hardMultiple ChoiceObjective-mapped
AIF-C01 Practice Question: A healthcare company is deploying a model to…
A healthcare company is deploying a model to predict patient readmission risk using Amazon SageMaker. The model processes protected health information (PHI). The company must adhere to HIPAA regulations, which require that all PHI is encrypted at rest and in transit, and that access to the data is logged and audited. The data is stored in an S3 bucket encrypted with SSE-S3. The SageMaker training job uses a custom Docker container that reads data from the S3 bucket and writes model artifacts back to another S3 bucket. The security team notices that the model artifacts in the output bucket are not encrypted. Also, the training logs in CloudWatch Logs contain PHI because the training script logs patient features. The company must fix these issues without delaying the deployment. What should the company do?
⚠ Common exam trap
The trap here is that candidates may focus on network-level controls (VPC, TLS) or logging mechanisms, overlooking the fact that the core issues are encryption at rest for the output bucket and preventing PHI from being written to CloudWatch Logs, which require application-level changes and bucket configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the training container to avoid logging PHI, and configure the output S3 bucket to use SSE-KMS encryption.
It directly addresses both issues: modifying the training container to avoid logging PHI ensures CloudWatch Logs no longer contain protected health information, and configuring the output S3 bucket to use SSE-KMS encryption ensures model artifacts are encrypted at rest. SSE-KMS is preferred over SSE-S3 for HIPAA compliance because it provides additional controls like key rotation and audit trails. This approach fixes the problems without delaying deployment, as it requires only code and configuration changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement client-side encryption for the output bucket, and update the training script to mask PHI before logging.
Why it's wrong here
Client-side encryption adds complexity and is not natively supported by SageMaker. Masking PHI in logs is good, but encryption should be server-side for simplicity.
- ✗
Change the output S3 bucket to use SSE-KMS encryption, and enable server access logs for the bucket.
Why it's wrong here
This fixes encryption, but server access logs do not prevent PHI from being logged in CloudWatch Logs.
- ✓
Modify the training container to avoid logging PHI, and configure the output S3 bucket to use SSE-KMS encryption.
Why this is correct
This directly addresses both issues: encryption of output artifacts and removal of PHI from logs.
- ✗
Configure the training job to use a VPC with private subnets, and enable data encryption in transit using TLS.
Why it's wrong here
This addresses network encryption but not the output bucket encryption or the logging issue.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 619 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.