AIF-C01 Guidelines for Responsible AI Practice Question

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateEndpointConfig",
        "sagemaker:UpdateEndpoint"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "sagemaker:EnableDataCapture": "true"
        }
      }
    }
  ]
}
```

An AI team uses the IAM policy shown in the exhibit to control endpoint creation. Why does this policy support responsible AI?

⚠ Common exam trap

The AIF-C01 exam often tests the misconception that IAM policies for responsible AI focus on restricting model sources or instance types, when in fact the key mechanism is enforcing observability through data capture for ongoing monitoring.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It ensures data capture is enabled for model monitoring

The IAM policy includes a condition that enforces the `DataCaptureConfig.EnableCapture` parameter to be set to `true` when creating a SageMaker endpoint. This ensures that model monitoring data is automatically collected, which is a key practice for responsible AI as it allows continuous monitoring of model performance, bias detection, and drift analysis. Without data capture, teams cannot audit or validate model behavior in production, undermining accountability and transparency.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
It requires human approval before deploying any model
Why it's wrong here
The policy governs endpoint creation permissions, not model deployment approval gates, so it cannot enforce human sign-off on models. It is tempting because approval workflows do support responsible AI, but that requires a deployment-stage control, not an IAM policy scoped to endpoint provisioning.
✗
It prevents the use of GPU instances to reduce cost
Why it's wrong here
The policy governs endpoint creation permissions, not instance selection, so GPU cost control is not its mechanism; responsible AI here concerns controlled deployment. Restricting instance types would be correct for budget governance, but cost reduction is a financial aim, not the accountability the policy demonstrates.
✓
It ensures data capture is enabled for model monitoring
Why this is correct
Enabling data capture feeds actual endpoint inputs and outputs into monitoring, satisfying the responsible AI requirement for ongoing oversight of deployed models. Without captured inference data, drift, bias and anomalous behaviour cannot be detected, so the policy enforces traceability rather than leaving monitoring optional.
✗
It restricts endpoints to only use models built in SageMaker
Why it's wrong here
Limiting endpoints to SageMaker-built models constrains provenance, not the approval or oversight the policy enforces; models from other sources can still be responsible. Such a restriction would be correct when governance demands vetted model origins, but the policy's control point is endpoint creation authorisation.

Go deeper

AIF-C01 Guidelines for Responsible AI Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question