AIF-C01 Security, Compliance and Governance for AI Solutions — 20 Questions

Question 1

A healthcare company is deploying a machine learning model on Amazon SageMaker to analyze patient records. The model requires access to a DynamoDB table containing patient data. Which combination of AWS services and features should the company use to restrict access to only the necessary resources?

Accepted Answer

Create an IAM role with a policy granting read-only access to the specific DynamoDB table and attach it to the SageMaker notebook instance. Option B is correct because it follows the AWS principle of least privilege by creating an IAM role with a policy that grants read-only access to the specific DynamoDB table, then attaching that role to the SageMaker notebook instance. This ensures the notebook can only perform read operations on the required table without exposing long-term credentials or granting broader permissions.

Answer

Attach a DynamoDB resource-based policy to the table allowing access from the SageMaker notebook

Answer

Store AWS access keys in the notebook and use those credentials to access DynamoDB

Answer

Launch the SageMaker notebook in a VPC with a security group that allows access to DynamoDB

Question 2

A company uses Amazon Rekognition to analyze images stored in an S3 bucket. The security team requires that all image analysis be logged to AWS CloudTrail for auditing. What is the minimum configuration needed to meet this requirement?

Accepted Answer

Enable CloudTrail data events for the S3 bucket to capture GetObject API calls. Option D is correct because CloudTrail data events capture S3 object-level API operations such as GetObject, which is the API call made by Amazon Rekognition when it retrieves images from the S3 bucket for analysis. By enabling data events for the S3 bucket, every GetObject request is logged to CloudTrail, providing the audit trail the security team requires. Management events alone do not capture object-level operations, and S3 server access logs are not integrated with CloudTrail for auditing.

Answer

Enable Rekognition logging in the AWS Management Console

Answer

Enable CloudTrail management events for the S3 bucket

Answer

Enable S3 server access logs on the bucket

Question 3

A financial services company is building a predictive model using Amazon SageMaker. The model training data contains personally identifiable information (PII). The company must ensure that the data is encrypted at rest and in transit, and that access to the data is logged. Which combination of AWS services meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS (SSE-KMS), enable SageMaker inter-container traffic encryption, and enable CloudTrail data events for the S3 bucket. Option B is correct because it addresses all three requirements: SSE-KMS encrypts data at rest in S3, SageMaker inter-container traffic encryption ensures data in transit between training containers is encrypted, and CloudTrail data events for the S3 bucket log all access to the PII data. This combination provides a complete, auditable encryption and logging solution.

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3) and enable CloudTrail trail for S3 data events

Answer

Use S3 client-side encryption and configure SageMaker to use HTTPS for inter-container traffic

Answer

Enable S3 default encryption with AES-256 and use AWS CloudTrail for S3 data events

Question 4

A data scientist needs to grant an IAM user access to a specific Amazon SageMaker notebook instance. The user should only be able to start and stop the notebook instance, but not delete it. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":["sagemaker:StartNotebookInstance","sagemaker:StopNotebookInstance"],"Resource":"arn:aws:sagemaker:us-east-1:123456789012:notebook-instance/MyNotebook"}. Option B is correct because it uses the specific actions `sagemaker:StartNotebookInstance` and `sagemaker:StopNotebookInstance` with a resource ARN that targets only the intended notebook instance. This grants the least privilege required to start and stop the instance while explicitly preventing deletion, as no delete action is included. The resource ARN restricts the policy to a single notebook instance, ensuring the user cannot affect other resources.

Answer

{"Effect":"Allow","Action":["sagemaker:Start*","sagemaker:Stop*"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"sagemaker:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"sagemaker:*","Resource":"arn:aws:sagemaker:us-east-1:123456789012:notebook-instance/MyNotebook"}

Question 5

A company is using Amazon Comprehend to extract entities from customer support tickets. The compliance team requires that the text sent to Comprehend be encrypted in transit and that Comprehend does not store any data beyond the processing time. How should the company configure the API call?

Accepted Answer

Use the HTTPS endpoint for the DetectEntities API and rely on Comprehend's stateless design. Option D is correct because Amazon Comprehend's DetectEntities API is inherently stateless—it does not store any text or results beyond the processing time required to generate the response. By using the HTTPS endpoint, the company ensures encryption in transit via TLS, satisfying the compliance requirement without additional configuration. Comprehend does not persist data from synchronous API calls, so no data is retained after the response is returned.

Answer

Encrypt the text using AWS KMS before sending it to Comprehend

Answer

Use the AWS SDK with server-side encryption enabled for the API call

Answer

Create a VPC endpoint for Comprehend and send requests over the private network

Question 6

A company uses Amazon SageMaker to host a real-time inference endpoint. The model was trained on sensitive data, and the company wants to ensure that the data sent to the endpoint is encrypted in transit. Additionally, the company wants to restrict access to the endpoint to only traffic originating from a specific VPC. Which configuration meets these requirements?

Accepted Answer

Create the SageMaker endpoint in a VPC, associate a security group that allows inbound HTTPS from the VPC CIDR, and configure the endpoint to use HTTPS. Option A is correct because creating the SageMaker endpoint within a VPC and associating a security group that restricts inbound HTTPS traffic to the VPC CIDR ensures that only traffic from within that VPC can reach the endpoint. Configuring the endpoint to use HTTPS encrypts data in transit using TLS, meeting both the encryption and VPC-only access requirements.

Answer

Configure the SageMaker endpoint to use mutual TLS (mTLS) with client certificates

Answer

Place the SageMaker endpoint behind an Amazon CloudFront distribution with an origin access identity

Answer

Use AWS STS to generate temporary credentials and require the client to sign requests with them

Question 7

A company is using Amazon Textract to extract text from scanned documents stored in an S3 bucket. The security team requires that all access to the documents be logged and that the documents be encrypted at rest using a customer-managed key. What should the company do to meet these requirements?

Accepted Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS) and enable CloudTrail data events for the S3 bucket. Option B is correct because enabling S3 server-side encryption with AWS KMS (SSE-KMS) satisfies the requirement for encryption at rest using a customer-managed key, and enabling CloudTrail data events for the S3 bucket captures all access to the documents (including GetObject, PutObject, etc.) for logging. This combination meets both security requirements precisely.

Answer

Use S3 default encryption and enable Textract logging

Answer

Enable S3 server access logs and use S3 SSE-KMS

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3) and enable S3 access logs

Question 8

A company is using Amazon SageMaker to train machine learning models. The security team wants to ensure that the training data is encrypted at rest and that the SageMaker notebook instances cannot access the internet. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Enable S3 server-side encryption with AWS KMS (SSE-KMS) for the training data bucket. Option A is correct because enabling S3 server-side encryption with AWS KMS (SSE-KMS) ensures that the training data stored in the S3 bucket is encrypted at rest. This satisfies the security team's requirement for data encryption at rest, as SSE-KMS provides envelope encryption with a customer-managed or AWS-managed KMS key, giving the company control over the encryption keys and auditability via AWS CloudTrail.

Answer

Create an AWS CloudTrail trail to log all S3 data events

Answer

Enable encryption at rest for the SageMaker endpoint using the AWS Management Console

Answer

Use AWS Security Token Service (STS) to generate temporary credentials for the notebook instance

Question 9

A company is deploying an Amazon Lex chatbot that processes customer credit card information. The company must ensure that the chatbot does not log sensitive data and that the data is encrypted in transit. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Ensure the Amazon Lex endpoint uses HTTPS for all API calls. Option A is correct because Amazon Lex endpoints support HTTPS, which encrypts data in transit using TLS. By ensuring all API calls use HTTPS, the company protects sensitive credit card information from being intercepted during communication between the client and the Lex service.

Answer

Enable CloudTrail data events for the Lex bot to capture conversation logs

Answer

Enable S3 server access logs on the bucket storing the Lex bot configuration

Question 10

A company is using Amazon Rekognition to detect objects in images stored in an S3 bucket. The company needs to ensure that the Rekognition service has permission to read images from the S3 bucket. Which TWO methods can achieve this? (Choose TWO.)

Accepted Answer

Attach an IAM role to the Lambda function that calls Rekognition, with an IAM policy granting s3:GetObject on the bucket. Option A is correct because when a Lambda function calls Amazon Rekognition, the function needs an IAM role with a policy that grants s3:GetObject permission on the source bucket. This allows the Lambda function to read the images and pass them to Rekognition for analysis. Option E is correct because you can attach a bucket policy that explicitly grants the Rekognition service principal (rekognition.amazonaws.com) permission to read objects, enabling Rekognition to directly access the S3 bucket when invoked.

Answer

Create an IAM role for Rekognition to assume and attach it to the Rekognition service

Answer

Configure the S3 bucket with a bucket ACL that grants read access to the Rekognition service

Answer

Attach a resource-based policy to the Rekognition collection allowing S3 access

Question 11

Refer to the exhibit. An IAM policy is attached to a role used by an Amazon SageMaker notebook instance. The notebook instance attempts to upload a model artifact to the S3 bucket 'my-bucket' without specifying server-side encryption. What will happen?

Accepted Answer

The upload fails with an access denied error. Option D is correct because the IAM policy attached to the SageMaker role includes a condition that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with a value of 'AES256'. Since the notebook instance attempts to upload without specifying server-side encryption, the condition is not met, and the request is denied with an access denied error. S3 default bucket encryption does not override explicit IAM policy conditions that require encryption headers in the request.

Answer

The upload succeeds because S3 automatically encrypts objects at rest

Answer

The upload fails because the policy does not allow PutObject without encryption

Answer

The upload succeeds because the bucket has default encryption enabled

Question 12

Refer to the exhibit. A company has the S3 bucket policy shown above. The company uses Amazon Rekognition to analyze images in the 'my-images' bucket. An IAM role used by a Lambda function calls Rekognition. Why might Rekognition be unable to read images from the bucket?

Accepted Answer

The condition 'aws:SourceAccount' does not match the account of the Rekognition service. The bucket policy includes a condition 'aws:SourceAccount' that restricts access to requests originating from a specific AWS account. If the Rekognition service is being called from a different account (e.g., the Lambda function's IAM role is in a different account than the one specified in the condition), Rekognition will be denied read access to the S3 bucket. This condition is often misconfigured, causing cross-account access failures even when the principal is allowed.

Answer

The Lambda function does not have an IAM role that allows Rekognition to call S3

Answer

The bucket policy does not grant Rekognition access to the bucket

Answer

The bucket policy does not include PutObject permission

Question 13

A company is deploying a generative AI model on Amazon Bedrock. The model is accessed by an application running on Amazon ECS Fargate. The security team requires that all data sent to and from the Bedrock model be encrypted in transit, and that the ECS task does not have internet access. The ECS tasks are launched in a private VPC subnet with a VPC endpoint for Bedrock configured. However, when the application attempts to invoke the Bedrock model, the call fails with a timeout error. The VPC endpoint policy is set to allow all actions from all principals. What is the most likely cause of the failure?

Accepted Answer

The security group associated with the VPC endpoint does not allow inbound HTTPS traffic from the ECS tasks. The timeout error indicates a network connectivity issue, not an authentication or authorization problem. Since the ECS tasks are in a private subnet without internet access and a VPC endpoint for Bedrock is configured, the most likely cause is that the security group associated with the VPC endpoint does not allow inbound HTTPS (port 443) traffic from the ECS tasks. Without this inbound rule, the TCP handshake fails, resulting in a timeout.

Answer

The ECS tasks are not configured to use a NAT gateway to reach the Bedrock endpoint

Answer

The VPC endpoint policy does not grant the ECS task IAM role permission to invoke Bedrock

Answer

The ECS task IAM role does not have the bedrock:InvokeModel permission

Question 14

A healthcare company is using Amazon SageMaker to train and deploy a model that predicts patient readmission risk. The model uses sensitive protected health information (PHI). The company must ensure that data is encrypted at rest and in transit, and that access to the model endpoint is restricted to authorized applications only. The security team has configured AWS KMS customer managed keys for encryption, and IAM roles for SageMaker execution. However, during a security audit, it was discovered that the model endpoint is accessible from the internet and that the data used for training was stored in an S3 bucket with default encryption enabled. The compliance team requires that all PHI data be encrypted with a key that is rotated annually, and that no public access is allowed to the endpoint or training data. Which combination of actions should the ML engineer take to remediate these issues?

Accepted Answer

Enable S3 bucket encryption with a customer managed KMS key, disable public access on the SageMaker endpoint by deploying it in a VPC, and configure the KMS key to rotate annually.. Option D is correct because it addresses all compliance requirements: enabling S3 bucket encryption with a customer managed KMS key ensures PHI is encrypted at rest with a key that can be rotated annually, deploying the SageMaker endpoint in a VPC removes public internet access, and configuring annual KMS key rotation satisfies the rotation policy. This combination ensures encryption at rest and in transit (via VPC), restricts endpoint access to authorized applications only, and meets the key rotation requirement.

Answer

Use a SageMaker notebook instance with a lifecycle configuration to encrypt data with a customer managed KMS key, and restrict endpoint access using an IAM policy.

Answer

Enable S3 bucket encryption with SSE-S3, attach a bucket policy denying public access, and use an AWS Lambda function to rotate the S3 bucket key every year.

Answer

Apply SSE-KMS with an AWS managed key to the S3 bucket, and use a Lambda function to rotate the key every year. Disable public access to the endpoint using a VPC endpoint.

Question 15

A company is using Amazon Bedrock to generate responses for customer support. They want to ensure that the model does not expose personally identifiable information (PII) in its outputs. Which AWS feature can be configured to automatically redact PII from model responses?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails is the correct choice because it provides configurable policies that can automatically detect and redact personally identifiable information (PII) from model inputs and outputs. This feature is specifically designed for Amazon Bedrock to enforce content safety and compliance requirements, including PII redaction, without requiring custom code or external services.

Answer

Amazon Macie

Answer

Amazon SageMaker Model Monitor

Answer

AWS CloudTrail

Question 16

A machine learning team needs to share a trained model with multiple teams across different AWS accounts. The model artifacts are stored in an S3 bucket in the central account. What is the most secure way to grant cross-account read access to the model artifacts?

Accepted Answer

Use AWS KMS to encrypt the artifacts and share the KMS key with the target accounts, then use bucket policies and IAM roles in the target accounts.. Option D is correct because it implements a defense-in-depth approach: AWS KMS encrypts the model artifacts at rest, and cross-account access is granted by combining an S3 bucket policy that allows the target accounts' IAM roles to read the objects, with those roles assuming the necessary permissions. This ensures that only authenticated and authorized IAM principals in the target accounts can decrypt and access the artifacts, preventing unauthorized access even if the bucket policy is misconfigured.

Answer

Use an S3 bucket policy that grants access to the root user of each target account.

Answer

Make the S3 bucket public.

Answer

Use S3 cross-region replication to copy the artifacts to each target account's bucket.

Question 17

A company is using Amazon SageMaker to train a model. The training data is stored in an S3 bucket that is encrypted with an AWS KMS customer managed key (CMK). The training job fails with an error indicating that the SageMaker execution role does not have permission to decrypt the data. The administrator has verified that the execution role has the kms:Decrypt permission. What additional permission might be missing?

Accepted Answer

kms:CreateGrant. When SageMaker accesses encrypted S3 data, it must create a grant on the KMS key to allow the SageMaker service principal to decrypt the data on behalf of the execution role. Even if the execution role has kms:Decrypt, SageMaker itself needs permission to call kms:CreateGrant to set up this delegated access. Without kms:CreateGrant, the service cannot establish the necessary cryptographic context for the training job.

Answer

kms:ReEncrypt

Answer

kms:DescribeKey

Answer

kms:GenerateDataKey

Question 18

A company wants to monitor for malicious activity in their machine learning pipelines, such as unauthorized access to training data or model artifacts. Which AWS service can provide automated threat detection and continuous monitoring?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS workloads, including machine learning pipelines. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as unauthorized access to S3 buckets containing training data or model artifacts, without requiring manual intervention.

Answer

AWS Config

Answer

AWS Shield

Answer

Amazon Inspector

Question 19

A data scientist is using Amazon SageMaker Studio. The company policy requires that all data used in SageMaker Studio notebooks be encrypted at rest and in transit. Which configuration should be enabled to meet this requirement?

Accepted Answer

Enable SageMaker Studio's data encryption using a customer managed key (CMK) and configure the notebook to use HTTPS for all traffic.. Option D is correct because it addresses both encryption at rest and in transit. SageMaker Studio uses Amazon EFS for persistent storage, and enabling encryption at rest with a customer managed key (CMK) ensures data on the EFS file system is encrypted. Additionally, configuring the notebook to use HTTPS ensures all traffic between the notebook and other services is encrypted in transit, meeting the company policy.

Answer

Store all data in encrypted DynamoDB tables and query from notebooks.

Answer

Use a VPC with no internet access and enable S3 encryption for all data.

Answer

Enable SageMaker Studio's default encryption using the AWS managed key for EFS.

Question 20

An organization uses Amazon Bedrock to generate content. They have implemented guardrails to block toxic content. However, some users are able to bypass the guardrails by encoding their prompts. What step should be taken to improve security?

Accepted Answer

Enable prompt injection detection in the guardrail configuration.. Option B is correct because Amazon Bedrock guardrails include a built-in prompt injection detection capability that can identify and block attempts to bypass content filters through encoded or obfuscated prompts. Enabling this feature specifically addresses the scenario where users encode their inputs to evade toxic content blocking, as it analyzes the decoded intent of the prompt rather than just the surface-level encoding.

Answer

Encode the prompts before sending to the model.

Answer

Use a different foundation model that is less susceptible.

Answer

Restrict access to the model using IAM policies.