AIF-C01 Security, Compliance and Governance for AI Solutions Practice Test 3 — 15 Questions

Question 1

A data science team is using Amazon SageMaker Studio. To meet compliance requirements, they need to ensure that all user activity in the environment is logged and that any unauthorized access attempts are detected. Which approach should they take?

Accepted Answer

Enable AWS CloudTrail and Amazon GuardDuty for threat detection.. AWS CloudTrail logs all API activity in SageMaker Studio, including user actions and access attempts, while Amazon GuardDuty provides intelligent threat detection by analyzing CloudTrail logs, VPC flow logs, and DNS logs for unauthorized access patterns. Together, they meet compliance requirements for logging and detecting unauthorized access without additional configuration overhead.

Answer

Enable SageMaker Model Monitor and configure Amazon S3 server access logs.

Answer

Use AWS Config rules to track changes and Amazon Inspector for vulnerability scanning.

Answer

Enable SageMaker Studio with VPC only mode and use AWS CloudTrail.

Question 2

A company uses Amazon Bedrock to generate content. They need to guarantee that the model does not produce toxic or biased outputs and that any violations are logged for review. Which service should they integrate with Bedrock?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails is the correct service because it is specifically designed to enforce content policies, filter toxic or biased outputs, and log violations for review within Bedrock workflows. It provides configurable thresholds for harmful categories (e.g., hate, insults, sexual content) and integrates directly with Bedrock models to intercept and redact or block undesired responses, with all violations recorded in Amazon CloudWatch Logs.

Answer

Amazon Comprehend

Answer

AWS WAF

Answer

AWS CloudTrail

Question 3

A company uses Amazon Rekognition to analyze images for a user-generated content platform. To comply with data residency requirements, they must ensure that images are not processed outside a specific AWS region. What should the company do?

Accepted Answer

Use an AWS Lambda function to copy images to a bucket in the desired region and invoke Rekognition there.. Option B is correct because it directly addresses the data residency requirement by using a Lambda function to copy images to an S3 bucket in the desired region and then invoking Rekognition in that same region. This ensures that image data never leaves the specified AWS region, as Rekognition processes images only in the region where the API call is made. The other options either do not prevent cross-region processing or are not applicable to Rekognition's data handling.

Answer

Enable Amazon Rekognition VPC endpoints.

Answer

Configure an AWS WAF rule to block cross-region processing.

Answer

Set up AWS Organizations to restrict the Rekognition service to one region.

Question 4

A team is using Amazon SageMaker to deploy a real-time inference endpoint. The endpoint must be accessible only from a specific IP range and must automatically scale based on request volume. Which configuration meets these requirements?

Accepted Answer

Configure the endpoint with a VPC and attach a security group that allows inbound traffic from the IP range, and enable automatic scaling for the endpoint.. Option B is correct because Amazon SageMaker endpoints can be deployed within a VPC, allowing you to attach a security group that restricts inbound traffic to a specific IP range. Additionally, SageMaker supports automatic scaling for real-time endpoints using Application Auto Scaling, which adjusts the number of instances based on request volume metrics like InvocationsPerInstance.

Answer

Deploy the endpoint in a public subnet with a security group allowing the IP range.

Answer

Deploy the endpoint with a VPC and use a Network Load Balancer with target group health checks.

Answer

Deploy the endpoint with an AWS WAF ACL to filter by IP and enable auto scaling for the endpoint.

Question 5

An organization uses Amazon Macie to discover sensitive data in S3. The compliance team needs to receive notifications when Macie finds PII. Which AWS service should they use to send notifications?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Macie publishes findings to Amazon EventBridge, which can trigger a target such as an SNS topic. SNS then pushes notifications (e.g., email, SMS, HTTP) to subscribers. This decoupled architecture allows the compliance team to receive real-time alerts when PII is detected, without needing to poll or manage compute resources.

Answer

AWS Lambda

Answer

Amazon CloudWatch

Answer

Amazon Simple Email Service (SES)

Question 6

A data engineer needs to ensure that all data uploaded to an S3 bucket for SageMaker training is automatically encrypted with a customer-managed key. Which S3 feature should they enable?

Accepted Answer

Default encryption with SSE-KMS using a customer managed key (CMK).. Option C is correct because the requirement specifies a customer-managed key (CMK). Default encryption with SSE-KMS allows you to specify a CMK, ensuring all objects uploaded to the S3 bucket are automatically encrypted using that key. This satisfies the data engineer's need for control over the encryption key.

Answer

Object lock with compliance mode.

Answer

Default encryption with SSE-KMS using an AWS managed key.

Answer

Default encryption with SSE-S3.

Question 7

A security analyst is reviewing CloudTrail logs for SageMaker API calls to identify which user executed a particular training job. The logs show assumed roles. In which CloudTrail event field can the analyst find the name of the user who assumed the role?

Accepted Answer

userIdentity.sessionContext.sessionIssuer.userName. When a user assumes an IAM role to perform SageMaker actions, the CloudTrail log records the assumed role's ARN in the `userIdentity.arn` field, but the original user's identity is preserved in the `userIdentity.sessionContext.sessionIssuer.userName` field. This field contains the name of the IAM user or role that initiated the `sts:AssumeRole` call, allowing the analyst to trace back to the actual user who assumed the role.

Answer

userIdentity.arn

Answer

eventName

Answer

requestParameters

Question 8

A company uses Amazon SageMaker to host a model for fraud detection. The model must be re-evaluated for bias on a monthly basis. Which SageMaker feature can be used to detect bias in a trained model?

Accepted Answer

SageMaker Clarify. SageMaker Clarify is the correct choice because it is specifically designed to detect bias in machine learning models and data. It provides built-in capabilities to evaluate bias metrics (e.g., difference in positive proportions, disparate impact) both before training (pre-training bias) and after training (post-training bias), making it suitable for the monthly re-evaluation requirement.

Answer

SageMaker Debugger

Answer

SageMaker Model Monitor

Answer

SageMaker Autopilot

Question 9

A company uses Amazon Bedrock to build a generative AI application. They need to secure the application by restricting access to the model and preventing sensitive data from being stored in prompts. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use Amazon Bedrock Guardrails to define content filters and deny topics.. Amazon Bedrock Guardrails (Option C) directly addresses the need to prevent sensitive data from being stored in prompts by allowing you to define content filters, deny topics, and configure sensitive information filters that block or mask such data before it reaches the model. This is the native service feature designed for content safety and data leakage prevention.

Answer

Enable VPC Flow Logs for Bedrock.

Answer

Enable AWS CloudTrail to log all Bedrock API calls.

Answer

Use AWS KMS to encrypt the model data.

Question 10

A data science team uses Amazon SageMaker to train models. To comply with SOC 2, they must ensure that access to training data is logged, that the data is encrypted at rest, and that model training jobs are isolated from each other. Which THREE actions should they take? (Choose three.)

Accepted Answer

Enable server-side encryption on the S3 bucket containing training data using SSE-KMS.. Option B is correct because enabling server-side encryption on the S3 bucket containing training data using SSE-KMS ensures data at rest is encrypted, which is a direct requirement for SOC 2 compliance. SSE-KMS provides envelope encryption with a customer-managed AWS KMS key, allowing fine-grained access control and audit trails for the encryption keys.

Answer

Enable Amazon Inspector to scan training instances for vulnerabilities.

Answer

Use SageMaker Debugger to monitor training jobs.

Question 11

A financial services company uses Amazon SageMaker Feature Store to manage features for machine learning models. The compliance auditor requires that all changes to feature definitions are logged and that feature data is immutable once written. Which TWO approaches should the team implement? (Choose two.)

Accepted Answer

Enable AWS CloudTrail for SageMaker Feature Store API calls.. Option A is correct because enabling AWS CloudTrail for SageMaker Feature Store API calls provides a detailed audit log of all operations, including changes to feature definitions (e.g., CreateFeatureGroup, UpdateFeatureGroup). This satisfies the compliance requirement for logging all changes. Option C is correct because enabling feature group versioning in SageMaker Feature Store allows you to track and manage changes to feature definitions over time, ensuring a historical record of modifications.

Answer

Use SageMaker Feature Store offline store with record identifier and event time.

Answer

Implement feature store online store with TTL to automatically expire data.

Answer

Use AWS Config to track changes to Feature Store resources.

Question 12

A company is using Amazon SageMaker to train machine learning models on sensitive customer data. Which AWS service can be used to encrypt the data at rest in the S3 bucket used by SageMaker?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the correct service because it provides managed encryption keys that can be used to enable server-side encryption (SSE-KMS) for Amazon S3 buckets. When SageMaker accesses training data from S3, it can use a customer-managed KMS key to encrypt data at rest, ensuring sensitive customer data remains protected. KMS integrates directly with S3 and SageMaker, allowing you to specify a KMS key in the SageMaker training job configuration.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Question 13

A data science team needs to grant a SageMaker notebook instance access to an S3 bucket containing training data. Which IAM policy should be attached to the notebook instance's execution role?

Accepted Answer

An IAM policy that allows s3:GetObject and s3:ListBucket on the specific bucket. The correct answer is D because a SageMaker notebook instance needs read access to the S3 bucket containing training data. The execution role must have an IAM policy that explicitly allows s3:GetObject (to read objects) and s3:ListBucket (to list the bucket contents) on the specific bucket. Without these permissions, the notebook cannot retrieve the training data.

Answer

An IAM policy that allows the sagemaker:InvokeEndpoint action

Answer

An IAM policy that allows kms:Decrypt on the S3 bucket's KMS key

Answer

An IAM policy that allows ec2:DescribeVpcs

Question 14

A financial services company is deploying a fraud detection model using Amazon SageMaker. They need to ensure that inference requests are encrypted in transit and that the model endpoint is only accessible from within a VPC. What is the MOST secure way to achieve this?

Accepted Answer

Deploy the model endpoint in a VPC with an interface VPC endpoint (AWS PrivateLink) and configure the model to require HTTPS. Option D is correct because it combines two critical security controls: deploying the SageMaker endpoint within a VPC using an interface VPC endpoint (AWS PrivateLink) ensures that all traffic stays within the AWS network and never traverses the public internet, while configuring the model to require HTTPS enforces encryption in transit. This architecture eliminates exposure to the internet and meets the requirement for encrypted inference requests and VPC-only access.

Answer

Enable public endpoint with TLS and restrict access using a VPN

Answer

Use SageMaker Model Monitor to detect anomalies in request data

Answer

Create a SageMaker endpoint in a private subnet without an internet gateway, and use AWS PrivateLink

Question 15

A company wants to track API calls made to Amazon SageMaker for audit purposes. Which AWS service should they enable?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API activity across AWS services, including Amazon SageMaker. By enabling CloudTrail, the company can capture all SageMaker API calls (e.g., CreateModel, InvokeEndpoint) for audit, compliance, and security analysis. CloudTrail logs provide details such as the identity of the caller, the time of the call, and the request parameters, which are essential for auditing.

Answer

Amazon Macie

Answer

AWS Config

Answer

Amazon CloudWatch Logs