AIF-C01 Security, Compliance, and Governance for AI Solutions — 30 Questions

Question 1

A data scientist needs to allow a foundation model in Amazon Bedrock to access a specific S3 bucket containing reference documents. The bucket is in a different AWS account. What is the MOST secure way to grant access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the S3 bucket policy to allow access from the Bedrock service role and add a Bedrock resource policy allowing the bucket. Cross-account access requires both the S3 bucket policy to grant the Bedrock service role and the Bedrock resource policy to allow the bucket, ensuring least privilege.

Answer

Use AWS Lake Formation to grant cross-account access to the bucket

Answer

Copy the S3 bucket to the same account as Bedrock

Answer

Make the S3 bucket public and use a pre-signed URL

Question 2

An organization uses AWS Lake Formation to govern a data lake used for SageMaker training. They need to enforce row-level security so that different teams only see data relevant to their projects. Which Lake Formation feature should they use?

Accepted Answer

Row-level security. Lake Formation's row-level security uses filters to restrict access to specific rows based on conditions.

Answer

Cell-level security

Answer

Column-level security

Answer

Tag-based access control

Question 3

A company wants to use a third-party foundation model in Bedrock and is concerned about the provider's data handling policies. Which action should they take to ensure their data is not used for model training by the provider?

Accepted Answer

Review the provider's data privacy policy and enable the opt-out option for training data use if available. AWS provides model access approval settings where customers can review and accept data handling policies; many providers offer opt-out options for training data use.

Answer

Use Bedrock's content filters to block sensitive data

Answer

Encrypt all data with KMS before sending to Bedrock

Answer

Use a custom model hosted on SageMaker instead

Question 4

A company wants to enforce strict data residency for training data used in SageMaker. The data must never leave a specific AWS Region. Which THREE actions should they take? (Choose 3)

Accepted Answer

Use KMS customer managed keys specific to the region. Option A is correct because KMS customer managed keys are Region-specific resources, so using a CMK created in the target Region ensures that encryption/decryption of training data stays bound to that Region and cannot be performed by a key in another Region. Option C is correct because S3 bucket policies can include conditions such as aws:RequestedRegion or aws:SourceRegion (or aws:SourceVpc/aws:SourceVpce) to explicitly deny requests that do not originate from within the required Region, enforcing data residency at the access-control layer. Option E is correct because creating a VPC in the desired Region and placing SageMaker resources (notebook instances, training jobs, endpoints) inside that VPC keeps compute and network traffic local to the Region, preventing data from being processed elsewhere. Option B is incorrect because KMS multi-Region keys are designed to replicate key material across Regions, which directly conflicts with strict data residency. Option D is incorrect because enabling cross-region replication for the S3 bucket would copy the training data into another Region, violating the requirement that data never leave the specified Region.

Answer

Use AWS KMS multi-Region keys to encrypt data

Answer

Enable cross-region replication for the S3 bucket

Question 5

A healthcare company uses Amazon SageMaker to train a model on patient data. To meet HIPAA compliance, they must ensure training data is encrypted at rest and in transit. Additionally, the training job should not have internet access. Which combination of actions should the company take?

Accepted Answer

Specify a KMS key for SageMaker's VolumeKmsKeyId and configure the training job to run in a VPC without a public internet route. Specifying a KMS key via VolumeKmsKeyId encrypts the SageMaker training volume at rest, and running the training job in a VPC without a public internet route enforces network isolation. Together these satisfy HIPAA requirements for encryption at rest and in transit plus no internet access. This is the standard SageMaker secure training pattern.

Answer

Use AWS Certificate Manager (ACM) to issue a certificate for the training job and enable network isolation

Answer

Enable SageMaker data capture and use a private VPC with an internet gateway

Answer

Store training data in an encrypted S3 bucket and use a SageMaker notebook instance inside a VPC

Question 6

A data scientist is using Amazon SageMaker to train a model with data that resides in an S3 bucket owned by another AWS account. The training job fails with access denied errors. The data scientist has already been granted cross-account read access to the S3 bucket via a bucket policy. What additional configuration is required?

Accepted Answer

Modify the SageMaker execution role to include an s3:GetObject permission for the bucket and ensure the bucket policy grants access to that role. SageMaker training jobs run within a SageMaker execution role. The role must have a trust policy allowing SageMaker to assume it, and the role must have permissions to read from the S3 bucket. The bucket policy alone is insufficient if the execution role does not have the necessary S3 permissions.

Answer

Add an AWS KMS key policy to allow cross-account decryption

Answer

Create a new VPC peering connection between the two accounts

Answer

Use AWS Lake Formation to grant cross-account permissions on the S3 data

Question 7

A machine learning team uses Amazon SageMaker to train and deploy models. They need to ensure that only approved base models from the AWS Marketplace are used. Which feature should they use to enforce this policy?

Accepted Answer

IAM policies that allow only specific model package ARNs from the AWS Marketplace. SageMaker Role Manager helps administrators create least-privilege IAM roles, but it does not restrict which models can be used. Model access in SageMaker is controlled via IAM policies on the CreateTrainingJob and CreateModel APIs, combined with resource-level permissions.

Answer

SageMaker Role Manager

Answer

AWS Config rules to detect non-compliant models

Answer

SageMaker Model Registry

Question 8

A financial institution is using Amazon Bedrock for a customer-facing application. They must ensure compliance with data residency requirements: model inputs and outputs must not leave a specific AWS Region. Which THREE steps should they take? (Choose THREE)

Accepted Answer

Enable Bedrock model invocation logging to an S3 bucket and CloudWatch Logs in the same Region. Option B is correct because enabling Bedrock model invocation logging to an S3 bucket and CloudWatch Logs in the same Region keeps the captured inputs and outputs within the required Region, satisfying data residency. Option C is correct because using AWS KMS with a customer managed key in the desired Region ensures data at rest is encrypted with a key that never leaves that Region, which is essential for residency compliance. Option D is correct because configuring an AWS PrivateLink VPC endpoint for Amazon Bedrock in the desired Region keeps invocation traffic on the AWS network within that Region and avoids cross-Region endpoints. Option A is incorrect because storing invocation logs in a different Region for disaster recovery would move model inputs and outputs outside the required Region, violating residency. Option E is incorrect because AWS Global Accelerator routes traffic across Regions for performance, which would not help and could conflict with keeping data within a single Region.

Answer

Set up an S3 bucket for model invocation logs in a different Region for disaster recovery

Answer

Use AWS Global Accelerator to route traffic to Bedrock across regions for better performance

Question 9

A data scientist needs to restrict access to a specific Amazon SageMaker notebook instance so that only a designated IAM role can invoke the CreatePresignedNotebookInstanceUrl API. Which IAM policy element should be used to achieve this?

Accepted Answer

Add a Condition block in the IAM policy attached to the user's role. Amazon SageMaker notebook instances do not support resource-based policies. The correct way to restrict the CreatePresignedNotebookInstanceUrl API to a specific IAM role is to attach an identity-based policy to the user's role that includes a Condition block specifying the resource ARN of the notebook instance. This ensures only that role can generate presigned URLs for that instance.

Answer

Modify the trust policy of the IAM role

Answer

Place the notebook instance in a private VPC subnet

Answer

Use a resource-based policy on the notebook instance

Question 10

A company is using Amazon Bedrock to generate text summaries of customer emails. The compliance team requires that any email containing a Social Security Number (SSN) must be blocked from being sent to the model for summarization. Which Bedrock Guardrail configuration should be used?

Accepted Answer

Use a content policy with a PII filter set to 'Deny' for SSN. Bedrock Guardrails can be configured to filter content before it is sent to the model. PII redaction with a deny action will block the input if SSNs are detected. The guardrail is applied at invocation time.

Answer

Configure a topic restriction to block 'PII' topics

Answer

Enable model invocation logging and manually review all inputs

Answer

Add a word filter with a list of common SSN patterns

Question 11

A machine learning team is training a model using Amazon SageMaker with data stored in an S3 bucket. The security policy requires that all data be encrypted at rest and in transit, and that the training job cannot access the internet. Which combination of settings should the team use?

Accepted Answer

Disable Network Isolation, place the training job in a private VPC subnet, and use an S3 VPC Endpoint. SageMaker training jobs can be run in a VPC without internet access by disabling 'Enable Network Isolation' (which actually blocks all network access) and using a VPC with no NAT gateway or internet gateway. KMS encryption for both S3 and the attached ML storage volume ensures encryption at rest.

Answer

Enable Network Isolation and use an S3 VPC Endpoint

Answer

Enable Network Isolation and use a VPC with a NAT gateway

Answer

Disable Network Isolation and use a public VPC subnet

Question 12

A financial services company uses Amazon Bedrock to generate investment advice. They have configured a guardrail to deny any harmful content. However, a user prompt 'Tell me how to commit fraud' was not blocked. What is the most likely cause?

Accepted Answer

The guardrail's content policy does not include the 'Fraud' category. Bedrock Guardrails rely on content policies that detect harmful content based on categories like fraud. If the guardrail template does not include the 'Fraud' category, such prompts may pass through. The guardrail's configuration must explicitly include the relevant harm category.

Answer

The guardrail's sensitivity threshold is set too low

Answer

The prompt was sent to a different Bedrock model that does not support guardrails

Answer

The guardrail was configured with a word filter but not a content filter

Question 13

A company is deploying a real-time inference endpoint using Amazon SageMaker. The security team requires that all data sent to the endpoint be encrypted in transit and that the endpoint is only accessible from within the company's VPC. Which configuration should be used?

Accepted Answer

Deploy the endpoint in a private subnet with a VPC endpoint for SageMaker Runtime. SageMaker endpoints can be deployed in a VPC and configured to use a private VPC endpoint (AWS PrivateLink) so that they are accessible only from within the VPC. HTTPS ensures encryption in transit; SageMaker endpoints automatically use HTTPS.

Answer

Deploy the endpoint in a public subnet and use a security group to restrict source IPs

Answer

Enable network isolation on the endpoint

Answer

Use an AWS Lambda function to proxy requests and restrict access via IAM

Question 14

An organization uses AWS Lake Formation to govern access to data used for machine learning in Amazon SageMaker. They want to ensure that a particular IAM role used by SageMaker can only query a subset of columns in a table containing sensitive customer data. Which Lake Formation permission should be granted to the role?

Accepted Answer

Grant SELECT on the table with column-level filter. Lake Formation supports column-level security through the SELECT permission with column filters (Data Filters / LF-Tags), which allows an IAM principal to query only specific columns of a table. Granting SELECT with a column-level filter on the table lets SageMaker's IAM role read only the permitted columns while the rest remain hidden. This is the native Lake Formation mechanism for fine-grained column access without duplicating data.

Answer

Grant DESCRIBE on the table

Answer

Grant INSERT on the table

Answer

Create a view with only the allowed columns and grant SELECT on the view

Question 15

A data scientist wants to use a third-party foundation model from Amazon Bedrock for a generative AI application. The compliance officer needs to understand how the third-party model provider handles data privacy. Where can the data scientist find this information?

Accepted Answer

In the Amazon Bedrock service documentation for the specific model provider. AWS provides a service-specific data privacy page for each Bedrock model provider, detailing data handling, retention, and privacy practices. This is part of the Bedrock documentation.

Answer

Contact the model provider directly via email

Answer

Use Amazon Macie to analyze the model provider's privacy policy

Answer

In the AWS Artifact reports

Question 16

A company uses Amazon Bedrock with a custom model that was trained on data subject to GDPR. The company needs to ensure that inference logs containing user prompts and model responses are stored in a specific AWS Region for data residency compliance. How should they configure Bedrock model invocation logging?

Accepted Answer

Enable model invocation logging and select an S3 bucket in the required region. Bedrock model invocation logging allows you to specify the S3 bucket and CloudWatch Logs group where logs are stored. By choosing an S3 bucket in the desired region and enabling CloudWatch Logs in that region, you can meet data residency requirements.

Answer

Configure a Bedrock Guardrail to log all invocations to a CloudWatch Logs group in the required region

Answer

Use AWS CloudTrail to log all API calls and store them in the required region

Answer

Use AWS Global Accelerator to route traffic to the required region

Question 17

A machine learning team needs to share a SageMaker notebook with a colleague from a different AWS account. The colleague should be able to open and run the notebook but not delete it. Which combination of actions should the team take?

Accepted Answer

Share the notebook via S3 with a bucket policy that grants read/write access to the colleague's account. SageMaker notebook instances do not support resource-based policies for cross-account access. To share a SageMaker notebook (the .ipynb file) with a colleague from a different AWS account, the notebook should be stored in an S3 bucket. A bucket policy can grant the colleague's account read access to the notebook file, and IAM roles can allow them to open and run it without delete permissions. Option A (Lake Formation) is used for sharing data lake resources, not typically for SageMaker notebooks directly. Option B is invalid because resource-based policies are not available for notebook instances. Option C grants too broad permissions.

Answer

Use AWS Lake Formation to share the notebook

Answer

Attach a resource-based policy to the notebook instance that grants the colleague's IAM role permissions to open and run, and deny delete

Answer

Create an IAM role in the colleague's account with permissions to create and manage SageMaker notebooks

Question 18

A company is deploying a generative AI application using Amazon Bedrock and needs to ensure that the model's responses do not include any sensitive information. Which TWO Bedrock Guardrail configurations should be used together to meet this requirement? (Select TWO.)

Accepted Answer

PII redaction to redact or mask sensitive data. Amazon Bedrock Guardrails provide multiple mechanisms to control model outputs. PII redaction specifically identifies and removes or masks personally identifiable information, directly addressing the requirement to prevent sensitive data exposure. Content policies, on the other hand, filter outputs based on harmful content categories (e.g., hate, violence) and do not target sensitive information like PII. Therefore, only PII redaction (Option A) is needed to meet this specific requirement.

Answer

Topic restriction to limit topics

Answer

Word filter to block specific words

Answer

Grounding check to verify responses are grounded in source documents

Answer

Content policy to filter out harmful content

Question 19

A company wants to encrypt training data stored in Amazon S3 and model artifacts in Amazon SageMaker using customer-managed keys. Which TWO AWS services or features should they use? (Select TWO.)

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) (C) is correct because it is the service that creates and manages the customer-managed keys (CMKs) required to encrypt data at rest, giving the company control over key policies, rotation, and grants. Amazon S3 server-side encryption with KMS (D) is correct because it uses SSE-KMS to encrypt S3 objects with a KMS customer-managed key, which is exactly the mechanism needed to encrypt the training data stored in S3. Together, KMS supplies the customer-managed key and S3 SSE-KMS applies it to the stored training data and, via the same KMS keys, to SageMaker model artifacts. Amazon Macie (A) is a data security and sensitive-data discovery service, not an encryption key management or encryption feature. AWS Certificate Manager (B) provisions and manages TLS/SSL certificates for in-transit encryption, not at-rest encryption of S3 or SageMaker data. AWS CloudHSM (E) provides dedicated hardware security modules for custom key storage, but it is not the managed service or S3 feature used here to encrypt S3 and SageMaker data with customer-managed keys.

Answer

Amazon Macie

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 20

A company uses Amazon Bedrock to access foundation models. The security team wants to ensure that only specific IAM roles can invoke a particular model. Which configuration should they use?

Accepted Answer

Create a Bedrock resource policy that grants InvokeModel to the required roles. Amazon Bedrock uses resource-based policies attached to the model to control access. IAM policies alone are insufficient because the model resource itself must grant access to specific principals.

Answer

Attach an S3 bucket policy to the model artifacts

Answer

Configure a VPC endpoint for Bedrock

Answer

Use AWS Organizations service control policies to deny all model access