mediumMultiple SelectObjective-mapped
AIF-C01 Practice Question: A data science team uses Amazon SageMaker to…
A data science team uses Amazon SageMaker to train models. To comply with SOC 2, they must ensure that access to training data is logged, that the data is encrypted at rest, and that model training jobs are isolated from each other. Which THREE actions should they take? (Choose three.)
⚠ Common exam trap
Candidates often confuse Amazon Inspector with a logging or encryption service, or think SageMaker Debugger provides security logging, when in fact Inspector only scans for vulnerabilities and Debugger only monitors model training metrics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable server-side encryption on the S3 bucket containing training data using SSE-KMS.
Enabling server-side encryption on the S3 bucket containing training data using SSE-KMS ensures data at rest is encrypted, which is a direct requirement for SOC 2 compliance. SSE-KMS provides envelope encryption with a customer-managed AWS KMS key, allowing fine-grained access control and audit trails for the encryption keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Amazon Inspector to scan training instances for vulnerabilities.
Why it's wrong here
Inspector is for vulnerability scanning, not required by SOC 2 for these controls.
- ✓
Enable server-side encryption on the S3 bucket containing training data using SSE-KMS.
Why this is correct
SSE-KMS encrypts data at rest.
- ✗
Use SageMaker Debugger to monitor training jobs.
Why it's wrong here
Debugger is for debugging and profiling, not for logging or encryption.
- ✓
Enable AWS CloudTrail to capture SageMaker API calls.
Why this is correct
CloudTrail logs access to training jobs and data.
- ✓
Use SageMaker VPC mode to launch training jobs in a private subnet.
Why this is correct
VPC mode isolates training jobs within a private network.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This AIF-C01 question is part of Courseiva's 619-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.