Security, Compliance, and Governance for AI Solutions

A machine learning engineer wants to detect if sensitive data, such as personally identifiable information (PII), exists in a training dataset stored in S3 before training a model. Which AWS service should they use?

A company wants to use Amazon Bedrock to generate responses grounded in their proprietary knowledge base. They need to minimize hallucinations and ensure responses are based on the provided documents. Which feature should they enable?

A company has trained a model using Amazon SageMaker and stored the model artifacts in S3 with SSE-KMS encryption. The development team wants to grant cross-account access to the model artifacts so a partner can deploy the model in their own account. Which steps are required?

A company runs a Retrieval Augmented Generation (RAG) application on Amazon Bedrock. The application uses an Amazon OpenSearch Serverless vector index to store internal HR documents. The security team must ensure that the vector index is encrypted at rest with a customer-managed AWS KMS key so that they can control key rotation and revoke access independently. Which configuration should they implement?

An organization wants to control which topics their AI chatbot can discuss. For example, they want to block all conversations about investment advice. Which Amazon Bedrock Guardrails feature should they configure?

A company uses Amazon Bedrock and wants to ensure that the model outputs are grounded in a set of provided documents to reduce hallucinations. Which TWO actions should they take? (Select TWO.)

A company uses SageMaker Clarify to detect bias in a deployed model. The monitoring must run automatically on a schedule. Which SageMaker feature should they use?

A company uses Amazon SageMaker Clarify to monitor a deployed model for bias. After running an analysis, they find that the model's predictions have a disparate impact on a protected group. What is the MOST appropriate next step?

A company uses Amazon Bedrock to build an AI assistant. They need to restrict the model from generating responses about competitors. Which Bedrock feature should they configure?

A financial services company uses Amazon SageMaker to train models with sensitive customer data. They must ensure that no data leaves a specific AWS Region due to data residency regulations. The training data is in S3. Which architecture meets this requirement while minimizing data transfer?

A data scientist needs to restrict access to a SageMaker notebook instance to only the corporate network. Which configuration should they use?

A company wants to detect sensitive data such as PII in their training datasets stored in S3 before using them for model training. Which AWS service should they use?

A healthcare startup uses Amazon Bedrock to power a patient-facing chatbot. Compliance officers are concerned that prompts or responses could contain protected health information and want an automated control that detects and blocks such content in real time before it reaches the model or the user. Which Amazon Bedrock feature should the team configure?

A retail company is preparing to launch a generative AI assistant built on Amazon Bedrock that will answer customer questions using internal product documents. The governance team wants to reduce the risk of the assistant producing fabricated, misleading, or harmful outputs before launch and during operation. (Choose two.)

A financial services company is using Amazon Bedrock to generate personalized investment advice. The compliance team requires that the model's responses do not contain any personally identifiable information (PII) such as account numbers or social security numbers, and that all PII is automatically masked. Which AWS service or feature should the company use to meet this requirement?

A company is deploying an AI model on Amazon SageMaker and needs to monitor for model drift over time. Which TWO actions should they take? (Choose TWO)

A company uses Bedrock Guardrails to filter harmful content in a generative AI application. They need to prevent the model from discussing proprietary internal projects. Which Guardrail component should be configured?

A company uses Amazon Bedrock with a third-party foundation model. They are concerned about the third-party provider accessing their data. What should they review to understand data handling practices?

A data science team is deploying a model using Amazon SageMaker. They need to monitor the model for bias after it is deployed. Which AWS service or feature should they use?

A company needs to govern the lifecycle of ML models, including versioning, monitoring for drift, and decommissioning outdated models. Which TWO services should they use? (Choose 2)

A company wants to automatically discover sensitive data such as credit card numbers in their Amazon S3 training datasets before using them for model training. Which AWS service should they use?

A data governance team wants to enforce fine-grained access control on data in an Amazon S3 data lake used by multiple business units for AI training. Which AWS service should they use to define and manage data permissions at the table and column level?

An organization uses a third-party foundation model accessed through Amazon Bedrock. The compliance team requires that all model inputs and outputs be auditable and retained for one year. Which approach should the team implement?

A company has deployed a model on Amazon SageMaker and enabled Model Monitor. They notice that the model's prediction accuracy has declined over time. Which type of drift is this, and what should they do?

A data scientist needs to train a model in Amazon SageMaker using a dataset that contains personally identifiable information (PII). The company policy requires all data at rest to be encrypted with a customer-managed key. Which configuration meets this requirement?

A company uses AWS Lake Formation to manage data lakes for analytics. They want to ensure that only authorized users can access specific columns in a table containing sensitive data used for ML training. Which Lake Formation feature should they use?

A financial services company runs a fraud-detection model on an Amazon SageMaker endpoint. Auditors require the company to prove that each prediction can be traced back to the specific model artifact, container image, and training data version used, so the company must be able to reproduce and explain any past decision. Which AWS capability should the company implement to meet this requirement?

A company is deploying an AI-powered document summarization system using Amazon Bedrock. They must ensure that the model only uses information from provided source documents and does not generate unsupported claims. Which Bedrock Guardrails feature should they enable?

A company uses Amazon Bedrock to generate content and wants to prevent the model from producing harmful or biased responses. Which AWS service should they configure to enforce content safety policies?

A company wants to use a third-party foundation model from Amazon Bedrock but is concerned about data privacy because the model provider might store prompts and responses. How should they address this concern?

A company is using Amazon Bedrock to power a customer-facing chatbot. The security team wants to ensure that the chatbot does not respond to prompts that attempt to elicit inappropriate or off-topic responses, such as discussing competitors or providing medical advice. The company also wants to monitor and log all blocked prompts for analysis. Which AWS service or feature should they use to achieve this?

A company is using Amazon SageMaker to manage the lifecycle of their machine learning models. They need to implement a governance framework that includes model versioning, monitoring for drift, and decommissioning of outdated models. Which THREE AWS services or features should they use together to meet these requirements? (Select THREE.)

A company is deploying a machine learning model on Amazon SageMaker. The compliance team requires that the model's predictions be explainable and that the company can provide documentation on how the model makes decisions. Which SageMaker feature should the company use to meet this requirement?

A company is using Amazon SageMaker to deploy a machine learning model for credit scoring. The compliance team requires that the model's predictions be explainable to customers, and that the company can demonstrate which features contributed most to a decision. Which SageMaker feature should be used to meet this requirement?

A financial services firm needs to ensure that all calls to Amazon Bedrock APIs are logged for audit purposes. Which AWS service should they enable to capture API calls?

A company is using Amazon Bedrock to power a chatbot that provides customer support. The security team wants to ensure that the chatbot does not generate responses that include profanity, hate speech, or prompts that attempt to bypass safety filters (jailbreak attempts). They also want to log any blocked interactions for review. Which AWS service or feature should be used to meet these requirements?

A healthcare startup is using Amazon SageMaker to train a model on patient data. They need to ensure that the training data does not contain any personally identifiable information (PII) before being used. Which AWS service can automatically detect and report PII in the data stored in S3?

A company using Amazon Bedrock needs to redact personally identifiable information (PII) from user inputs before sending them to the foundation model. Which Bedrock Guardrails component should be configured?

A company needs to audit all API calls made to Amazon Bedrock, including model invocations and guardrail evaluations. Which AWS service should they enable to capture these API calls for compliance?

A financial services firm uses Amazon Bedrock to generate investment summaries. They need to prevent the model from generating content containing personally identifiable information (PII) such as social security numbers. Which feature should they configure in Bedrock Guardrails?

A machine learning team wants to detect bias in a deployed model's predictions on new data. They use Amazon SageMaker. Which service should they use to generate bias reports after deployment?

A security engineer is configuring logging for Amazon Bedrock model invocations. They need to capture both the input and output of all API calls for compliance audits. Which set of steps should they take?

A company wants to log all model invocation requests in Amazon Bedrock for audit and troubleshooting. Which TWO destinations can they configure for invocation logging? (Choose 2)

A media company must give an external analytics vendor temporary, auditable access to a curated S3 dataset used for fine-tuning a model. The vendor works from its own AWS account, and the company's security policy forbids sharing long-term IAM credentials. Which approach best meets the policy while keeping access auditable?

A healthcare company is building an AI application on AWS that processes patient records. The security team must ensure that data stored in Amazon S3 is encrypted at rest using a key that the company manages and can rotate independently. Which AWS service should they use to meet these requirements?

A government agency trains models on highly sensitive data inside Amazon SageMaker. The security policy states that training data and model artifacts must never be accessible over the public internet and that traffic to AWS services must stay within the agency's Amazon VPC. Which combination should the agency implement?

A company is using Amazon Bedrock to build an AI assistant that accesses internal knowledge bases. The security team wants to ensure that the assistant only retrieves documents that the requesting user is authorized to view, based on their department. Which approach should be used to enforce this fine-grained access control?

A company uses Amazon Bedrock and needs to log all model invocations for audit purposes. The logs must be stored in a central S3 bucket and also sent to CloudWatch Logs for real-time monitoring. Which configuration should they use?

A company has deployed a machine learning model using Amazon SageMaker and wants to monitor the model for bias over time. Which SageMaker feature should they use to detect bias in the model's predictions after deployment?

A data scientist wants to restrict which IAM roles can invoke a specific Amazon Bedrock base model. Which AWS feature should they use?

A company is implementing an AI governance framework for their machine learning models deployed on Amazon SageMaker. Which THREE actions should they include to manage the model lifecycle effectively? (Select THREE.)

A company needs to ensure that model inference endpoints in SageMaker are only accessible from a private subnet in their VPC, and no traffic goes over the public internet. Which network configuration should they use?

A company uses Amazon SageMaker to train sensitive ML models. Which AWS service should they use to encrypt the training data and model artifacts at rest?

A company uses Amazon Bedrock Guardrails to filter harmful content. They want to ensure that the model does not generate responses containing specific keywords related to their internal project names. Which Guardrails component should they configure?

A company uses Amazon Macie to discover sensitive data in an S3 bucket containing training datasets. The bucket policy currently prohibits access from external accounts. Which TWO steps are necessary to allow a cross-account SageMaker training job to access this bucket while maintaining security?

A company wants to use AWS Lake Formation to govern access to data used for AI training. They need to ensure that only approved columns of sensitive tables are visible to data scientists. Which THREE steps should they implement? (Choose THREE)