AIF-C01 Security, Compliance, and Governance for AI Solutions Practice Test 2 — 15 Questions

Question 1

A company needs to govern the lifecycle of ML models, including versioning, monitoring for drift, and decommissioning outdated models. Which TWO services should they use? (Choose 2)

Accepted Answer

Amazon SageMaker Model Registry. SageMaker Model Registry handles versioning and model approval; SageMaker Model Monitor tracks drift and performance.

Answer

AWS CloudTrail

Answer

Amazon S3

Answer

AWS CodePipeline

Question 2

A company wants to enforce strict data residency for training data used in SageMaker. The data must never leave a specific AWS Region. Which THREE actions should they take? (Choose 3)

Accepted Answer

Use KMS customer managed keys specific to the region. To enforce data residency, the company must use a VPC in the desired region, configure S3 bucket policies to block cross-region access, and use KMS keys regional to that region.

Answer

Use AWS KMS multi-Region keys to encrypt data

Answer

Enable cross-region replication for the S3 bucket

Question 3

A company wants to log all model invocation requests in Amazon Bedrock for audit and troubleshooting. Which TWO destinations can they configure for invocation logging? (Choose 2)

Accepted Answer

Amazon CloudWatch Logs. Bedrock invocation logging supports S3 and CloudWatch Logs as destinations.

Answer

Amazon DynamoDB

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Question 4

A data scientist wants to restrict which IAM roles can invoke a specific Amazon Bedrock base model. Which AWS feature should they use?

Accepted Answer

Bedrock resource-based policy. Bedrock resource policies allow you to attach fine-grained permissions to a specific model, specifying which principals (IAM roles) can invoke it.

Answer

S3 bucket policy on the model artifacts

Answer

AWS KMS key policy for the encryption key

Answer

AWS CloudTrail log delivery policy

Question 5

A healthcare company uses Amazon SageMaker to train a model on patient data. To meet HIPAA compliance, they must ensure training data is encrypted at rest and in transit. Additionally, the training job should not have internet access. Which combination of actions should the company take?

Accepted Answer

Specify a KMS key for SageMaker's VolumeKmsKeyId and configure the training job to run in a VPC without a public internet route. Using KMS encryption keys and configuring the training job to run in a VPC without a public internet route satisfies both encryption and network isolation requirements.

Answer

Use AWS Certificate Manager (ACM) to issue a certificate for the training job and enable network isolation

Answer

Enable SageMaker data capture and use a private VPC with an internet gateway

Answer

Store training data in an encrypted S3 bucket and use a SageMaker notebook instance inside a VPC

Question 6

A financial services firm uses Amazon Bedrock to generate investment summaries. They need to prevent the model from generating content containing personally identifiable information (PII) such as social security numbers. Which feature should they configure in Bedrock Guardrails?

Accepted Answer

Sensitive information filters with PII redaction. Bedrock Guardrails include a PII redaction filter that can detect and block or mask PII in model inputs and outputs.

Answer

Contextual grounding checks

Answer

Content filtering with category-based harmful content filters

Answer

Word filters with a custom list of terms

Question 7

A company uses Amazon SageMaker Clarify to monitor a deployed model for bias. After running an analysis, they find that the model's predictions have a disparate impact on a protected group. What is the MOST appropriate next step?

Accepted Answer

Investigate the root cause of bias, then use techniques such as reweighing training data or applying bias mitigation algorithms before redeploying. Discovering bias requires investigation and mitigation. SageMaker Clarify can help identify bias, but mitigation typically involves retraining with balanced data or adjusting model outputs.

Answer

Modify the SageMaker endpoint to add a random noise to predictions for the protected group

Answer

Ignore the results because SageMaker Clarify is still in preview

Answer

Immediately delete the model and retrain from scratch using only data from the protected group

Question 8

A data governance team wants to enforce fine-grained access control on data in an Amazon S3 data lake used by multiple business units for AI training. Which AWS service should they use to define and manage data permissions at the table and column level?

Accepted Answer

AWS Lake Formation. AWS Lake Formation provides fine-grained access control for data lakes, allowing you to set permissions on tables and columns across AWS analytics and ML services.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 9

A security engineer is configuring logging for Amazon Bedrock model invocations. They need to capture both the input and output of all API calls for compliance audits. Which set of steps should they take?

Accepted Answer

Enable Bedrock model invocation logging and specify an S3 bucket and optionally CloudWatch Logs as the destination. Bedrock model invocation logging captures inputs and outputs to S3 and/or CloudWatch Logs. CloudTrail records API calls but not the model inputs/outputs.

Answer

Enable CloudTrail for the Bedrock API and configure S3 event notifications

Answer

Use VPC Flow Logs to capture network traffic and reconstruct model inputs from packet data

Answer

Enable AWS Config rules for Bedrock and stream logs to Amazon Kinesis

Question 10

A company wants to automatically discover sensitive data such as credit card numbers in their Amazon S3 training datasets before using them for model training. Which AWS service should they use?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data in S3.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Audit Manager

Question 11

A company is deploying an AI-powered document summarization system using Amazon Bedrock. They must ensure that the model only uses information from provided source documents and does not generate unsupported claims. Which Bedrock Guardrails feature should they enable?

Accepted Answer

Contextual grounding check. Contextual grounding checks ensure that model responses are factually supported by the reference sources, reducing hallucinations.

Answer

Content filtering with category-based harmful content filters

Answer

Word filters

Answer

Topic restrictions

Question 12

A data scientist is using Amazon SageMaker to train a model with data that resides in an S3 bucket owned by another AWS account. The training job fails with access denied errors. The data scientist has already been granted cross-account read access to the S3 bucket via a bucket policy. What additional configuration is required?

Accepted Answer

Modify the SageMaker execution role to include an s3:GetObject permission for the bucket and ensure the bucket policy grants access to that role. SageMaker training jobs run within a SageMaker execution role. The role must have a trust policy allowing SageMaker to assume it, and the role must have permissions to read from the S3 bucket. The bucket policy alone is insufficient if the execution role does not have the necessary S3 permissions.

Answer

Add an AWS KMS key policy to allow cross-account decryption

Answer

Create a new VPC peering connection between the two accounts

Answer

Use AWS Lake Formation to grant cross-account permissions on the S3 data

Question 13

An organization wants to control which topics their AI chatbot can discuss. For example, they want to block all conversations about investment advice. Which Amazon Bedrock Guardrails feature should they configure?

Accepted Answer

Topic restrictions. Topic restrictions allow you to define denied topics. When the model's input or output matches a denied topic, the guardrail blocks the interaction.

Answer

Contextual grounding check

Answer

Content filtering with category-based harmful content filters

Answer

Sensitive information filters

Question 14

A machine learning team uses Amazon SageMaker to train and deploy models. They need to ensure that only approved base models from the AWS Marketplace are used. Which feature should they use to enforce this policy?

Accepted Answer

IAM policies that allow only specific model package ARNs from the AWS Marketplace. SageMaker Role Manager helps administrators create least-privilege IAM roles, but it does not restrict which models can be used. Model access in SageMaker is controlled via IAM policies on the CreateTrainingJob and CreateModel APIs, combined with resource-level permissions.

Answer

SageMaker Role Manager

Answer

AWS Config rules to detect non-compliant models

Answer

SageMaker Model Registry

Question 15

A company uses Amazon Bedrock with a third-party foundation model. They are concerned about the third-party provider accessing their data. What should they review to understand data handling practices?

Accepted Answer

The third-party model provider's data privacy and handling documentation within AWS Bedrock's service description. AWS Bedrock's documentation includes data handling and privacy information for each third-party provider. The service agreement and data privacy page explain that AWS does not use customer data to improve models, and what third parties may do.

Answer

AWS Artifact reports for SOC and PCI compliance

Answer

AWS CloudTrail logs for model invocation

Answer

Amazon SageMaker Model Registry metadata