AIF-C01 Practice Test 32 — 15 Questions

Question 1

A machine learning engineer notices that a SageMaker training job failed due to insufficient permissions to access a KMS-encrypted S3 bucket. The training job's IAM role has S3 access permissions. What should be done to resolve the issue?

Accepted Answer

Add a kms:Decrypt permission to the IAM role for the specific KMS key used to encrypt the S3 bucket. The training job failed because the IAM role lacks permission to decrypt the KMS key used for S3 server-side encryption. Even with S3 access permissions, SageMaker cannot read encrypted objects without the kms:Decrypt action on the specific KMS key. Adding kms:Decrypt to the role's policy for that key resolves the issue.

Answer

Create a new KMS key and re-encrypt the data

Answer

Assign the SageMakerFullAccess policy to the role

Answer

Change the S3 bucket's default encryption to S3-managed keys (SSE-S3)

Question 2

A research organization is using Amazon SageMaker Studio to collaborate on building machine learning models. The security policy requires that all data and code remain within a VPC and cannot be accessed from the public internet. Additionally, the organization wants to enforce that only approved base images are used for the Studio environment. How should the organization configure SageMaker Studio to meet these requirements?

Accepted Answer

Configure the Studio domain in VPC Only mode and use a SageMaker Studio lifecycle configuration to restrict the list of available base images to those in a private Amazon ECR repository.. Option B is correct because configuring the SageMaker Studio domain in VPC Only mode ensures that all data and code remain within the VPC and cannot be accessed from the public internet. Additionally, using a lifecycle configuration script to restrict available base images to those in a private Amazon ECR repository enforces the policy that only approved base images are used, as the lifecycle configuration can modify the Jupyter Server settings to limit the image registry.

Answer

Use an AWS Transit Gateway to connect the VPC, and enforce HTTPS for all traffic.

Answer

Configure the Studio domain to disable direct internet access, and let users choose any base image from the SageMaker public registry.

Answer

Use AWS CloudFormation to create a Studio domain in a VPC and rely on individuals to use approved images.

Question 3

A security analyst is reviewing CloudTrail logs for SageMaker API calls to identify which user executed a particular training job. The logs show assumed roles. In which CloudTrail event field can the analyst find the name of the user who assumed the role?

Accepted Answer

userIdentity.sessionContext.sessionIssuer.userName. When a user assumes an IAM role to perform SageMaker actions, the CloudTrail log records the assumed role's ARN in the `userIdentity.arn` field, but the original user's identity is preserved in the `userIdentity.sessionContext.sessionIssuer.userName` field. This field contains the name of the IAM user or role that initiated the `sts:AssumeRole` call, allowing the analyst to trace back to the actual user who assumed the role.

Answer

userIdentity.arn

Answer

eventName

Answer

requestParameters

Question 4

A company wants to ensure that only approved machine learning models are deployed to production on Amazon SageMaker. Which combination of services can enforce this governance requirement?

Accepted Answer

AWS Config custom rules and AWS IAM policies. Option D is correct because AWS Config custom rules can evaluate SageMaker model deployment configurations against defined policies (e.g., requiring models to be from an approved registry), and AWS IAM policies can restrict who can create or update endpoints, together enforcing that only approved ML models are deployed. This combination provides both continuous compliance checking and access control, directly addressing the governance requirement.

Answer

AWS CodePipeline and Amazon CodeGuru

Answer

Amazon CloudWatch Events and AWS CloudTrail

Answer

AWS Organizations and AWS Artifact

Question 5

A company is using Amazon Bedrock to deploy a chatbot. They want to ensure that the chatbot does not produce harmful or biased content. Which TWO AWS services or features can be used together to implement content moderation and monitoring?

Accepted Answer

Amazon Bedrock Guardrails for content filtering. Amazon Bedrock Guardrails (Option D) is correct because it provides built-in content filtering capabilities specifically designed for foundation models, allowing you to define denied topics, filter harmful content, and enforce safety policies directly within the Bedrock chatbot workflow. Amazon CloudWatch Logs (Option E) is correct because it enables you to log model inputs and outputs, which can be monitored for compliance, audited for bias, and used to trigger alerts when harmful content is detected. Together, they form a comprehensive content moderation and monitoring solution that addresses both proactive filtering and reactive analysis.

Answer

Amazon SageMaker Model Monitor for drift detection

Answer

Amazon Rekognition for image moderation

Answer

Amazon Comprehend for sentiment analysis

Question 6

A data science team is using Amazon SageMaker to build a model. They want to ensure that only authorized users can deploy models to production. Which TWO methods can they use to enforce this?

Accepted Answer

Use SageMaker Model Registry to require approval before deployment.. Option A is correct because SageMaker Model Registry allows you to set up an approval workflow for model versions. By requiring explicit approval before a model can be deployed to production, you enforce a governance gate that prevents unauthorized or unverified models from being used in production endpoints.

Answer

Enable multi-factor authentication (MFA) for all AWS accounts.

Answer

Use AWS CloudTrail to audit deployment actions.

Answer

Use Amazon GuardDuty to monitor for unauthorized deployment.

Question 7

A team is using Amazon SageMaker to deploy a real-time inference endpoint. The endpoint must be accessible only from a specific IP range and must automatically scale based on request volume. Which configuration meets these requirements?

Accepted Answer

Configure the endpoint with a VPC and attach a security group that allows inbound traffic from the IP range, and enable automatic scaling for the endpoint.. Option B is correct because Amazon SageMaker endpoints can be deployed within a VPC, allowing you to attach a security group that restricts inbound traffic to a specific IP range. Additionally, SageMaker supports automatic scaling for real-time endpoints using Application Auto Scaling, which adjusts the number of instances based on request volume metrics like InvocationsPerInstance.

Answer

Deploy the endpoint in a public subnet with a security group allowing the IP range.

Answer

Deploy the endpoint with a VPC and use a Network Load Balancer with target group health checks.

Answer

Deploy the endpoint with an AWS WAF ACL to filter by IP and enable auto scaling for the endpoint.

Question 8

A company uses Amazon Rekognition to analyze images for a user-generated content platform. To comply with data residency requirements, they must ensure that images are not processed outside a specific AWS region. What should the company do?

Accepted Answer

Use an AWS Lambda function to copy images to a bucket in the desired region and invoke Rekognition there.. Option B is correct because it directly addresses the data residency requirement by using a Lambda function to copy images to an S3 bucket in the desired region and then invoking Rekognition in that same region. This ensures that image data never leaves the specified AWS region, as Rekognition processes images only in the region where the API call is made. The other options either do not prevent cross-region processing or are not applicable to Rekognition's data handling.

Answer

Enable Amazon Rekognition VPC endpoints.

Answer

Configure an AWS WAF rule to block cross-region processing.

Answer

Set up AWS Organizations to restrict the Rekognition service to one region.

Question 9

An organization uses Amazon Bedrock to generate content. They have implemented guardrails to block toxic content. However, some users are able to bypass the guardrails by encoding their prompts. What step should be taken to improve security?

Accepted Answer

Enable prompt injection detection in the guardrail configuration.. Option B is correct because Amazon Bedrock guardrails include a built-in prompt injection detection capability that can identify and block attempts to bypass content filters through encoded or obfuscated prompts. Enabling this feature specifically addresses the scenario where users encode their inputs to evade toxic content blocking, as it analyzes the decoded intent of the prompt rather than just the surface-level encoding.

Answer

Encode the prompts before sending to the model.

Answer

Use a different foundation model that is less susceptible.

Answer

Restrict access to the model using IAM policies.

Question 10

A company is using Amazon Bedrock to deploy a foundation model. To comply with GDPR, they need to ensure that the model does not generate outputs containing personally identifiable information (PII). Which AWS service can best help detect and redact PII from the model's responses?

Accepted Answer

Amazon Comprehend. Amazon Comprehend is the correct service because it provides a built-in PII detection and redaction capability that can be integrated with Amazon Bedrock. Using the `DetectPiiEntities` API, you can scan model responses for PII such as names, addresses, and credit card numbers, and then redact or mask those entities before returning the output to the user. This directly addresses the GDPR requirement to prevent PII leakage from generative AI outputs.

Answer

Amazon GuardDuty

Answer

Amazon Rekognition

Answer

AWS WAF

Question 11

A company uses Amazon SageMaker for model training. To comply with data residency requirements, they must ensure that the training data never leaves a specific AWS region. However, during training, the SageMaker service might use resources in other regions for auto-scaling. Which configuration should they use to enforce data residency?

Accepted Answer

Use AWS Organizations to create an SCP that denies access to SageMaker resources in other regions.. Option C is correct because AWS Organizations Service Control Policies (SCPs) can explicitly deny access to SageMaker resources in any region outside the allowed one. By attaching an SCP that denies `sagemaker:*` actions when the `aws:RequestedRegion` condition key does not match the permitted region, the company can enforce data residency at the account level, preventing SageMaker from provisioning resources in other regions even if auto-scaling would otherwise trigger cross-region activity.

Answer

Configure the training job to use only local spot instances and enable network isolation.

Answer

Use Amazon SageMaker's inter-container traffic encryption and disable cross-region data transfer.

Answer

Use a VPC with a VPC endpoint for SageMaker and restrict the training job to use only local resources.

Question 12

Refer to the exhibit. A data scientist is trying to run a SageMaker training job that uses training data from an S3 bucket encrypted with the specified KMS key. The training job fails with an access denied error. The IAM role shown is attached to the training job. What is the missing permission?

Accepted Answer

kms:CreateGrant. When a SageMaker training job accesses encrypted S3 data, it must be granted permission to use the KMS key for decryption. The `kms:CreateGrant` permission allows SageMaker to create a grant on the KMS key, which is required for the service to decrypt the data on behalf of the user. Without this permission, the training job fails with an access denied error even if other KMS actions are allowed.

Answer

s3:ListBucket

Answer

kms:GenerateDataKey

Answer

s3:GetBucketLocation

Question 13

A data engineer needs to ensure that all data uploaded to an S3 bucket for SageMaker training is automatically encrypted with a customer-managed key. Which S3 feature should they enable?

Accepted Answer

Default encryption with SSE-KMS using a customer managed key (CMK).. Option C is correct because the requirement specifies a customer-managed key (CMK). Default encryption with SSE-KMS allows you to specify a CMK, ensuring all objects uploaded to the S3 bucket are automatically encrypted using that key. This satisfies the data engineer's need for control over the encryption key.

Answer

Object lock with compliance mode.

Answer

Default encryption with SSE-KMS using an AWS managed key.

Answer

Default encryption with SSE-S3.

Question 14

A company is using Amazon Bedrock to generate content for a marketing application. The company wants to ensure that the model does not generate content that violates the company's brand guidelines, which prohibit certain keywords and tones. Which TWO features should the company use to enforce these guidelines? (Choose two.)

Accepted Answer

Create a prompt template that instructs the model to adhere to brand guidelines and avoid prohibited keywords.. Option B is correct because prompt engineering allows the company to embed brand guidelines directly into the instruction given to the model, effectively steering the output away from prohibited keywords and tones. Option C is correct because Amazon Bedrock Guardrails provides a managed, policy-based mechanism to define custom deny topics and content filters that can block or mask unwanted content at inference time, enforcing brand guidelines without manual intervention.

Answer

Enable Amazon CloudWatch Logs to capture model output and manually review.

Answer

Use AWS IAM policies to restrict the model's output to only approved words.

Answer

Encrypt the model responses using AWS KMS to prevent unauthorized viewing.

Question 15

A company is deploying an AI-based customer service chatbot using Amazon Lex and AWS Lambda. The company must ensure compliance with GDPR by allowing users to request deletion of their personal data collected during conversations. Which TWO actions should the company take? (Choose two.)

Accepted Answer

Use the Amazon Lex DeleteTranscript API to delete user conversation transcripts.. Option A is correct because Amazon Lex provides the DeleteTranscript API, which allows the deletion of user conversation transcripts stored by Lex. This directly supports GDPR compliance by enabling the removal of personal data from conversation logs. The API targets the specific transcripts associated with a user, ensuring that their data is permanently deleted.

Answer

Apply an IAM policy that denies access to the conversation logs for the user who requested deletion.

Answer

Disable encryption of conversation logs to allow manual deletion.

Answer

Modify the Lex bot's conversation log settings to stop collecting personal data.