AIF-C01 Security, Compliance, and Governance for AI Solutions Practice Test 4 — 15 Questions

Question 1

A company uses Amazon Bedrock to access foundation models. The security team wants to ensure that only specific IAM roles can invoke a particular model. Which configuration should they use?

Accepted Answer

Create a Bedrock resource policy that grants InvokeModel to the required roles. Amazon Bedrock uses resource-based policies attached to the model to control access. IAM policies alone are insufficient because the model resource itself must grant access to specific principals.

Answer

Attach an S3 bucket policy to the model artifacts

Answer

Configure a VPC endpoint for Bedrock

Answer

Use AWS Organizations service control policies to deny all model access

Question 2

A data scientist is training a model using Amazon SageMaker and needs to ensure the training data is encrypted at rest and in transit. The data is stored in S3. Which combination of steps meets this requirement?

Accepted Answer

Use an S3 bucket with SSE-KMS encryption and configure the SageMaker training job to use a VPC with no internet access. S3 server-side encryption (SSE-S3 or KMS) protects data at rest. SageMaker uses HTTPS for data in transit between S3 and the training instance, and VPC configuration can enforce network isolation.

Answer

Enable S3 Transfer Acceleration and use a public SageMaker training job

Answer

Use client-side encryption before uploading to S3 and disable SageMaker internet access

Answer

Enable default S3 bucket encryption and use a SageMaker notebook instance in a private subnet

Question 3

A company uses Amazon Bedrock to generate content and wants to prevent the model from producing harmful or biased responses. Which AWS service should they configure to enforce content safety policies?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails provides content filtering, PII redaction, topic restrictions, and other safety controls. It is purpose-built for content safety in Bedrock.

Answer

Amazon Comprehend for toxicity detection

Answer

Amazon SageMaker Clarify

Answer

AWS WAF to filter model responses

Question 4

A financial services company uses Amazon SageMaker to train models with sensitive customer data. They must ensure that no data leaves a specific AWS Region due to data residency regulations. The training data is in S3. Which architecture meets this requirement while minimizing data transfer?

Accepted Answer

Use S3 VPC endpoints and place SageMaker training job in a private subnet with no internet access. Using a VPC with S3 VPC endpoints ensures data stays within the AWS network and does not traverse the internet. Data remains in the same Region because S3 endpoints are Regional.

Answer

Place SageMaker training job in a private subnet with a NAT gateway and route traffic through the internet

Answer

Configure S3 Transfer Acceleration and use a public SageMaker training job

Answer

Use AWS Glue to copy data to an EBS volume attached to the training instance

Question 5

A company uses Amazon Bedrock and needs to log all model invocations for audit purposes. The logs must be stored in a central S3 bucket and also sent to CloudWatch Logs for real-time monitoring. Which configuration should they use?

Accepted Answer

Configure Amazon Bedrock model invocation logging to send logs to both S3 and CloudWatch Logs. Bedrock model invocation logging can be configured to send logs to both S3 and CloudWatch Logs simultaneously. This is a built-in feature of Bedrock logging settings.

Answer

Enable Amazon Macie to monitor Bedrock responses

Answer

Enable AWS CloudTrail to capture Bedrock API calls and configure CloudTrail logs to S3 and CloudWatch

Answer

Use AWS Lambda to capture responses and write to S3 and CloudWatch

Question 6

A machine learning engineer wants to detect if sensitive data, such as personally identifiable information (PII), exists in a training dataset stored in S3 before training a model. Which AWS service should they use?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in S3 buckets.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 7

A data science team is deploying a model using Amazon SageMaker. They need to monitor the model for bias after it is deployed. Which AWS service or feature should they use?

Accepted Answer

Amazon SageMaker Clarify. Amazon SageMaker Clarify provides bias detection and explainability for ML models, both during training (pre-deployment) and inference (post-deployment).

Answer

Amazon Bedrock Guardrails

Answer

Amazon SageMaker Model Monitor

Answer

AWS CloudTrail

Question 8

A company uses AWS Lake Formation to manage data lakes for analytics. They want to ensure that only authorized users can access specific columns in a table containing sensitive data used for ML training. Which Lake Formation feature should they use?

Accepted Answer

Column-level permissions. Lake Formation column-level permissions allow fine-grained access control to specific columns within a table.

Answer

Row-level security filters

Answer

Cell-level security

Answer

S3 bucket policies

Question 9

A company wants to use a third-party foundation model from Amazon Bedrock but is concerned about data privacy because the model provider might store prompts and responses. How should they address this concern?

Accepted Answer

Review the third-party model provider's data handling policy and choose a model that does not retain data. Each third-party model provider in Bedrock has its own data handling policies. Customers should review those policies and can choose models that do not store data or use Bedrock features like Guardrails to redact sensitive data. However, the direct action is to review the provider's policy and select a model that meets privacy requirements.

Answer

Enable Amazon Bedrock model invocation logging to capture all interactions

Answer

Use Amazon Macie to scan prompts before they are sent

Answer

Use AWS KMS to encrypt the prompts and responses before sending to the model

Question 10

A company has trained a model using Amazon SageMaker and stored the model artifacts in S3 with SSE-KMS encryption. The development team wants to grant cross-account access to the model artifacts so a partner can deploy the model in their own account. Which steps are required?

Accepted Answer

Create an S3 bucket policy allowing the partner account to read the objects, and ensure the KMS key policy allows the partner account to use the key. To share SSE-KMS encrypted objects cross-account, you must grant the partner account access to both the S3 object (via bucket policy) and the KMS key (via key policy). The partner must also have the correct IAM permissions.

Answer

Create a new IAM role in the partner account with S3 read permissions

Answer

Use AWS Lake Formation to share the data

Answer

Copy the model artifacts to a public S3 bucket

Question 11

A company uses Amazon Bedrock Guardrails to filter harmful content. They want to ensure that the model does not generate responses containing specific keywords related to their internal project names. Which Guardrails component should they configure?

Accepted Answer

Word filters. Word filters in Bedrock Guardrails allow you to specify custom words or phrases that should be blocked in model responses.

Answer

Harmful content filters

Answer

Topic restrictions

Answer

Grounding checks

Question 12

A company has deployed a model on Amazon SageMaker and enabled Model Monitor. They notice that the model's prediction accuracy has declined over time. Which type of drift is this, and what should they do?

Accepted Answer

This is concept drift; they should retrain the model with new data. Model drift refers to the degradation of model performance over time due to changes in data or relationships. SageMaker Model Monitor can detect data drift, but model drift (accuracy decline) requires retraining or updating the model.

Answer

This is bias drift; they should run SageMaker Clarify

Answer

This is model drift; they should delete and redeploy the model

Answer

This is data drift; they should update the training data

Question 13

A company uses Amazon Bedrock and wants to ensure that the model outputs are grounded in a set of provided documents to reduce hallucinations. Which TWO actions should they take? (Select TWO.)

Accepted Answer

Enable the grounding check in Bedrock Guardrails. Bedrock Guardrails' grounding check verifies that model responses are supported by source documents. Knowledge Bases for Amazon Bedrock provide a RAG architecture to retrieve relevant document chunks.

Answer

Configure a word filter to block ungrounded phrases

Answer

Enable model invocation logging to S3

Answer

Fine-tune the model on the documents

Question 14

A company is implementing an AI governance framework for their machine learning models deployed on Amazon SageMaker. Which THREE actions should they include to manage the model lifecycle effectively? (Select THREE.)

Accepted Answer

Enable Amazon CloudWatch alarms for model accuracy metrics. Model versioning tracks changes, monitoring for drift ensures performance, and a decommissioning process retires outdated models. These are key lifecycle management practices.

Answer

Automatically delete all previous model versions after deployment

Answer

Use AWS CloudTrail to track model inference requests

Question 15

A data scientist needs to use Amazon SageMaker to train a model and must ensure that the training data and the model artifacts are encrypted using customer-managed KMS keys. Which TWO resources can be encrypted with KMS keys in this scenario? (Select TWO.)

Accepted Answer

SageMaker ML storage volume (attached to training instances). SageMaker can use KMS keys to encrypt the ML storage volume (attached to training instances) and S3 buckets storing training data. Model artifacts in S3 can also be encrypted with KMS.

Answer

SageMaker notebook instances

Answer

Amazon SageMaker Model Registry

Answer

Amazon CloudWatch Logs