AIF-C01 Security, Compliance, and Governance for AI Solutions Practice Test 3 — 15 Questions

Question 1

A company is deploying an AI model on Amazon SageMaker and needs to monitor for model drift over time. Which TWO actions should they take? (Choose TWO)

Accepted Answer

Enable data capture on the SageMaker endpoint to store real-time inference data in S3. SageMaker Model Monitor can detect drift in model quality, data quality, and bias. Capturing inference data is a prerequisite for monitoring. The other options are either unrelated or not directly for drift detection.

Answer

Use AWS CloudTrail to log all inference requests and responses

Answer

Store model artifacts in Amazon ECR and tag each version

Answer

Set up Amazon CloudWatch anomaly detection on the endpoint invocation count

Question 2

A financial institution is using Amazon Bedrock for a customer-facing application. They must ensure compliance with data residency requirements: model inputs and outputs must not leave a specific AWS Region. Which THREE steps should they take? (Choose THREE)

Accepted Answer

Enable Bedrock model invocation logging to an S3 bucket and CloudWatch Logs in the same Region. To ensure data residency, the Bedrock model must be accessed only via a VPC endpoint (so traffic stays within AWS network), and all storage and logging must be in the desired Region. CloudTrail and invocation logs must also be stored in that Region.

Answer

Set up an S3 bucket for model invocation logs in a different Region for disaster recovery

Answer

Use AWS Global Accelerator to route traffic to Bedrock across regions for better performance

Question 3

A company wants to use AWS Lake Formation to govern access to data used for AI training. They need to ensure that only approved columns of sensitive tables are visible to data scientists. Which THREE steps should they implement? (Choose THREE)

Accepted Answer

Use AWS Glue crawlers to catalog the data and populate the Data Catalog. Lake Formation allows you to register S3 locations, create resource links, and grant permissions at column level. The other options are not specific to Lake Formation column-level access control.

Answer

Create a SageMaker notebook instance and attach an IAM role

Answer

Enable S3 versioning on the training data bucket

Question 4

A company is using Amazon Bedrock to generate text summaries of customer emails. The compliance team requires that any email containing a Social Security Number (SSN) must be blocked from being sent to the model for summarization. Which Bedrock Guardrail configuration should be used?

Accepted Answer

Use a content policy with a PII filter set to 'Deny' for SSN. Bedrock Guardrails can be configured to filter content before it is sent to the model. PII redaction with a deny action will block the input if SSNs are detected. The guardrail is applied at invocation time.

Answer

Configure a topic restriction to block 'PII' topics

Answer

Enable model invocation logging and manually review all inputs

Answer

Add a word filter with a list of common SSN patterns

Question 5

A machine learning team is training a model using Amazon SageMaker with data stored in an S3 bucket. The security policy requires that all data be encrypted at rest and in transit, and that the training job cannot access the internet. Which combination of settings should the team use?

Accepted Answer

Disable Network Isolation, place the training job in a private VPC subnet, and use an S3 VPC Endpoint. SageMaker training jobs can be run in a VPC without internet access by disabling 'Enable Network Isolation' (which actually blocks all network access) and using a VPC with no NAT gateway or internet gateway. KMS encryption for both S3 and the attached ML storage volume ensures encryption at rest.

Answer

Enable Network Isolation and use an S3 VPC Endpoint

Answer

Enable Network Isolation and use a VPC with a NAT gateway

Answer

Disable Network Isolation and use a public VPC subnet

Question 6

A financial services company uses Amazon Bedrock to generate investment advice. They have configured a guardrail to deny any harmful content. However, a user prompt 'Tell me how to commit fraud' was not blocked. What is the most likely cause?

Accepted Answer

The guardrail's content policy does not include the 'Fraud' category. Bedrock Guardrails rely on content policies that detect harmful content based on categories like fraud. If the guardrail template does not include the 'Fraud' category, such prompts may pass through. The guardrail's configuration must explicitly include the relevant harm category.

Answer

The guardrail's sensitivity threshold is set too low

Answer

The prompt was sent to a different Bedrock model that does not support guardrails

Answer

The guardrail was configured with a word filter but not a content filter

Question 7

A company needs to audit all API calls made to Amazon Bedrock, including model invocations and guardrail evaluations. Which AWS service should they enable to capture these API calls for compliance?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for all AWS services, including Bedrock. It captures the caller identity, API, parameters, and response elements, which can be used for auditing and compliance.

Answer

Amazon Macie

Answer

AWS Config

Answer

Amazon GuardDuty

Question 8

A healthcare startup is using Amazon SageMaker to train a model on patient data. They need to ensure that the training data does not contain any personally identifiable information (PII) before being used. Which AWS service can automatically detect and report PII in the data stored in S3?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in S3. It can detect PII such as names, addresses, and health information.

Answer

Amazon Rekognition

Answer

AWS Glue DataBrew

Answer

Amazon Comprehend Medical

Question 9

A company is deploying a real-time inference endpoint using Amazon SageMaker. The security team requires that all data sent to the endpoint be encrypted in transit and that the endpoint is only accessible from within the company's VPC. Which configuration should be used?

Accepted Answer

Deploy the endpoint in a private subnet with a VPC endpoint for SageMaker Runtime. SageMaker endpoints can be deployed in a VPC and configured to use a private VPC endpoint (AWS PrivateLink) so that they are accessible only from within the VPC. HTTPS ensures encryption in transit; SageMaker endpoints automatically use HTTPS.

Answer

Deploy the endpoint in a public subnet and use a security group to restrict source IPs

Answer

Enable network isolation on the endpoint

Answer

Use an AWS Lambda function to proxy requests and restrict access via IAM

Question 10

An organization uses AWS Lake Formation to govern access to data used for machine learning in Amazon SageMaker. They want to ensure that a particular IAM role used by SageMaker can only query a subset of columns in a table containing sensitive customer data. Which Lake Formation permission should be granted to the role?

Accepted Answer

Grant SELECT on the table with column-level filter. Lake Formation supports column-level permissions via Data Permissions. You can grant SELECT permission on specific columns of a table to an IAM role, restricting access to only those columns.

Answer

Grant DESCRIBE on the table

Answer

Grant INSERT on the table

Answer

Create a view with only the allowed columns and grant SELECT on the view

Question 11

A data scientist wants to use a third-party foundation model from Amazon Bedrock for a generative AI application. The compliance officer needs to understand how the third-party model provider handles data privacy. Where can the data scientist find this information?

Accepted Answer

In the Amazon Bedrock service documentation for the specific model provider. AWS provides a service-specific data privacy page for each Bedrock model provider, detailing data handling, retention, and privacy practices. This is part of the Bedrock documentation.

Answer

Contact the model provider directly via email

Answer

Use Amazon Macie to analyze the model provider's privacy policy

Answer

In the AWS Artifact reports

Question 12

A company has deployed a machine learning model using Amazon SageMaker and wants to monitor the model for bias over time. Which SageMaker feature should they use to detect bias in the model's predictions after deployment?

Accepted Answer

SageMaker Clarify. SageMaker Clarify is designed to detect bias in ML models both before and after deployment. It can analyze predictions to identify potential bias against certain groups.

Answer

SageMaker Debugger

Answer

SageMaker Model Monitor

Answer

SageMaker Role Manager

Question 13

A company uses Amazon Bedrock with a custom model that was trained on data subject to GDPR. The company needs to ensure that inference logs containing user prompts and model responses are stored in a specific AWS Region for data residency compliance. How should they configure Bedrock model invocation logging?

Accepted Answer

Enable model invocation logging and select an S3 bucket in the required region. Bedrock model invocation logging allows you to specify the S3 bucket and CloudWatch Logs group where logs are stored. By choosing an S3 bucket in the desired region and enabling CloudWatch Logs in that region, you can meet data residency requirements.

Answer

Configure a Bedrock Guardrail to log all invocations to a CloudWatch Logs group in the required region

Answer

Use AWS CloudTrail to log all API calls and store them in the required region

Answer

Use AWS Global Accelerator to route traffic to the required region

Question 14

A company is using Amazon SageMaker to manage the lifecycle of their machine learning models. They need to implement a governance framework that includes model versioning, monitoring for drift, and decommissioning of outdated models. Which THREE AWS services or features should they use together to meet these requirements? (Select THREE.)

Accepted Answer

SageMaker Pipelines. SageMaker Model Registry handles versioning, SageMaker Model Monitor detects drift, and SageMaker Pipelines can orchestrate decommissioning workflows. Together they cover the governance lifecycle.

Answer

AWS CloudTrail

Answer

SageMaker Role Manager

Question 15

A company wants to encrypt training data stored in Amazon S3 and model artifacts in Amazon SageMaker using customer-managed keys. Which TWO AWS services or features should they use? (Select TWO.)

Accepted Answer

AWS Key Management Service (KMS). AWS KMS allows creation of customer-managed keys. SageMaker can be configured to use a KMS key to encrypt model artifacts and the ML storage volume. S3 also integrates with KMS for server-side encryption.

Answer

Amazon Macie

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM