AIF-C01 Practice Question: Security, Compliance, and Governance for AI Solutions
A company is deploying a real-time inference endpoint using Amazon SageMaker. The security team requires that all data sent to the endpoint be encrypted in transit and that the endpoint is only accessible from within the company's VPC. Which configuration should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the endpoint in a private subnet with a VPC endpoint for SageMaker Runtime
SageMaker endpoints can be deployed in a VPC and configured to use a private VPC endpoint (AWS PrivateLink) so that they are accessible only from within the VPC. HTTPS ensures encryption in transit; SageMaker endpoints automatically use HTTPS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy the endpoint in a private subnet with a VPC endpoint for SageMaker Runtime
Why this is correct
This makes the endpoint accessible only via the VPC endpoint, ensuring no public internet access, and HTTPS is used automatically.
- ✗
Deploy the endpoint in a public subnet and use a security group to restrict source IPs
Why it's wrong here
Even with security group restrictions, the endpoint has a public DNS and is potentially exposed to the internet.
- ✗
Enable network isolation on the endpoint
Why it's wrong here
Network isolation prevents the endpoint from accessing the internet but does not restrict inbound access; the endpoint remains publicly accessible.
- ✗
Use an AWS Lambda function to proxy requests and restrict access via IAM
Why it's wrong here
Lambda adds complexity and still requires the endpoint to be accessible; it does not inherently restrict network access.
Go deeper
Related to this question
About these practice questions
This AIF-C01 question is part of Courseiva's 619-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.