AIF-C01 Security, Compliance, and Governance for AI Solutions Practice Test 5 — 15 Questions

Question 1

A financial services company uses Amazon SageMaker to train models with sensitive customer data. They must ensure that no data leaves a specific AWS Region due to data residency regulations. The training data is in S3. Which architecture meets this requirement while minimizing data transfer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use S3 VPC endpoints and place SageMaker training job in a private subnet with no internet access. Using a VPC with S3 VPC endpoints ensures data stays within the AWS network and does not traverse the internet. Data remains in the same Region because S3 endpoints are Regional.

Answer

Place SageMaker training job in a private subnet with a NAT gateway and route traffic through the internet

Answer

Configure S3 Transfer Acceleration and use a public SageMaker training job

Answer

Use AWS Glue to copy data to an EBS volume attached to the training instance

Question 2

A company uses Amazon Bedrock and needs to log all model invocations for audit purposes. The logs must be stored in a central S3 bucket and also sent to CloudWatch Logs for real-time monitoring. Which configuration should they use?

Accepted Answer

Configure Amazon Bedrock model invocation logging to send logs to both S3 and CloudWatch Logs. Bedrock model invocation logging can be configured to send logs to both S3 and CloudWatch Logs simultaneously. This is a built-in feature of Bedrock logging settings.

Answer

Enable Amazon Macie to monitor Bedrock responses

Answer

Enable AWS CloudTrail to capture Bedrock API calls and configure CloudTrail logs to S3 and CloudWatch

Answer

Use AWS Lambda to capture responses and write to S3 and CloudWatch

Question 3

A machine learning engineer wants to detect if sensitive data, such as personally identifiable information (PII), exists in a training dataset stored in S3 before training a model. Which AWS service should they use?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in S3 buckets.

Answer

Amazon Inspector

Answer

Amazon GuardDuty

Answer

AWS Config

Question 4

A data science team is deploying a model using Amazon SageMaker. They need to monitor the model for bias after it is deployed. Which AWS service or feature should they use?

Accepted Answer

Amazon SageMaker Clarify. Amazon SageMaker Clarify provides bias detection and explainability for machine learning models, including pre-training bias metrics on datasets and post-training bias metrics on deployed model predictions. It integrates with SageMaker Model Monitor to continuously detect bias drift in production.

Answer

Amazon Bedrock Guardrails

Answer

Amazon SageMaker Model Monitor

Answer

AWS CloudTrail

Question 5

A company uses AWS Lake Formation to manage data lakes for analytics. They want to ensure that only authorized users can access specific columns in a table containing sensitive data used for ML training. Which Lake Formation feature should they use?

Accepted Answer

Column-level permissions. Lake Formation column-level permissions allow fine-grained access control to specific columns within a table.

Answer

Row-level security filters

Answer

Cell-level security

Answer

S3 bucket policies

Question 6

A company wants to use a third-party foundation model from Amazon Bedrock but is concerned about data privacy because the model provider might store prompts and responses. How should they address this concern?

Accepted Answer

Review the third-party model provider's data handling policy and choose a model that does not retain data. Each third-party model provider in Bedrock has its own data handling policies. Customers should review those policies and can choose models that do not store data or use Bedrock features like Guardrails to redact sensitive data. However, the direct action is to review the provider's policy and select a model that meets privacy requirements.

Answer

Enable Amazon Bedrock model invocation logging to capture all interactions

Answer

Use Amazon Macie to scan prompts before they are sent

Answer

Use AWS KMS to encrypt the prompts and responses before sending to the model

Question 7

A company has trained a model using Amazon SageMaker and stored the model artifacts in S3 with SSE-KMS encryption. The development team wants to grant cross-account access to the model artifacts so a partner can deploy the model in their own account. Which steps are required?

Accepted Answer

Create an S3 bucket policy allowing the partner account to read the objects, and ensure the KMS key policy allows the partner account to use the key. To share SSE-KMS encrypted objects cross-account, you must grant the partner account access to both the S3 object (via bucket policy) and the KMS key (via key policy). The partner must also have the correct IAM permissions.

Answer

Create a new IAM role in the partner account with S3 read permissions

Answer

Use AWS Lake Formation to share the data

Answer

Copy the model artifacts to a public S3 bucket

Question 8

A company uses Amazon Bedrock Guardrails to filter harmful content. They want to ensure that the model does not generate responses containing specific keywords related to their internal project names. Which Guardrails component should they configure?

Accepted Answer

Word filters. Word filters in Amazon Bedrock Guardrails are specifically designed to block or mask responses containing custom keywords or phrases. By configuring word filters, the company can ensure that internal project names are not generated in model responses. This is the precise component for keyword-based filtering.

Answer

Harmful content filters

Answer

Topic restrictions

Answer

Grounding checks

Question 9

A company has deployed a model on Amazon SageMaker and enabled Model Monitor. They notice that the model's prediction accuracy has declined over time. Which type of drift is this, and what should they do?

Accepted Answer

This is concept drift; they should retrain the model with new data. The decline in prediction accuracy over time, despite the model and data pipeline remaining the same, is characteristic of concept drift—the relationship between input features and the target variable has changed. The appropriate action is to retrain the model with new data that reflects the current relationship. SageMaker Model Monitor can detect this via accuracy metrics.

Answer

This is bias drift; they should run SageMaker Clarify

Answer

This is model drift; they should delete and redeploy the model

Answer

This is data drift; they should update the training data

Question 10

A company uses Amazon Bedrock and wants to ensure that the model outputs are grounded in a set of provided documents to reduce hallucinations. Which TWO actions should they take? (Select TWO.)

Accepted Answer

Enable the grounding check in Bedrock Guardrails. Option A is correct because Bedrock Guardrails provides a contextual grounding check that evaluates model responses against a provided source (reference) and applies a grounding threshold to filter or flag responses that are not supported by the source, directly reducing hallucinations. Option D is correct because Amazon Bedrock Knowledge Bases ingests the provided documents, chunks them, generates embeddings, and stores them in a vector store so the model can retrieve relevant chunks at inference time via RetrieveAndGenerate, grounding outputs in the actual documents. Option B is wrong because a word filter blocks specific words or phrases and cannot determine whether a statement is factually grounded in the source documents. Option C is wrong because model invocation logging to S3 only records requests and responses for auditing and monitoring; it does not ground outputs or prevent hallucinations. Option E is wrong because fine-tuning on the documents adapts model weights to style and patterns but does not provide retrieval-based grounding or verifiable citations, and it is not the recommended mechanism for grounding against a document set.

Answer

Configure a word filter to block ungrounded phrases

Answer

Enable model invocation logging to S3

Answer

Fine-tune the model on the documents

Question 11

A company is implementing an AI governance framework for their machine learning models deployed on Amazon SageMaker. Which THREE actions should they include to manage the model lifecycle effectively? (Select THREE.)

Accepted Answer

Enable Amazon CloudWatch alarms for model accuracy metrics. Option A is correct because Amazon CloudWatch alarms on model accuracy metrics (e.g., via SageMaker Model Monitor's ModelQuality metrics) provide automated detection of drift or degradation, which is essential for governing model performance across the lifecycle. Option C is correct because a formal decommissioning policy ensures old models are retired in a controlled, auditable way, preventing stale or non-compliant models from continuing to serve predictions. Option E is correct because SageMaker Model Registry provides model versioning, approval workflows, and metadata tracking, which are foundational for managing the model lifecycle and governance. Option B is not appropriate because automatically deleting all previous model versions destroys the audit trail and rollback capability that governance frameworks require. Option D is not the right tool because CloudTrail records AWS API activity (control-plane events), not individual model inference requests; inference logging is handled by SageMaker endpoint data capture or CloudWatch Logs.

Answer

Automatically delete all previous model versions after deployment

Answer

Use AWS CloudTrail to track model inference requests

Question 12

A company uses Amazon Bedrock to build an AI assistant. They need to restrict the model from generating responses about competitors. Which Bedrock feature should they configure?

Accepted Answer

Denied topics. Bedrock Guardrails allows you to define topic restrictions that block certain topics from being discussed. Other options are for content filtering, PII redaction, or grounding.

Answer

Word filters

Answer

PII redaction

Answer

Content filters

Question 13

A data scientist needs to train a model in Amazon SageMaker using a dataset that contains personally identifiable information (PII). The company policy requires all data at rest to be encrypted with a customer-managed key. Which configuration meets this requirement?

Accepted Answer

Specify a KMS customer-managed key when creating the SageMaker training job and enable data encryption for the S3 bucket with the same key. Using a KMS customer-managed key (CMK) for SageMaker's EBS volumes and S3 buckets ensures encryption at rest with a key the customer controls. The other options either use AWS-managed keys, skip encryption, or are not applicable to SageMaker training jobs.

Answer

Enable default encryption for the S3 bucket using AWS-managed S3 keys (SSE-S3)

Answer

Encrypt the data before uploading to S3 using a client-side library

Answer

Use SageMaker's local mode and store data on the instance's ephemeral storage

Question 14

An organization uses a third-party foundation model accessed through Amazon Bedrock. The compliance team requires that all model inputs and outputs be auditable and retained for one year. Which approach should the team implement?

Accepted Answer

Enable Bedrock model invocation logging and configure destination to S3 with a lifecycle policy to retain logs for one year. Bedrock model invocation logging captures all requests and responses and can be sent to CloudWatch Logs or S3 for retention. CloudTrail logs only API-level events (e.g., InvokeModel calls) but not the actual payloads. The other options do not provide payload logging.

Answer

Store all prompts and responses in a DynamoDB table via custom code in the application

Answer

Use VPC Flow Logs to capture network traffic to Bedrock

Answer

Enable CloudTrail data events for Bedrock

Question 15

A machine learning team wants to detect bias in a deployed model's predictions on new data. They use Amazon SageMaker. Which service should they use to generate bias reports after deployment?

Accepted Answer

Amazon SageMaker Clarify. Amazon SageMaker Clarify provides bias detection and explainability for ML models, both during training and after deployment. SageMaker Model Monitor detects data drift but not bias. SageMaker Debugger is for training debugging. SageMaker Role Manager is for managing IAM roles.

Answer

Amazon SageMaker Debugger

Answer

Amazon SageMaker Model Monitor

Answer

Amazon SageMaker Role Manager