AIF-C01 Practice Question: Security, Compliance, and Governance for AI Solutions
A company uses Amazon Bedrock with a custom model that was trained on data subject to GDPR. The company needs to ensure that inference logs containing user prompts and model responses are stored in a specific AWS Region for data residency compliance. How should they configure Bedrock model invocation logging?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable model invocation logging and select an S3 bucket in the required region
Bedrock model invocation logging allows you to specify the S3 bucket and CloudWatch Logs group where logs are stored. By choosing an S3 bucket in the desired region and enabling CloudWatch Logs in that region, you can meet data residency requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Bedrock Guardrail to log all invocations to a CloudWatch Logs group in the required region
Why it's wrong here
Guardrails do not log full invocation content; they log only guardrail evaluations.
- ✓
Enable model invocation logging and select an S3 bucket in the required region
Why this is correct
This directs logs to a bucket in the desired region, satisfying data residency.
- ✗
Use AWS CloudTrail to log all API calls and store them in the required region
Why it's wrong here
CloudTrail logs API calls, not model invocation content (prompts/responses). The requirement is for inference logs.
- ✗
Use AWS Global Accelerator to route traffic to the required region
Why it's wrong here
Global Accelerator improves performance but does not control log storage location.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AIF-C01 question from scratch — 619 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.