Courseiva
← AIF-C01
Full test
Question 225 of 500
Security, Compliance and Governance for AI Solutions →hardMultiple ChoiceObjective-mapped

Quick Answer

The answer is that the security concern is the model data URL using HTTP instead of HTTPS. This is correct because when a CloudTrail log entry for a CreateModel API call records an HTTP-based URL for the model data, it means the data transferred from that URL to SageMaker is transmitted in plaintext, leaving it vulnerable to interception or tampering during transit. On the AWS Certified AI Practitioner AIF-C01 exam, this scenario tests your understanding of data-in-transit encryption requirements and how CloudTrail logs can reveal configuration weaknesses; a common trap is overlooking the URL scheme and focusing instead on permissions or encryption-at-rest. Remember that CloudTrail logs capture the exact URL provided, so any HTTP model data URL is a red flag for unencrypted data movement. A quick memory tip: "HTTP is not secure in transit—always check the scheme in the log."

AIF-C01 Practice Question: Security, Compliance and Governance for AI Solutions

This AIF-C01 practice question tests your understanding of security, compliance and governance for ai solutions. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Exhibit

Refer to the exhibit.
[CloudTrail Log Entry]
{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "AssumedRole",
    "arn": "arn:aws:sts::123456789012:assumed-role/SageMakerExecutionRole/i-0123456789abcdef0",
    "accountId": "123456789012",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "arn": "arn:aws:iam::123456789012:role/SageMakerExecutionRole"
      }
    }
  },
  "eventTime": "2024-03-15T10:00:00Z",
  "eventSource": "sagemaker.amazonaws.com",
  "eventName": "CreateModel",
  "resources": [
    {
      "arn": "arn:aws:sagemaker:us-east-1:123456789012:model/my-model",
      "type": "AWS::SageMaker::Model"
    }
  ],
  "requestParameters": {
    "modelName": "my-model",
    "primaryContainer": {
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-image:latest",
      "modelDataUrl": "s3://my-bucket/model.tar.gz"
    },
    "executionRoleArn": "arn:aws:iam::123456789012:role/SageMakerExecutionRole"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.42",
  "userAgent": "sagemaker.amazonaws.com"
}

An administrator reviews a CloudTrail log entry for a CreateModel API call. Which security concern should they investigate?

Question 1hardmultiple choice
Full question →

Exhibit

Refer to the exhibit.
[CloudTrail Log Entry]
{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "AssumedRole",
    "arn": "arn:aws:sts::123456789012:assumed-role/SageMakerExecutionRole/i-0123456789abcdef0",
    "accountId": "123456789012",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "arn": "arn:aws:iam::123456789012:role/SageMakerExecutionRole"
      }
    }
  },
  "eventTime": "2024-03-15T10:00:00Z",
  "eventSource": "sagemaker.amazonaws.com",
  "eventName": "CreateModel",
  "resources": [
    {
      "arn": "arn:aws:sagemaker:us-east-1:123456789012:model/my-model",
      "type": "AWS::SageMaker::Model"
    }
  ],
  "requestParameters": {
    "modelName": "my-model",
    "primaryContainer": {
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-image:latest",
      "modelDataUrl": "s3://my-bucket/model.tar.gz"
    },
    "executionRoleArn": "arn:aws:iam::123456789012:role/SageMakerExecutionRole"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.42",
  "userAgent": "sagemaker.amazonaws.com"
}

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The model data URL uses HTTP instead of HTTPS

Option B is correct because using HTTP instead of HTTPS for the model data URL exposes the data in transit to potential interception or tampering. CloudTrail logs record the URL as provided, and if it uses HTTP, the data transferred from that URL to SageMaker is unencrypted, violating security best practices for data in transit. This is a direct security concern that should be investigated and remediated by using HTTPS.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The model name is not encrypted in the log

    Why it's wrong here

    CloudTrail logs are encrypted; model names are not sensitive.

  • ✓

    The model data URL uses HTTP instead of HTTPS

    Why this is correct

    HTTPS should be used to encrypt data in transit; using HTTP is a security risk.

    Related concept

    Read the scenario before looking for a memorised answer.

  • ✗

    The source IP address is an external IP

    Why it's wrong here

    External IPs are normal; the concern is the lack of HTTPS.

  • ✗

    The execution role ARN is visible in the log

    Why it's wrong here

    Role ARNs are not secrets; they are identifiers.

Common exam traps

Common exam trap: answer the scenario, not the keyword

Cisco often tests the distinction between data in transit encryption (HTTPS vs HTTP) and data at rest encryption, leading candidates to incorrectly focus on log encryption or ARN visibility instead of the actual security risk in the API call parameters.

Detailed technical explanation

How to think about this question

When SageMaker creates a model, it downloads the model artifacts from the specified URL. If the URL uses HTTP, the data is transmitted in plaintext, making it vulnerable to man-in-the-middle attacks. CloudTrail logs the exact URL, so an administrator can audit this. In a real-world scenario, a model artifact could contain proprietary algorithms or sensitive data, and using HTTP would violate compliance requirements like PCI DSS or HIPAA, which mandate encryption in transit.

KKey Concepts to Remember

  • Read the scenario before looking for a memorised answer.
  • Find the constraint that changes the correct option.
  • Eliminate answers that are true in general but not in this case.

TExam Day Tips

  • Watch for words such as best, first, most likely and least administrative effort.
  • Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related practice questions

Related AIF-C01 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Applications of Foundation Models practice questions

Practise AIF-C01 questions linked to Applications of Foundation Models.

Fundamentals of AI and ML practice questions

Practise AIF-C01 questions linked to Fundamentals of AI and ML.

Fundamentals of Generative AI practice questions

Practise AIF-C01 questions linked to Fundamentals of Generative AI.

Guidelines for Responsible AI practice questions

Practise AIF-C01 questions linked to Guidelines for Responsible AI.

Security, Compliance and Governance for AI Solutions practice questions

Practise AIF-C01 questions linked to Security, Compliance and Governance for AI Solutions.

AIF-C01 fundamentals practice questions

Practise AIF-C01 questions linked to AIF-C01 fundamentals.

AIF-C01 scenario practice questions

Practise AIF-C01 questions linked to AIF-C01 scenario.

AIF-C01 troubleshooting practice questions

Practise AIF-C01 questions linked to AIF-C01 troubleshooting.

Practice this exam

Start a free AIF-C01 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions20 questions30 questions50 questionsTimed 30
AIF-C01 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this AIF-C01 question test?

Security, Compliance and Governance for AI Solutions — This question tests Security, Compliance and Governance for AI Solutions — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: The model data URL uses HTTP instead of HTTPS — Option B is correct because using HTTP instead of HTTPS for the model data URL exposes the data in transit to potential interception or tampering. CloudTrail logs record the URL as provided, and if it uses HTTP, the data transferred from that URL to SageMaker is unencrypted, violating security best practices for data in transit. This is a direct security concern that should be investigated and remediated by using HTTPS.

What should I do if I get this AIF-C01 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

More AIF-C01 practice questions

Browse all AIF-C01 questions →

Last reviewed: Jun 25, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.