AIF-C01 Security, Compliance, and Governance for AI Solutions — 15 Questions

Question 1

A company uses Amazon SageMaker to train sensitive ML models. Which AWS service should they use to encrypt the training data and model artifacts at rest?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) allows customers to create and manage encryption keys used to encrypt data at rest in SageMaker, including training data and model artifacts.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS Certificate Manager

Question 2

A data scientist needs to allow a foundation model in Amazon Bedrock to access a specific S3 bucket containing reference documents. The bucket is in a different AWS account. What is the MOST secure way to grant access?

Accepted Answer

Configure the S3 bucket policy to allow access from the Bedrock service role and add a Bedrock resource policy allowing the bucket. Cross-account access requires both the S3 bucket policy to grant the Bedrock service role and the Bedrock resource policy to allow the bucket, ensuring least privilege.

Answer

Use AWS Lake Formation to grant cross-account access to the bucket

Answer

Copy the S3 bucket to the same account as Bedrock

Answer

Make the S3 bucket public and use a pre-signed URL

Question 3

A company uses Bedrock Guardrails to filter harmful content in a generative AI application. They need to prevent the model from discussing proprietary internal projects. Which Guardrail component should be configured?

Accepted Answer

Topic restrictions. Topic restrictions allow administrators to define denied topics; the model will not generate responses related to those topics.

Answer

Content filters

Answer

Grounding check

Answer

Word filters

Question 4

A financial services firm needs to ensure that all calls to Amazon Bedrock APIs are logged for audit purposes. Which AWS service should they enable to capture API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in AWS accounts, including Bedrock API calls, providing audit logs.

Answer

Amazon S3 server access logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 5

A company wants to detect sensitive data such as PII in their training datasets stored in S3 before using them for model training. Which AWS service should they use?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to discover and protect sensitive data in S3, including PII.

Answer

Amazon Inspector

Answer

AWS Shield

Answer

Amazon GuardDuty

Question 6

A company uses SageMaker Clarify to detect bias in a deployed model. The monitoring must run automatically on a schedule. Which SageMaker feature should they use?

Accepted Answer

SageMaker Model Monitor. SageMaker Model Monitor can be configured to run bias detection jobs on a schedule using Clarify's bias metrics.

Answer

SageMaker Pipelines

Answer

SageMaker Experiments

Answer

SageMaker Data Wrangler

Question 7

An organization uses AWS Lake Formation to govern a data lake used for SageMaker training. They need to enforce row-level security so that different teams only see data relevant to their projects. Which Lake Formation feature should they use?

Accepted Answer

Row-level security. Lake Formation's row-level security uses filters to restrict access to specific rows based on conditions.

Answer

Cell-level security

Answer

Column-level security

Answer

Tag-based access control

Question 8

A company wants to use Amazon Bedrock to generate responses grounded in their proprietary knowledge base. They need to minimize hallucinations and ensure responses are based on the provided documents. Which feature should they enable?

Accepted Answer

Grounding check. Grounding check in Bedrock Guardrails verifies that the model's response is supported by the source documents, reducing hallucinations.

Answer

Topic restrictions

Answer

Word filters

Answer

Content filters

Question 9

A data scientist needs to restrict access to a SageMaker notebook instance to only the corporate network. Which configuration should they use?

Accepted Answer

Place the notebook instance in a VPC and configure security groups to allow only corporate IP ranges. VPC isolation places the notebook instance inside a VPC, and security groups can restrict inbound traffic to the corporate network IP range.

Answer

Enable multi-factor authentication for the notebook

Answer

Use an IAM policy to allow only corporate users

Answer

Use a SageMaker lifecycle configuration to block external IPs

Question 10

A company needs to ensure that model inference endpoints in SageMaker are only accessible from a private subnet in their VPC, and no traffic goes over the public internet. Which network configuration should they use?

Accepted Answer

Use a VPC interface endpoint for SageMaker and disable public access. A VPC-only endpoint (interface endpoint) or private endpoint without public internet access ensures traffic stays within the VPC.

Answer

Create a public endpoint and restrict access using IAM policies

Answer

Use AWS PrivateLink for the endpoint, but keep public endpoint enabled

Answer

Deploy the endpoint in a public subnet with a security group blocking all inbound traffic

Question 11

A company using Amazon Bedrock needs to redact personally identifiable information (PII) from user inputs before sending them to the foundation model. Which Bedrock Guardrails component should be configured?

Accepted Answer

Sensitive information filters. PII redaction in Guardrails automatically detects and redacts PII in user inputs or model responses.

Answer

Content filters

Answer

Topic restrictions

Answer

Word filters

Question 12

A company wants to use a third-party foundation model in Bedrock and is concerned about the provider's data handling policies. Which action should they take to ensure their data is not used for model training by the provider?

Accepted Answer

Review the provider's data privacy policy and enable the opt-out option for training data use if available. AWS provides model access approval settings where customers can review and accept data handling policies; many providers offer opt-out options for training data use.

Answer

Use Bedrock's content filters to block sensitive data

Answer

Encrypt all data with KMS before sending to Bedrock

Answer

Use a custom model hosted on SageMaker instead

Question 13

A company needs to govern the lifecycle of ML models, including versioning, monitoring for drift, and decommissioning outdated models. Which TWO services should they use? (Choose 2)

Accepted Answer

Amazon SageMaker Model Registry. SageMaker Model Registry handles versioning and model approval; SageMaker Model Monitor tracks drift and performance.

Answer

AWS CloudTrail

Answer

Amazon S3

Answer

AWS CodePipeline

Question 14

A company wants to enforce strict data residency for training data used in SageMaker. The data must never leave a specific AWS Region. Which THREE actions should they take? (Choose 3)

Accepted Answer

Use KMS customer managed keys specific to the region. To enforce data residency, the company must use a VPC in the desired region, configure S3 bucket policies to block cross-region access, and use KMS keys regional to that region.

Answer

Use AWS KMS multi-Region keys to encrypt data

Answer

Enable cross-region replication for the S3 bucket

Question 15

A company wants to log all model invocation requests in Amazon Bedrock for audit and troubleshooting. Which TWO destinations can they configure for invocation logging? (Choose 2)

Accepted Answer

Amazon CloudWatch Logs. Bedrock invocation logging supports S3 and CloudWatch Logs as destinations.

Answer

Amazon DynamoDB

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose