AIF-C01 Practice Test 9 — 10 Questions

Question 1

A company wants to monitor for malicious activity in their machine learning pipelines, such as unauthorized access to training data or model artifacts. Which AWS service can provide automated threat detection and continuous monitoring?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS workloads, including machine learning pipelines. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as unauthorized access to S3 buckets containing training data or model artifacts, without requiring manual intervention.

Answer

AWS Config

Answer

AWS Shield

Answer

Amazon Inspector

Question 2

A company deploys an Amazon Bedrock agent that uses a knowledge base with sensitive financial documents. The security team requires that all data retrieval queries be logged for auditing, and that the LLM responses do not contain any personally identifiable information (PII). What combination of services should the company use?

Accepted Answer

Enable Amazon CloudWatch Logs for the Bedrock agent and use Amazon Comprehend to redact PII from responses.. Option B is correct because Amazon CloudWatch Logs can capture query logs, and Amazon Comprehend (or Bedrock Guardrails) can detect and redact PII. Option A is wrong because GuardDuty is for threat detection, not PII redaction. Option C is wrong because AWS Config is for resource compliance, not logging queries. Option D is wrong because Macie is for data discovery in S3, not real-time PII redaction in responses.

Answer

Enable AWS CloudTrail for API logging and use Amazon GuardDuty to detect PII in responses.

Answer

Use AWS Config to monitor Bedrock resource configurations and apply an IAM policy to restrict PII.

Answer

Use Amazon S3 server access logs for the knowledge base and enable Amazon Macie to redact PII.

Question 3

A data scientist is using Amazon SageMaker Studio. The company policy requires that all data used in SageMaker Studio notebooks be encrypted at rest and in transit. Which configuration should be enabled to meet this requirement?

Accepted Answer

Enable SageMaker Studio's data encryption using a customer managed key (CMK) and configure the notebook to use HTTPS for all traffic.. Option D is correct because it addresses both encryption at rest and in transit. SageMaker Studio uses Amazon EFS for persistent storage, and enabling encryption at rest with a customer managed key (CMK) ensures data on the EFS file system is encrypted. Additionally, configuring the notebook to use HTTPS ensures all traffic between the notebook and other services is encrypted in transit, meeting the company policy.

Answer

Store all data in encrypted DynamoDB tables and query from notebooks.

Answer

Use a VPC with no internet access and enable S3 encryption for all data.

Answer

Enable SageMaker Studio's default encryption using the AWS managed key for EFS.

Question 4

A company uses Amazon Bedrock to build a generative AI application. They need to secure the application by restricting access to the model and preventing sensitive data from being stored in prompts. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use Amazon Bedrock Guardrails to define content filters and deny topics.. Amazon Bedrock Guardrails (Option C) directly addresses the need to prevent sensitive data from being stored in prompts by allowing you to define content filters, deny topics, and configure sensitive information filters that block or mask such data before it reaches the model. This is the native service feature designed for content safety and data leakage prevention.

Answer

Enable VPC Flow Logs for Bedrock.

Answer

Enable AWS CloudTrail to log all Bedrock API calls.

Answer

Use AWS KMS to encrypt the model data.

Question 5

A company is using Amazon Bedrock to generate responses for customer support. They want to ensure that the model does not expose personally identifiable information (PII) in its outputs. Which AWS feature can be configured to automatically redact PII from model responses?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails is the correct choice because it provides configurable policies that can automatically detect and redact personally identifiable information (PII) from model inputs and outputs. This feature is specifically designed for Amazon Bedrock to enforce content safety and compliance requirements, including PII redaction, without requiring custom code or external services.

Answer

Amazon Macie

Answer

Amazon SageMaker Model Monitor

Answer

AWS CloudTrail

Question 6

An organization uses Amazon Macie to discover sensitive data in S3. The compliance team needs to receive notifications when Macie finds PII. Which AWS service should they use to send notifications?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Macie publishes findings to Amazon EventBridge, which can trigger a target such as an SNS topic. SNS then pushes notifications (e.g., email, SMS, HTTP) to subscribers. This decoupled architecture allows the compliance team to receive real-time alerts when PII is detected, without needing to poll or manage compute resources.

Answer

AWS Lambda

Answer

Amazon CloudWatch

Answer

Amazon Simple Email Service (SES)

Question 7

A company is deploying a machine learning model that processes personal data of EU citizens. Which AWS service can help them comply with the General Data Protection Regulation (GDPR) by tracking data lineage and usage?

Accepted Answer

AWS Audit Manager. AWS Audit Manager is the correct service because it provides prebuilt frameworks and automated evidence collection to help you audit and demonstrate compliance with regulations like GDPR. It specifically tracks data lineage and usage by continuously collecting and organizing evidence from your AWS resources, which is essential for GDPR's requirements on data processing transparency and accountability.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon SageMaker Model Registry

Question 8

A data science team is using Amazon SageMaker Studio. To meet compliance requirements, they need to ensure that all user activity in the environment is logged and that any unauthorized access attempts are detected. Which approach should they take?

Accepted Answer

Enable AWS CloudTrail and Amazon GuardDuty for threat detection.. AWS CloudTrail logs all API activity in SageMaker Studio, including user actions and access attempts, while Amazon GuardDuty provides intelligent threat detection by analyzing CloudTrail logs, VPC flow logs, and DNS logs for unauthorized access patterns. Together, they meet compliance requirements for logging and detecting unauthorized access without additional configuration overhead.

Answer

Enable SageMaker Model Monitor and configure Amazon S3 server access logs.

Answer

Use AWS Config rules to track changes and Amazon Inspector for vulnerability scanning.

Answer

Enable SageMaker Studio with VPC only mode and use AWS CloudTrail.

Question 9

A company uses Amazon SageMaker to host a model for fraud detection. The model must be re-evaluated for bias on a monthly basis. Which SageMaker feature can be used to detect bias in a trained model?

Accepted Answer

SageMaker Clarify. SageMaker Clarify is the correct choice because it is specifically designed to detect bias in machine learning models and data. It provides built-in capabilities to evaluate bias metrics (e.g., difference in positive proportions, disparate impact) both before training (pre-training bias) and after training (post-training bias), making it suitable for the monthly re-evaluation requirement.

Answer

SageMaker Debugger

Answer

SageMaker Model Monitor

Answer

SageMaker Autopilot

Question 10

A company wants to track API calls made to Amazon SageMaker for audit purposes. Which AWS service should they enable?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across AWS services, including Amazon SageMaker. By enabling CloudTrail, the company can capture all SageMaker API calls (e.g., CreateModel, InvokeEndpoint) for audit, compliance, and security analysis. CloudTrail logs provide details such as the identity of the caller, the time of the call, and the request parameters, which are essential for auditing.

Answer

Amazon Macie

Answer

AWS Config

Answer

Amazon CloudWatch Logs