AIF-C01 Practice Question: Security, Compliance, and Governance for AI Solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable Bedrock model invocation logging and specify an S3 bucket and optionally CloudWatch Logs as the destination

  Why this is correct

  Enabling model invocation logging in Bedrock and designating an S3 bucket (with optional CloudWatch Logs) captures both the request input and the model output for every API call, directly meeting the compliance audit requirement to record full invocation content.

• ✗

  Enable CloudTrail for the Bedrock API and configure S3 event notifications

  Why it's wrong here

  CloudTrail records Bedrock control-plane API activity, not the request and response payloads containing prompts and completions, and S3 event notifications only fire on object changes. Model invocation logging is the correct mechanism; CloudTrail suits auditing who called which API, not capturing content.

• ✗

  Use VPC Flow Logs to capture network traffic and reconstruct model inputs from packet data

  Why it's wrong here

  VPC Flow Logs record IP metadata such as addresses, ports and bytes, not request or response payloads, so prompts and completions cannot be reconstructed. It tempts as an existing network-visibility tool, and it would be right for auditing connectivity and traffic patterns rather than Bedrock invocation content.

• ✗

  Enable AWS Config rules for Bedrock and stream logs to Amazon Kinesis

  Why it's wrong here

  AWS Config evaluates resource configuration compliance and does not capture Bedrock request or response bodies, so streaming it to Kinesis yields no invocation content. It tempts because Config and Kinesis are familiar audit pipelines, and it would be right for tracking configuration drift, not logging model inputs and outputs.

Go deeper

Related to this question