AIF-C01 Security, Compliance, and Governance for AI Solutions — Timed 20 Questions

Question 1

A company uses Amazon SageMaker to train sensitive ML models. Which AWS service should they use to encrypt the training data and model artifacts at rest?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) allows customers to create and manage encryption keys used to encrypt data at rest in SageMaker, including training data and model artifacts.

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Answer

AWS Certificate Manager

Question 2

A data scientist needs to allow a foundation model in Amazon Bedrock to access a specific S3 bucket containing reference documents. The bucket is in a different AWS account. What is the MOST secure way to grant access?

Accepted Answer

Configure the S3 bucket policy to allow access from the Bedrock service role and add a Bedrock resource policy allowing the bucket. Cross-account access requires both the S3 bucket policy to grant the Bedrock service role and the Bedrock resource policy to allow the bucket, ensuring least privilege.

Answer

Use AWS Lake Formation to grant cross-account access to the bucket

Answer

Copy the S3 bucket to the same account as Bedrock

Answer

Make the S3 bucket public and use a pre-signed URL

Question 3

A company uses Bedrock Guardrails to filter harmful content in a generative AI application. They need to prevent the model from discussing proprietary internal projects. Which Guardrail component should be configured?

Accepted Answer

Topic restrictions. Topic restrictions allow administrators to define denied topics; the model will not generate responses related to those topics.

Answer

Content filters

Answer

Grounding check

Answer

Word filters

Question 4

A financial services firm needs to ensure that all calls to Amazon Bedrock APIs are logged for audit purposes. Which AWS service should they enable to capture API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity in AWS accounts, including Bedrock API calls, providing audit logs.

Answer

Amazon S3 server access logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 5

A company wants to detect sensitive data such as PII in their training datasets stored in S3 before using them for model training. Which AWS service should they use?

Accepted Answer

Amazon Macie. Amazon Macie uses machine learning to discover and protect sensitive data in S3, including PII.

Answer

Amazon Inspector

Answer

AWS Shield

Answer

Amazon GuardDuty

Question 6

A company uses SageMaker Clarify to detect bias in a deployed model. The monitoring must run automatically on a schedule. Which SageMaker feature should they use?

Accepted Answer

SageMaker Model Monitor. SageMaker Model Monitor can be configured to run bias detection jobs on a schedule using Clarify's bias metrics.

Answer

SageMaker Pipelines

Answer

SageMaker Experiments

Answer

SageMaker Data Wrangler

Question 7

An organization uses AWS Lake Formation to govern a data lake used for SageMaker training. They need to enforce row-level security so that different teams only see data relevant to their projects. Which Lake Formation feature should they use?

Accepted Answer

Row-level security. Lake Formation's row-level security uses filters to restrict access to specific rows based on conditions.

Answer

Cell-level security

Answer

Column-level security

Answer

Tag-based access control

Question 8

A company wants to use Amazon Bedrock to generate responses grounded in their proprietary knowledge base. They need to minimize hallucinations and ensure responses are based on the provided documents. Which feature should they enable?

Accepted Answer

Grounding check. Grounding check in Bedrock Guardrails verifies that the model's response is supported by the source documents, reducing hallucinations.

Answer

Topic restrictions

Answer

Word filters

Answer

Content filters

Question 9

A data scientist needs to restrict access to a SageMaker notebook instance to only the corporate network. Which configuration should they use?

Accepted Answer

Place the notebook instance in a VPC and configure security groups to allow only corporate IP ranges. VPC isolation places the notebook instance inside a VPC, and security groups can restrict inbound traffic to the corporate network IP range.

Answer

Enable multi-factor authentication for the notebook

Answer

Use an IAM policy to allow only corporate users

Answer

Use a SageMaker lifecycle configuration to block external IPs

Question 10

A company needs to ensure that model inference endpoints in SageMaker are only accessible from a private subnet in their VPC, and no traffic goes over the public internet. Which network configuration should they use?

Accepted Answer

Use a VPC interface endpoint for SageMaker and disable public access. A VPC-only endpoint (interface endpoint) or private endpoint without public internet access ensures traffic stays within the VPC.

Answer

Create a public endpoint and restrict access using IAM policies

Answer

Use AWS PrivateLink for the endpoint, but keep public endpoint enabled

Answer

Deploy the endpoint in a public subnet with a security group blocking all inbound traffic

Question 11

A company using Amazon Bedrock needs to redact personally identifiable information (PII) from user inputs before sending them to the foundation model. Which Bedrock Guardrails component should be configured?

Accepted Answer

Sensitive information filters. PII redaction in Guardrails automatically detects and redacts PII in user inputs or model responses.

Answer

Content filters

Answer

Topic restrictions

Answer

Word filters

Question 12

A company wants to use a third-party foundation model in Bedrock and is concerned about the provider's data handling policies. Which action should they take to ensure their data is not used for model training by the provider?

Accepted Answer

Review the provider's data privacy policy and enable the opt-out option for training data use if available. AWS provides model access approval settings where customers can review and accept data handling policies; many providers offer opt-out options for training data use.

Answer

Use Bedrock's content filters to block sensitive data

Answer

Encrypt all data with KMS before sending to Bedrock

Answer

Use a custom model hosted on SageMaker instead

Question 13

A company needs to govern the lifecycle of ML models, including versioning, monitoring for drift, and decommissioning outdated models. Which TWO services should they use? (Choose 2)

Accepted Answer

Amazon SageMaker Model Registry. SageMaker Model Registry handles versioning and model approval; SageMaker Model Monitor tracks drift and performance.

Answer

AWS CloudTrail

Answer

Amazon S3

Answer

AWS CodePipeline

Question 14

A company wants to enforce strict data residency for training data used in SageMaker. The data must never leave a specific AWS Region. Which THREE actions should they take? (Choose 3)

Accepted Answer

Use KMS customer managed keys specific to the region. To enforce data residency, the company must use a VPC in the desired region, configure S3 bucket policies to block cross-region access, and use KMS keys regional to that region.

Answer

Use AWS KMS multi-Region keys to encrypt data

Answer

Enable cross-region replication for the S3 bucket

Question 15

A company wants to log all model invocation requests in Amazon Bedrock for audit and troubleshooting. Which TWO destinations can they configure for invocation logging? (Choose 2)

Accepted Answer

Amazon CloudWatch Logs. Bedrock invocation logging supports S3 and CloudWatch Logs as destinations.

Answer

Amazon DynamoDB

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Firehose

Question 16

A data scientist wants to restrict which IAM roles can invoke a specific Amazon Bedrock base model. Which AWS feature should they use?

Accepted Answer

Bedrock resource-based policy. Bedrock resource policies allow you to attach fine-grained permissions to a specific model, specifying which principals (IAM roles) can invoke it.

Answer

S3 bucket policy on the model artifacts

Answer

AWS KMS key policy for the encryption key

Answer

AWS CloudTrail log delivery policy

Question 17

A healthcare company uses Amazon SageMaker to train a model on patient data. To meet HIPAA compliance, they must ensure training data is encrypted at rest and in transit. Additionally, the training job should not have internet access. Which combination of actions should the company take?

Accepted Answer

Specify a KMS key for SageMaker's VolumeKmsKeyId and configure the training job to run in a VPC without a public internet route. Using KMS encryption keys and configuring the training job to run in a VPC without a public internet route satisfies both encryption and network isolation requirements.

Answer

Use AWS Certificate Manager (ACM) to issue a certificate for the training job and enable network isolation

Answer

Enable SageMaker data capture and use a private VPC with an internet gateway

Answer

Store training data in an encrypted S3 bucket and use a SageMaker notebook instance inside a VPC

Question 18

A financial services firm uses Amazon Bedrock to generate investment summaries. They need to prevent the model from generating content containing personally identifiable information (PII) such as social security numbers. Which feature should they configure in Bedrock Guardrails?

Accepted Answer

Sensitive information filters with PII redaction. Bedrock Guardrails include a PII redaction filter that can detect and block or mask PII in model inputs and outputs.

Answer

Contextual grounding checks

Answer

Content filtering with category-based harmful content filters

Answer

Word filters with a custom list of terms

Question 19

A company uses Amazon SageMaker Clarify to monitor a deployed model for bias. After running an analysis, they find that the model's predictions have a disparate impact on a protected group. What is the MOST appropriate next step?

Accepted Answer

Investigate the root cause of bias, then use techniques such as reweighing training data or applying bias mitigation algorithms before redeploying. Discovering bias requires investigation and mitigation. SageMaker Clarify can help identify bias, but mitigation typically involves retraining with balanced data or adjusting model outputs.

Answer

Modify the SageMaker endpoint to add a random noise to predictions for the protected group

Answer

Ignore the results because SageMaker Clarify is still in preview

Answer

Immediately delete the model and retrain from scratch using only data from the protected group

Question 20

A data governance team wants to enforce fine-grained access control on data in an Amazon S3 data lake used by multiple business units for AI training. Which AWS service should they use to define and manage data permissions at the table and column level?

Accepted Answer

AWS Lake Formation. AWS Lake Formation provides fine-grained access control for data lakes, allowing you to set permissions on tables and columns across AWS analytics and ML services.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudTrail

Answer

Amazon Macie