AIF-C01 Security, Compliance, and Governance for AI Solutions Practice Test 2 — 15 Questions

Question 1

A data scientist wants to restrict which IAM roles can invoke a specific Amazon Bedrock base model. Which AWS feature should they use?

Accepted Answer

Bedrock resource-based policy. Bedrock resource policies allow you to attach fine-grained permissions to a specific model, specifying which principals (IAM roles) can invoke it.

Answer

S3 bucket policy on the model artifacts

Answer

AWS KMS key policy for the encryption key

Answer

AWS CloudTrail log delivery policy

Question 2

A healthcare company uses Amazon SageMaker to train a model on patient data. To meet HIPAA compliance, they must ensure training data is encrypted at rest and in transit. Additionally, the training job should not have internet access. Which combination of actions should the company take?

Accepted Answer

Specify a KMS key for SageMaker's VolumeKmsKeyId and configure the training job to run in a VPC without a public internet route. Using KMS encryption keys and configuring the training job to run in a VPC without a public internet route satisfies both encryption and network isolation requirements.

Answer

Use AWS Certificate Manager (ACM) to issue a certificate for the training job and enable network isolation

Answer

Enable SageMaker data capture and use a private VPC with an internet gateway

Answer

Store training data in an encrypted S3 bucket and use a SageMaker notebook instance inside a VPC

Question 3

A financial services firm uses Amazon Bedrock to generate investment summaries. They need to prevent the model from generating content containing personally identifiable information (PII) such as social security numbers. Which feature should they configure in Bedrock Guardrails?

Accepted Answer

Sensitive information filters with PII redaction. Bedrock Guardrails include a PII redaction filter that can detect and block or mask PII in model inputs and outputs.

Answer

Contextual grounding checks

Answer

Content filtering with category-based harmful content filters

Answer

Word filters with a custom list of terms

Question 4

A company uses Amazon SageMaker Clarify to monitor a deployed model for bias. After running an analysis, they find that the model's predictions have a disparate impact on a protected group. What is the MOST appropriate next step?

Accepted Answer

Investigate the root cause of bias, then use techniques such as reweighing training data or applying bias mitigation algorithms before redeploying. Discovering bias requires investigation and mitigation. SageMaker Clarify can help identify bias, but mitigation typically involves retraining with balanced data or adjusting model outputs.

Answer

Modify the SageMaker endpoint to add a random noise to predictions for the protected group

Answer

Ignore the results because SageMaker Clarify is still in preview

Answer

Immediately delete the model and retrain from scratch using only data from the protected group

Question 5

A data governance team wants to enforce fine-grained access control on data in an Amazon S3 data lake used by multiple business units for AI training. Which AWS service should they use to define and manage data permissions at the table and column level?

Accepted Answer

AWS Lake Formation. AWS Lake Formation provides fine-grained access control for data lakes, allowing you to set permissions on tables and columns across AWS analytics and ML services.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 6

A security engineer is configuring logging for Amazon Bedrock model invocations. They need to capture both the input and output of all API calls for compliance audits. Which set of steps should they take?

Accepted Answer

Enable Bedrock model invocation logging and specify an S3 bucket and optionally CloudWatch Logs as the destination. Bedrock model invocation logging captures inputs and outputs to S3 and/or CloudWatch Logs. CloudTrail records API calls but not the model inputs/outputs.

Answer

Enable CloudTrail for the Bedrock API and configure S3 event notifications

Answer

Use VPC Flow Logs to capture network traffic and reconstruct model inputs from packet data

Answer

Enable AWS Config rules for Bedrock and stream logs to Amazon Kinesis

Question 7

A company wants to automatically discover sensitive data such as credit card numbers in their Amazon S3 training datasets before using them for model training. Which AWS service should they use?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data in S3.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Audit Manager

Question 8

A company is deploying an AI-powered document summarization system using Amazon Bedrock. They must ensure that the model only uses information from provided source documents and does not generate unsupported claims. Which Bedrock Guardrails feature should they enable?

Accepted Answer

Contextual grounding check. Contextual grounding checks ensure that model responses are factually supported by the reference sources, reducing hallucinations.

Answer

Content filtering with category-based harmful content filters

Answer

Word filters

Answer

Topic restrictions

Question 9

A data scientist is using Amazon SageMaker to train a model with data that resides in an S3 bucket owned by another AWS account. The training job fails with access denied errors. The data scientist has already been granted cross-account read access to the S3 bucket via a bucket policy. What additional configuration is required?

Accepted Answer

Modify the SageMaker execution role to include an s3:GetObject permission for the bucket and ensure the bucket policy grants access to that role. SageMaker training jobs run within a SageMaker execution role. The role must have a trust policy allowing SageMaker to assume it, and the role must have permissions to read from the S3 bucket. The bucket policy alone is insufficient if the execution role does not have the necessary S3 permissions.

Answer

Add an AWS KMS key policy to allow cross-account decryption

Answer

Create a new VPC peering connection between the two accounts

Answer

Use AWS Lake Formation to grant cross-account permissions on the S3 data

Question 10

An organization wants to control which topics their AI chatbot can discuss. For example, they want to block all conversations about investment advice. Which Amazon Bedrock Guardrails feature should they configure?

Accepted Answer

Topic restrictions. Topic restrictions allow you to define denied topics. When the model's input or output matches a denied topic, the guardrail blocks the interaction.

Answer

Contextual grounding check

Answer

Content filtering with category-based harmful content filters

Answer

Sensitive information filters

Question 11

A machine learning team uses Amazon SageMaker to train and deploy models. They need to ensure that only approved base models from the AWS Marketplace are used. Which feature should they use to enforce this policy?

Accepted Answer

IAM policies that allow only specific model package ARNs from the AWS Marketplace. SageMaker Role Manager helps administrators create least-privilege IAM roles, but it does not restrict which models can be used. Model access in SageMaker is controlled via IAM policies on the CreateTrainingJob and CreateModel APIs, combined with resource-level permissions.

Answer

SageMaker Role Manager

Answer

AWS Config rules to detect non-compliant models

Answer

SageMaker Model Registry

Question 12

A company uses Amazon Bedrock with a third-party foundation model. They are concerned about the third-party provider accessing their data. What should they review to understand data handling practices?

Accepted Answer

The third-party model provider's data privacy and handling documentation within AWS Bedrock's service description. AWS Bedrock's documentation includes data handling and privacy information for each third-party provider. The service agreement and data privacy page explain that AWS does not use customer data to improve models, and what third parties may do.

Answer

AWS Artifact reports for SOC and PCI compliance

Answer

AWS CloudTrail logs for model invocation

Answer

Amazon SageMaker Model Registry metadata

Question 13

A company is deploying an AI model on Amazon SageMaker and needs to monitor for model drift over time. Which TWO actions should they take? (Choose TWO)

Accepted Answer

Enable data capture on the SageMaker endpoint to store real-time inference data in S3. SageMaker Model Monitor can detect drift in model quality, data quality, and bias. Capturing inference data is a prerequisite for monitoring. The other options are either unrelated or not directly for drift detection.

Answer

Use AWS CloudTrail to log all inference requests and responses

Answer

Store model artifacts in Amazon ECR and tag each version

Answer

Set up Amazon CloudWatch anomaly detection on the endpoint invocation count

Question 14

A financial institution is using Amazon Bedrock for a customer-facing application. They must ensure compliance with data residency requirements: model inputs and outputs must not leave a specific AWS Region. Which THREE steps should they take? (Choose THREE)

Accepted Answer

Enable Bedrock model invocation logging to an S3 bucket and CloudWatch Logs in the same Region. To ensure data residency, the Bedrock model must be accessed only via a VPC endpoint (so traffic stays within AWS network), and all storage and logging must be in the desired Region. CloudTrail and invocation logs must also be stored in that Region.

Answer

Set up an S3 bucket for model invocation logs in a different Region for disaster recovery

Answer

Use AWS Global Accelerator to route traffic to Bedrock across regions for better performance

Question 15

A company wants to use AWS Lake Formation to govern access to data used for AI training. They need to ensure that only approved columns of sensitive tables are visible to data scientists. Which THREE steps should they implement? (Choose THREE)

Accepted Answer

Use AWS Glue crawlers to catalog the data and populate the Data Catalog. Lake Formation allows you to register S3 locations, create resource links, and grant permissions at column level. The other options are not specific to Lake Formation column-level access control.

Answer

Create a SageMaker notebook instance and attach an IAM role

Answer

Enable S3 versioning on the training data bucket