deploying a machine learning model on Amazon SageMaker to analyze patient records. The model requires access to a DynamoDB table containing patient data. Which combination of AWS services and features should the company use to restrict access to only the necessary resources?

Accepted Answer

Create an IAM role with a policy granting read-only access to the specific DynamoDB table and attach it to the SageMaker notebook instance. Option B is correct because it follows the AWS principle of least privilege by creating an IAM role with a policy that grants read-only access to the specific DynamoDB table, then attaching that role to the SageMaker notebook instance. This ensures the notebook can only perform read operations on the required table without exposing long-term credentials or granting broader permissions.

Answer

Attach a DynamoDB resource-based policy to the table allowing access from the SageMaker notebook

Answer

Store AWS access keys in the notebook and use those credentials to access DynamoDB

Answer

Launch the SageMaker notebook in a VPC with a security group that allows access to DynamoDB

Question 7

A company is using Amazon Textract to extract text from scanned documents stored in an S3 bucket. The security team requires that all access to the documents be logged and that the documents be encrypted at rest using a customer-managed key. What should the company do to meet these requirements?

Accepted Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS) and enable CloudTrail data events for the S3 bucket. Option B is correct because enabling S3 server-side encryption with AWS KMS (SSE-KMS) satisfies the requirement for encryption at rest using a customer-managed key, and enabling CloudTrail data events for the S3 bucket captures all access to the documents (including GetObject, PutObject, etc.) for logging. This combination meets both security requirements precisely.

Answer

Use S3 default encryption and enable Textract logging

Answer

Enable S3 server access logs and use S3 SSE-KMS

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3) and enable S3 access logs

Question 8

A company is using Amazon SageMaker to train machine learning models. The security team wants to ensure that the training data is encrypted at rest and that the SageMaker notebook instances cannot access the internet. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS) for the training data bucket. Option A is correct because enabling S3 server-side encryption with AWS KMS (SSE-KMS) ensures that the training data stored in the S3 bucket is encrypted at rest. This satisfies the security team's requirement for data encryption at rest, as SSE-KMS provides envelope encryption with a customer-managed or AWS-managed KMS key, giving the company control over the encryption keys and auditability via AWS CloudTrail.

Answer

Create an AWS CloudTrail trail to log all S3 data events

Answer

Enable encryption at rest for the SageMaker endpoint using the AWS Management Console

Answer

Use AWS Security Token Service (STS) to generate temporary credentials for the notebook instance

Question 9

A company is deploying an Amazon Lex chatbot that processes customer credit card information. The company must ensure that the chatbot does not log sensitive data and that the data is encrypted in transit. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Ensure the Amazon Lex endpoint uses HTTPS for all API calls. Option A is correct because Amazon Lex endpoints support HTTPS, which encrypts data in transit using TLS. By ensuring all API calls use HTTPS, the company protects sensitive credit card information from being intercepted during communication between the client and the Lex service.

Answer

Enable CloudTrail data events for the Lex bot to capture conversation logs

Answer

Enable S3 server access logs on the bucket storing the Lex bot configuration

Question 10

Refer to the exhibit. An IAM policy is attached to a role used by an Amazon SageMaker notebook instance. The notebook instance attempts to upload a model artifact to the S3 bucket 'my-bucket' without specifying server-side encryption. What will happen?

Accepted Answer

The upload fails with an access denied error. Option D is correct because the IAM policy attached to the SageMaker role includes a condition that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with a value of 'AES256'. Since the notebook instance attempts to upload without specifying server-side encryption, the condition is not met, and the request is denied with an access denied error. S3 default bucket encryption does not override explicit IAM policy conditions that require encryption headers in the request.

Answer

The upload succeeds because S3 automatically encrypts objects at rest

Answer

The upload fails because the policy does not allow PutObject without encryption

Answer

The upload succeeds because the bucket has default encryption enabled

Question 11

Refer to the exhibit. A company has the S3 bucket policy shown above. The company uses Amazon Rekognition to analyze images in the 'my-images' bucket. An IAM role used by a Lambda function calls Rekognition. Why might Rekognition be unable to read images from the bucket?

Accepted Answer

The condition 'aws:SourceAccount' does not match the account of the Rekognition service. The bucket policy includes a condition 'aws:SourceAccount' that restricts access to requests originating from a specific AWS account. If the Rekognition service is being called from a different account (e.g., the Lambda function's IAM role is in a different account than the one specified in the condition), Rekognition will be denied read access to the S3 bucket. This condition is often misconfigured, causing cross-account access failures even when the principal is allowed.

Answer

The Lambda function does not have an IAM role that allows Rekognition to call S3

Answer

The bucket policy does not grant Rekognition access to the bucket

Answer

The bucket policy does not include PutObject permission

Question 12

Which THREE of the following are benefits of using Amazon Bedrock for foundation models?

Accepted Answer

Access to multiple models via single API. Amazon Bedrock provides a single API endpoint that allows you to access multiple foundation models from different providers (e.g., Anthropic, AI21 Labs, Meta, Stability AI) without managing separate integrations. This simplifies application development and reduces operational overhead by abstracting the underlying model infrastructure.

Answer

Ability to fine-tune models

Answer

Guaranteed output accuracy

Question 13

A company wants to use AI to automatically transcribe customer service calls into text. Which AWS service is most suitable?

Accepted Answer

Amazon Transcribe. Amazon Transcribe is the correct choice because it is a fully managed automatic speech recognition (ASR) service designed specifically to convert speech into text. It can handle real-time streaming or batch processing of audio files, making it ideal for transcribing customer service calls into searchable text.

Answer

Amazon Comprehend

Answer

Amazon Polly

Answer

Amazon Rekognition

Question 14

A company is training a deep learning model for image classification. Which THREE practices help reduce overfitting? (Choose three.)

Accepted Answer

L2 regularization. L2 regularization (also known as weight decay) adds a penalty proportional to the square of the weight magnitudes to the loss function. This discourages the model from learning overly complex patterns by forcing weights to stay small, which reduces overfitting by limiting the model's capacity to fit noise in the training data.

Answer

Increasing model depth

Answer

Increasing learning rate

Question 15

A company wants to automatically detect anomalies in their AWS CloudTrail logs to identify potential security threats. Which AWS service is specifically designed for this purpose?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts and workloads using machine learning, anomaly detection, and integrated threat intelligence. It specifically analyzes CloudTrail management and data events, VPC Flow Logs, and DNS logs to identify unauthorized behavior or potential security threats, making it the correct choice for automatically detecting anomalies in CloudTrail logs.

Answer

Amazon Macie

Answer

AWS Config

Answer

Amazon Inspector