hardMultiple SelectObjective-mapped
AIF-C01 Practice Question: A company uses Amazon SageMaker Pipelines for…
A company uses Amazon SageMaker Pipelines for MLOps. The security team requires that all pipeline steps use only approved Docker images from a private Amazon ECR repository, and that all pipeline artifacts are encrypted with a customer managed KMS key. Which THREE steps must the company configure to meet these requirements? (Choose three.)
⚠ Common exam trap
The AIF-C01 exam often tests the distinction between configuration that directly enforces a requirement (like specifying ImageUri and KMS key) versus monitoring or housekeeping actions (like lifecycle policies or Config rules) that do not enforce the requirement at the pipeline step level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Specify a KMS key in the pipeline definition for encrypting output artifacts.
Amazon SageMaker Pipelines allows you to specify a KMS key in the pipeline definition to encrypt output artifacts at rest. This ensures that all artifacts generated by pipeline steps are encrypted using a customer managed KMS key, meeting the security team's encryption requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Specify a KMS key in the pipeline definition for encrypting output artifacts.
Why this is correct
This encrypts artifacts with the customer managed key.
- ✗
Set an ECR lifecycle policy to delete untagged images older than 30 days.
Why it's wrong here
Lifecycle policies manage image retention, not enforcement of approved images in pipelines.
- ✓
Configure each pipeline step to use an ImageUri that references a Docker image in the private Amazon ECR repository.
Why this is correct
This ensures only approved images from the private repo are used.
- ✗
Enable AWS Config rules to check for public ECR repositories.
Why it's wrong here
Config rules are detective, not preventive; they do not enforce encryption in the pipeline.
- ✓
Assign an IAM role to the pipeline that includes kms:Encrypt and kms:Decrypt permissions for the customer managed KMS key.
Why this is correct
The role must have KMS permissions to perform encryption/decryption during pipeline execution.
Go deeper
Related to this question
About these practice questions
One of 619 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.