AIF-C01 Security, Compliance, and Governance for AI Solutions Practice Test 4 — 15 Questions

Question 1

A financial services firm uses Amazon Bedrock to generate investment summaries. They need to prevent the model from generating content containing personally identifiable information (PII) such as social security numbers. Which feature should they configure in Bedrock Guardrails?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sensitive information filters with PII redaction. Bedrock Guardrails include a PII redaction filter that can detect and block or mask PII in model inputs and outputs.

Answer

Contextual grounding checks

Answer

Content filtering with category-based harmful content filters

Answer

Word filters with a custom list of terms

Question 2

A company uses Amazon SageMaker Clarify to monitor a deployed model for bias. After running an analysis, they find that the model's predictions have a disparate impact on a protected group. What is the MOST appropriate next step?

Accepted Answer

Investigate the root cause of bias, then use techniques such as reweighing training data or applying bias mitigation algorithms before redeploying. Discovering bias requires investigation and mitigation. SageMaker Clarify can help identify bias, but mitigation typically involves retraining with balanced data or adjusting model outputs.

Answer

Modify the SageMaker endpoint to add a random noise to predictions for the protected group

Answer

Ignore the results because SageMaker Clarify is still in preview

Answer

Immediately delete the model and retrain from scratch using only data from the protected group

Question 3

A data governance team wants to enforce fine-grained access control on data in an Amazon S3 data lake used by multiple business units for AI training. Which AWS service should they use to define and manage data permissions at the table and column level?

Accepted Answer

AWS Lake Formation. AWS Lake Formation is purpose-built to define and manage fine-grained access control (table, column, row, and cell level) on data stored in Amazon S3 data lakes. It provides a centralized permission model that works across analytics and AI/ML services, making it the correct choice for multi-business-unit governance. IAM alone cannot express column-level permissions on S3 data.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudTrail

Answer

Amazon Macie

Question 4

A security engineer is configuring logging for Amazon Bedrock model invocations. They need to capture both the input and output of all API calls for compliance audits. Which set of steps should they take?

Accepted Answer

Enable Bedrock model invocation logging and specify an S3 bucket and optionally CloudWatch Logs as the destination. Bedrock model invocation logging captures inputs and outputs to S3 and/or CloudWatch Logs. CloudTrail records API calls but not the model inputs/outputs.

Answer

Enable CloudTrail for the Bedrock API and configure S3 event notifications

Answer

Use VPC Flow Logs to capture network traffic and reconstruct model inputs from packet data

Answer

Enable AWS Config rules for Bedrock and stream logs to Amazon Kinesis

Question 5

A company wants to automatically discover sensitive data such as credit card numbers in their Amazon S3 training datasets before using them for model training. Which AWS service should they use?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data stored in Amazon S3. It is purpose-built to detect PII such as credit card numbers, social security numbers, and API keys in S3 buckets, making it the correct choice for scanning training datasets before use.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS Audit Manager

Question 6

A company is deploying an AI-powered document summarization system using Amazon Bedrock. They must ensure that the model only uses information from provided source documents and does not generate unsupported claims. Which Bedrock Guardrails feature should they enable?

Accepted Answer

Contextual grounding check. Contextual grounding checks ensure that model responses are factually supported by the reference sources, reducing hallucinations.

Answer

Content filtering with category-based harmful content filters

Answer

Word filters

Answer

Topic restrictions

Question 7

An organization wants to control which topics their AI chatbot can discuss. For example, they want to block all conversations about investment advice. Which Amazon Bedrock Guardrails feature should they configure?

Accepted Answer

Topic restrictions. Amazon Bedrock Guardrails topic restrictions allow you to define a set of topics that the model should avoid discussing. By configuring topic restrictions, you can block conversations about investment advice by providing a natural language description of the topic and example phrases. This is the specific feature designed to deny-list topics.

Answer

Contextual grounding check

Answer

Content filtering with category-based harmful content filters

Answer

Sensitive information filters

Question 8

A company uses Amazon Bedrock with a third-party foundation model. They are concerned about the third-party provider accessing their data. What should they review to understand data handling practices?

Accepted Answer

The third-party model provider's data privacy and handling documentation within AWS Bedrock's service description. When using a third-party foundation model through Amazon Bedrock, the model provider's own data privacy and handling documentation — surfaced within the Bedrock service description and model details — is the authoritative source for how that provider treats your prompts, completions, and any fine-tuning data. AWS's shared responsibility model means AWS secures the Bedrock infrastructure, but the third-party model provider defines its own data usage terms. Reviewing that documentation tells you whether inputs are used for training, how long they are retained, and what regional or contractual safeguards apply.

Answer

AWS Artifact reports for SOC and PCI compliance

Answer

AWS CloudTrail logs for model invocation

Answer

Amazon SageMaker Model Registry metadata

Question 9

A company is deploying an AI model on Amazon SageMaker and needs to monitor for model drift over time. Which TWO actions should they take? (Choose TWO)

Accepted Answer

Enable data capture on the SageMaker endpoint to store real-time inference data in S3. Option B is correct because enabling data capture on a SageMaker endpoint records the request and response payloads of real-time inference traffic and stores them in Amazon S3, which is the required input for drift analysis. Option E is correct because SageMaker Model Monitor runs scheduled monitoring jobs that compare newly captured data against a baseline (created from training or a baseline job) and can emit CloudWatch metrics and alarms when drift, such as data or model quality drift, is detected. Together, B supplies the live data and E performs the comparison and alerting needed to monitor model drift over time. Option A is not appropriate because CloudTrail records control-plane API activity, not inference payloads, so it cannot detect data or model drift. Option C is unrelated because storing model artifacts in Amazon ECR and tagging versions addresses artifact versioning, not runtime drift detection. Option D is insufficient because CloudWatch anomaly detection on invocation count only tracks traffic volume, not changes in input data distribution or model prediction quality.

Answer

Use AWS CloudTrail to log all inference requests and responses

Answer

Store model artifacts in Amazon ECR and tag each version

Answer

Set up Amazon CloudWatch anomaly detection on the endpoint invocation count

Question 10

A company wants to use AWS Lake Formation to govern access to data used for AI training. They need to ensure that only approved columns of sensitive tables are visible to data scientists. Which THREE steps should they implement? (Choose THREE)

Accepted Answer

Use AWS Glue crawlers to catalog the data and populate the Data Catalog. The scenario requires governing access to AI training data with Lake Formation and restricting visibility to approved columns, so the solution must include cataloging, registering the data location, and applying column-level grants. Option A is correct because AWS Glue crawlers scan the S3 data, infer schemas, and populate the AWS Glue Data Catalog, which Lake Formation relies on to define and enforce permissions on tables and columns. Option C is correct because Lake Formation supports column-level permissions, allowing you to grant SELECT on only specific columns of a table to the data scientist role, which directly satisfies the requirement that only approved columns be visible. Option E is correct because the S3 bucket containing the training data must be registered with Lake Formation so that Lake Formation manages access to the underlying data and can enforce its table and column permissions. Option B is not required because a SageMaker notebook instance with an IAM role is a compute/access mechanism, not a governance step for restricting column visibility. Option D is not relevant because S3 versioning provides object version retention and recovery, not fine-grained column access control.

Answer

Create a SageMaker notebook instance and attach an IAM role

Answer

Enable S3 versioning on the training data bucket

Question 11

A company needs to audit all API calls made to Amazon Bedrock, including model invocations and guardrail evaluations. Which AWS service should they enable to capture these API calls for compliance?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls for all AWS services, including Bedrock. It captures the caller identity, API, parameters, and response elements, which can be used for auditing and compliance.

Answer

Amazon Macie

Answer

AWS Config

Answer

Amazon GuardDuty

Question 12

A healthcare startup is using Amazon SageMaker to train a model on patient data. They need to ensure that the training data does not contain any personally identifiable information (PII) before being used. Which AWS service can automatically detect and report PII in the data stored in S3?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and privacy service that uses machine learning to automatically discover, classify, and protect sensitive data stored in Amazon S3. It can detect personally identifiable information (PII) such as names, addresses, and credit card numbers, and provides detailed reports. This directly addresses the requirement to detect and report PII in S3 before using it for training.

Answer

Amazon Rekognition

Answer

AWS Glue DataBrew

Answer

Amazon Comprehend Medical

Question 13

A company has deployed a machine learning model using Amazon SageMaker and wants to monitor the model for bias over time. Which SageMaker feature should they use to detect bias in the model's predictions after deployment?

Accepted Answer

SageMaker Clarify. SageMaker Clarify is designed to detect bias in ML models both before and after deployment. It can analyze predictions to identify potential bias against certain groups.

Answer

SageMaker Debugger

Answer

SageMaker Model Monitor

Answer

SageMaker Role Manager

Question 14

A company is using Amazon SageMaker to manage the lifecycle of their machine learning models. They need to implement a governance framework that includes model versioning, monitoring for drift, and decommissioning of outdated models. Which THREE AWS services or features should they use together to meet these requirements? (Select THREE.)

Accepted Answer

SageMaker Pipelines. SageMaker Model Registry (C) is the correct service for model versioning and governance, as it maintains a catalog of model versions with metadata, approval statuses, and lineage, enabling tracking and controlled promotion of models through their lifecycle. SageMaker Model Monitor (E) is correct because it continuously monitors deployed endpoints for data drift, model quality drift, bias drift, and feature attribution drift, alerting when the model deviates from baseline behavior. SageMaker Pipelines (B) is correct because it provides CI/CD orchestration to automate the ML workflow, including training, evaluation, registration to the Model Registry, and deployment, which supports governance and decommissioning through repeatable, versioned pipeline executions. AWS CloudTrail (A) only records API activity for auditing and does not provide model versioning, drift monitoring, or lifecycle decommissioning, so it does not meet the requirements. SageMaker Role Manager (D) merely helps create and manage IAM roles and permissions for SageMaker personas; it does not provide versioning, drift detection, or model decommissioning capabilities.

Answer

AWS CloudTrail

Answer

SageMaker Role Manager

Question 15

A company uses Amazon Bedrock to generate content and wants to prevent the model from producing harmful or biased responses. Which AWS service should they configure to enforce content safety policies?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails provides content filtering, PII redaction, topic restrictions, and other safety controls. It is purpose-built for content safety in Bedrock.

Answer

Amazon Comprehend for toxicity detection

Answer

Amazon SageMaker Clarify

Answer

AWS WAF to filter model responses