AIF-C01 Practice Question: An administrator reviews a CloudTrail log entry…

Exhibit

Refer to the exhibit.
[CloudTrail Log Entry]
{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "AssumedRole",
    "arn": "arn:aws:sts::123456789012:assumed-role/SageMakerExecutionRole/i-0123456789abcdef0",
    "accountId": "123456789012",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "arn": "arn:aws:iam::123456789012:role/SageMakerExecutionRole"
      }
    }
  },
  "eventTime": "2024-03-15T10:00:00Z",
  "eventSource": "sagemaker.amazonaws.com",
  "eventName": "CreateModel",
  "resources": [
    {
      "arn": "arn:aws:sagemaker:us-east-1:123456789012:model/my-model",
      "type": "AWS::SageMaker::Model"
    }
  ],
  "requestParameters": {
    "modelName": "my-model",
    "primaryContainer": {
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-image:latest",
      "modelDataUrl": "s3://my-bucket/model.tar.gz"
    },
    "executionRoleArn": "arn:aws:iam::123456789012:role/SageMakerExecutionRole"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.42",
  "userAgent": "sagemaker.amazonaws.com"
}

An administrator reviews a CloudTrail log entry for a CreateModel API call. Which security concern should they investigate?

⚠ Common exam trap

The AIF-C01 exam often tests the distinction between data in transit encryption (HTTPS vs HTTP) and data at rest encryption, leading candidates to incorrectly focus on log encryption or ARN visibility instead of the actual security risk in the API call parameters.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The model data URL uses HTTP instead of HTTPS

Using HTTP instead of HTTPS for the model data URL exposes the data in transit to potential interception or tampering. CloudTrail logs record the URL as provided, and if it uses HTTP, the data transferred from that URL to SageMaker is unencrypted, violating security best practices for data in transit. This is a direct security concern that should be investigated and remediated by using HTTPS.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The model name is not encrypted in the log
Why it's wrong here
CloudTrail logs are encrypted; model names are not sensitive.
✓
The model data URL uses HTTP instead of HTTPS
Why this is correct
HTTPS should be used to encrypt data in transit; using HTTP is a security risk.
✗
The source IP address is an external IP
Why it's wrong here
External IPs are normal; the concern is the lack of HTTPS.
✗
The execution role ARN is visible in the log
Why it's wrong here
Role ARNs are not secrets; they are identifiers.

Go deeper

AIF-C01 Practice Question: An administrator reviews a CloudTrail log entry…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question