Courseiva

CCNA Security, Compliance, and Governance for AI Solutions Questions

67 questions · Security, Compliance, and Governance for AI Solutions · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
Multi-Selectmedium

A machine learning team uses Amazon SageMaker to train models. They need to ensure that only approved base models from the AWS Marketplace can be used, and that training jobs cannot access the internet. Which TWO configurations should they implement?

Select 2 answers
A.Use SageMaker Role Manager to create a role that denies access to the marketplace
B.Use SageMaker Model Registry to control which models are approved and enforce use via IAM policies
C.Create a VPC endpoint for SageMaker and S3
D.Enable data encryption at rest using KMS
E.Enable network isolation for the training job and place it in a private subnet with no internet access
AnswersB, E

Model Registry with IAM policies can restrict which models can be used for training.

Why this answer

To restrict model access, use SageMaker Studio's model registry or IAM policies to limit which models can be used. To prevent internet access, configure the training job with a VPC without a NAT gateway. Data encryption does not restrict model access.

The other options are not relevant.

Practice this question →
2
MCQhard

An organization uses AWS Lake Formation to govern a data lake used for SageMaker training. They need to enforce row-level security so that different teams only see data relevant to their projects. Which Lake Formation feature should they use?

A.Cell-level security
B.Column-level security
C.Row-level security
D.Tag-based access control
AnswerC

Row-level security allows filtering rows based on conditions, enabling per-team data access.

Why this answer

Lake Formation's row-level security uses filters to restrict access to specific rows based on conditions.

Practice this question →
3
MCQhard

A data scientist is using Amazon SageMaker to train a model with data that resides in an S3 bucket owned by another AWS account. The training job fails with access denied errors. The data scientist has already been granted cross-account read access to the S3 bucket via a bucket policy. What additional configuration is required?

A.Modify the SageMaker execution role to include an s3:GetObject permission for the bucket and ensure the bucket policy grants access to that role
B.Add an AWS KMS key policy to allow cross-account decryption
C.Create a new VPC peering connection between the two accounts
D.Use AWS Lake Formation to grant cross-account permissions on the S3 data
AnswerA

The execution role must have explicit S3 read permissions, and the bucket policy must allow the role (or the account) to access the objects.

Why this answer

SageMaker training jobs run within a SageMaker execution role. The role must have a trust policy allowing SageMaker to assume it, and the role must have permissions to read from the S3 bucket. The bucket policy alone is insufficient if the execution role does not have the necessary S3 permissions.

Practice this question →
4
MCQeasy

A machine learning engineer wants to detect if sensitive data, such as personally identifiable information (PII), exists in a training dataset stored in S3 before training a model. Which AWS service should they use?

A.Amazon Inspector
B.Amazon Macie
C.Amazon GuardDuty
D.AWS Config
AnswerB

Macie automatically identifies sensitive data such as PII in S3 buckets.

Why this answer

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in S3 buckets.

Practice this question →
5
MCQmedium

A company wants to use Amazon Bedrock to generate responses grounded in their proprietary knowledge base. They need to minimize hallucinations and ensure responses are based on the provided documents. Which feature should they enable?

A.Topic restrictions
B.Word filters
C.Grounding check
D.Content filters
AnswerC

Grounding check validates model responses against a source, ensuring alignment with provided documents.

Why this answer

Grounding check in Bedrock Guardrails verifies that the model's response is supported by the source documents, reducing hallucinations.

Practice this question →
6
MCQhard

A company has trained a model using Amazon SageMaker and stored the model artifacts in S3 with SSE-KMS encryption. The development team wants to grant cross-account access to the model artifacts so a partner can deploy the model in their own account. Which steps are required?

A.Create a new IAM role in the partner account with S3 read permissions
B.Create an S3 bucket policy allowing the partner account to read the objects, and ensure the KMS key policy allows the partner account to use the key
C.Use AWS Lake Formation to share the data
D.Copy the model artifacts to a public S3 bucket
AnswerB

Both S3 bucket policy and KMS key policy must grant cross-account access.

Why this answer

To share SSE-KMS encrypted objects cross-account, you must grant the partner account access to both the S3 object (via bucket policy) and the KMS key (via key policy). The partner must also have the correct IAM permissions.

Practice this question →
7
MCQeasy

An organization wants to control which topics their AI chatbot can discuss. For example, they want to block all conversations about investment advice. Which Amazon Bedrock Guardrails feature should they configure?

A.Contextual grounding check
B.Content filtering with category-based harmful content filters
C.Sensitive information filters
D.Topic restrictions
AnswerD

Topic restrictions explicitly define which topics are allowed or denied.

Why this answer

Topic restrictions allow you to define denied topics. When the model's input or output matches a denied topic, the guardrail blocks the interaction.

Practice this question →
8
Multi-Selectmedium

A company uses Amazon Bedrock and wants to ensure that the model outputs are grounded in a set of provided documents to reduce hallucinations. Which TWO actions should they take? (Select TWO.)

Select 2 answers
A.Enable the grounding check in Bedrock Guardrails
B.Configure a word filter to block ungrounded phrases
C.Enable model invocation logging to S3
D.Use Amazon Bedrock Knowledge Bases to store and retrieve document chunks
E.Fine-tune the model on the documents
AnswersA, D

Grounding check ensures responses are anchored to source documents.

Why this answer

Bedrock Guardrails' grounding check verifies that model responses are supported by source documents. Knowledge Bases for Amazon Bedrock provide a RAG architecture to retrieve relevant document chunks.

Practice this question →
9
MCQmedium

A company uses SageMaker Clarify to detect bias in a deployed model. The monitoring must run automatically on a schedule. Which SageMaker feature should they use?

A.SageMaker Pipelines
B.SageMaker Experiments
C.SageMaker Data Wrangler
D.SageMaker Model Monitor
AnswerD

Model Monitor can schedule bias detection with Clarify and track drift.

Why this answer

SageMaker Model Monitor can be configured to run bias detection jobs on a schedule using Clarify's bias metrics.

Practice this question →
10
MCQhard

A company uses Amazon SageMaker Clarify to monitor a deployed model for bias. After running an analysis, they find that the model's predictions have a disparate impact on a protected group. What is the MOST appropriate next step?

A.Investigate the root cause of bias, then use techniques such as reweighing training data or applying bias mitigation algorithms before redeploying
B.Modify the SageMaker endpoint to add a random noise to predictions for the protected group
C.Ignore the results because SageMaker Clarify is still in preview
D.Immediately delete the model and retrain from scratch using only data from the protected group
AnswerA

Bias mitigation involves understanding the cause and applying methods like data reweighing or post-processing adjustments.

Why this answer

Discovering bias requires investigation and mitigation. SageMaker Clarify can help identify bias, but mitigation typically involves retraining with balanced data or adjusting model outputs.

Practice this question →
11
MCQhard

A financial services company uses Amazon Bedrock to generate investment advice. They have configured a guardrail to deny any harmful content. However, a user prompt 'Tell me how to commit fraud' was not blocked. What is the most likely cause?

A.The guardrail's sensitivity threshold is set too low
B.The guardrail's content policy does not include the 'Fraud' category
C.The prompt was sent to a different Bedrock model that does not support guardrails
D.The guardrail was configured with a word filter but not a content filter
AnswerB

Content policies are configurable; if 'Fraud' is not selected, the guardrail will not block prompts related to fraud.

Why this answer

Bedrock Guardrails rely on content policies that detect harmful content based on categories like fraud. If the guardrail template does not include the 'Fraud' category, such prompts may pass through. The guardrail's configuration must explicitly include the relevant harm category.

Practice this question →
12
MCQmedium

A company uses Amazon Bedrock to build an AI assistant. They need to restrict the model from generating responses about competitors. Which Bedrock feature should they configure?

A.Word filters
B.Denied topics
C.PII redaction
D.Content filters
AnswerB

Denied topics in Guardrails explicitly prevent the model from discussing prohibited subjects.

Why this answer

Bedrock Guardrails allows you to define topic restrictions that block certain topics from being discussed. Other options are for content filtering, PII redaction, or grounding.

Practice this question →
13
MCQhard

A financial services company uses Amazon SageMaker to train models with sensitive customer data. They must ensure that no data leaves a specific AWS Region due to data residency regulations. The training data is in S3. Which architecture meets this requirement while minimizing data transfer?

A.Place SageMaker training job in a private subnet with a NAT gateway and route traffic through the internet
B.Configure S3 Transfer Acceleration and use a public SageMaker training job
C.Use AWS Glue to copy data to an EBS volume attached to the training instance
D.Use S3 VPC endpoints and place SageMaker training job in a private subnet with no internet access
AnswerD

VPC endpoints keep S3 traffic within AWS network and same region; no internet access ensures residency.

Why this answer

Using a VPC with S3 VPC endpoints ensures data stays within the AWS network and does not traverse the internet. Data remains in the same Region because S3 endpoints are Regional.

Practice this question →
14
MCQeasy

A data scientist needs to restrict access to a SageMaker notebook instance to only the corporate network. Which configuration should they use?

A.Enable multi-factor authentication for the notebook
B.Use an IAM policy to allow only corporate users
C.Place the notebook instance in a VPC and configure security groups to allow only corporate IP ranges
D.Use a SageMaker lifecycle configuration to block external IPs
AnswerC

VPC placement and security groups enforce network-level restrictions.

Why this answer

VPC isolation places the notebook instance inside a VPC, and security groups can restrict inbound traffic to the corporate network IP range.

Practice this question →
15
MCQeasy

A company wants to detect sensitive data such as PII in their training datasets stored in S3 before using them for model training. Which AWS service should they use?

A.Amazon Macie
B.Amazon Inspector
C.AWS Shield
D.Amazon GuardDuty
AnswerA

Macie automatically discovers sensitive data in S3 using machine learning.

Why this answer

Amazon Macie uses machine learning to discover and protect sensitive data in S3, including PII.

Practice this question →
16
Multi-Selecteasy

A company wants to use Amazon Bedrock to build an application that summarizes customer support tickets. They are concerned about data privacy and want to ensure that customer data is not used by the third-party model provider for training or improvement. Which TWO actions should they take?

Select 2 answers
A.Store all data in an encrypted S3 bucket
B.Disable model improvement data sharing in Bedrock settings
C.Use a third-party model not listed in Bedrock
D.Use a different foundation model that has a data processing agreement (DPA) in place
E.Enable VPC endpoints for Bedrock
AnswersB, D

This prevents AWS from using your data to improve the model.

Why this answer

AWS does not share data with model providers for training unless you opt in. To be safe, disable model improvement and use a data processing agreement if needed. Using a different model or VPC endpoints does not directly address data usage for training.

Practice this question →
17
Multi-Selectmedium

A company is deploying an AI model on Amazon SageMaker and needs to monitor for model drift over time. Which TWO actions should they take? (Choose TWO)

Select 2 answers
A.Use AWS CloudTrail to log all inference requests and responses
B.Enable data capture on the SageMaker endpoint to store real-time inference data in S3
C.Store model artifacts in Amazon ECR and tag each version
D.Set up Amazon CloudWatch anomaly detection on the endpoint invocation count
E.Configure SageMaker Model Monitor to schedule monitoring jobs that compare new data against a baseline
AnswersB, E

Data capture is required to collect the data that Model Monitor will analyze for drift.

Why this answer

SageMaker Model Monitor can detect drift in model quality, data quality, and bias. Capturing inference data is a prerequisite for monitoring. The other options are either unrelated or not directly for drift detection.

Practice this question →
18
MCQhard

A company uses Bedrock Guardrails to filter harmful content in a generative AI application. They need to prevent the model from discussing proprietary internal projects. Which Guardrail component should be configured?

A.Topic restrictions
B.Content filters
C.Grounding check
D.Word filters
AnswerA

Topic restrictions allow creating a list of denied topics; the model avoids discussing them.

Why this answer

Topic restrictions allow administrators to define denied topics; the model will not generate responses related to those topics.

Practice this question →
19
MCQmedium

A company uses Amazon Bedrock with a third-party foundation model. They are concerned about the third-party provider accessing their data. What should they review to understand data handling practices?

A.AWS Artifact reports for SOC and PCI compliance
B.AWS CloudTrail logs for model invocation
C.The third-party model provider's data privacy and handling documentation within AWS Bedrock's service description
D.Amazon SageMaker Model Registry metadata
AnswerC

AWS provides documentation on how each provider handles data, including whether data is used for model improvement.

Why this answer

AWS Bedrock's documentation includes data handling and privacy information for each third-party provider. The service agreement and data privacy page explain that AWS does not use customer data to improve models, and what third parties may do.

Practice this question →
20
MCQmedium

A data science team is deploying a model using Amazon SageMaker. They need to monitor the model for bias after it is deployed. Which AWS service or feature should they use?

A.Amazon Bedrock Guardrails
B.Amazon SageMaker Clarify
C.Amazon SageMaker Model Monitor
D.AWS CloudTrail
AnswerB

Clarify detects bias in predictions and provides feature importance for deployed models.

Why this answer

Amazon SageMaker Clarify provides bias detection and explainability for ML models, both during training (pre-deployment) and inference (post-deployment).

Practice this question →
21
MCQmedium

A healthcare company uses Amazon SageMaker to train a model on patient data. To meet HIPAA compliance, they must ensure training data is encrypted at rest and in transit. Additionally, the training job should not have internet access. Which combination of actions should the company take?

A.Use AWS Certificate Manager (ACM) to issue a certificate for the training job and enable network isolation
B.Enable SageMaker data capture and use a private VPC with an internet gateway
C.Specify a KMS key for SageMaker's VolumeKmsKeyId and configure the training job to run in a VPC without a public internet route
D.Store training data in an encrypted S3 bucket and use a SageMaker notebook instance inside a VPC
AnswerC

KMS encrypts the EBS volumes at rest; VPC without internet route ensures no internet access.

Why this answer

Using KMS encryption keys and configuring the training job to run in a VPC without a public internet route satisfies both encryption and network isolation requirements.

Practice this question →
22
MCQhard

A company uses Amazon Bedrock with a custom model that was trained on data subject to GDPR. The company needs to ensure that inference logs containing user prompts and model responses are stored in a specific AWS Region for data residency compliance. How should they configure Bedrock model invocation logging?

A.Configure a Bedrock Guardrail to log all invocations to a CloudWatch Logs group in the required region
B.Enable model invocation logging and select an S3 bucket in the required region
C.Use AWS CloudTrail to log all API calls and store them in the required region
D.Use AWS Global Accelerator to route traffic to the required region
AnswerB

This directs logs to a bucket in the desired region, satisfying data residency.

Why this answer

Bedrock model invocation logging allows you to specify the S3 bucket and CloudWatch Logs group where logs are stored. By choosing an S3 bucket in the desired region and enabling CloudWatch Logs in that region, you can meet data residency requirements.

Practice this question →
23
Multi-Selecteasy

A company wants to encrypt training data stored in Amazon S3 and model artifacts in Amazon SageMaker using customer-managed keys. Which TWO AWS services or features should they use? (Select TWO.)

Select 2 answers
A.Amazon Macie
B.AWS Certificate Manager (ACM)
C.AWS Key Management Service (KMS)
D.Amazon S3 server-side encryption with KMS
E.AWS CloudHSM
AnswersC, D

KMS creates and manages encryption keys that can be used by both S3 and SageMaker.

Why this answer

AWS KMS allows creation of customer-managed keys. SageMaker can be configured to use a KMS key to encrypt model artifacts and the ML storage volume. S3 also integrates with KMS for server-side encryption.

Practice this question →
24
Multi-Selectmedium

A company needs to govern the lifecycle of ML models, including versioning, monitoring for drift, and decommissioning outdated models. Which TWO services should they use? (Choose 2)

Select 2 answers
A.AWS CloudTrail
B.Amazon SageMaker Model Registry
C.Amazon SageMaker Model Monitor
D.Amazon S3
E.AWS CodePipeline
AnswersB, C

Model Registry manages model versions, approvals, and lifecycle stages.

Why this answer

SageMaker Model Registry handles versioning and model approval; SageMaker Model Monitor tracks drift and performance.

Practice this question →
25
MCQeasy

A company wants to automatically discover sensitive data such as credit card numbers in their Amazon S3 training datasets before using them for model training. Which AWS service should they use?

A.Amazon Macie
B.AWS Config
C.Amazon GuardDuty
D.AWS Audit Manager
AnswerA

Macie uses ML and pattern matching to identify sensitive data like PII, financial numbers, etc., in S3.

Why this answer

Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data in S3.

Practice this question →
26
MCQeasy

A company uses Amazon Bedrock to access foundation models. The security team wants to ensure that only specific IAM roles can invoke a particular model. Which configuration should they use?

A.Attach an S3 bucket policy to the model artifacts
B.Configure a VPC endpoint for Bedrock
C.Use AWS Organizations service control policies to deny all model access
D.Create a Bedrock resource policy that grants InvokeModel to the required roles
AnswerD

Bedrock resource policies are attached to models and specify which principals can invoke them.

Why this answer

Amazon Bedrock uses resource-based policies attached to the model to control access. IAM policies alone are insufficient because the model resource itself must grant access to specific principals.

Practice this question →
27
MCQmedium

A data scientist needs to allow a foundation model in Amazon Bedrock to access a specific S3 bucket containing reference documents. The bucket is in a different AWS account. What is the MOST secure way to grant access?

A.Use AWS Lake Formation to grant cross-account access to the bucket
B.Copy the S3 bucket to the same account as Bedrock
C.Configure the S3 bucket policy to allow access from the Bedrock service role and add a Bedrock resource policy allowing the bucket
D.Make the S3 bucket public and use a pre-signed URL
AnswerC

This two-way policy approach ensures only the specified Bedrock role can access the bucket, following cross-account security best practices.

Why this answer

Cross-account access requires both the S3 bucket policy to grant the Bedrock service role and the Bedrock resource policy to allow the bucket, ensuring least privilege.

Practice this question →
28
Multi-Selectmedium

A company uses AWS Lake Formation to govern data used for AI/ML. They have a data lake containing customer transaction data. A data scientist needs to access the data for training a model in SageMaker. Which TWO steps are required to grant access while maintaining governance?

Select 2 answers
A.Disable Lake Formation and use S3 bucket policies only
B.Register the SageMaker execution role as a Lake Formation principal and grant it the necessary permissions
C.Grant the data scientist's IAM role SELECT permission on the relevant database and tables in Lake Formation
D.Modify the S3 bucket policy to allow public access
E.Create an IAM policy that allows the SageMaker execution role to access all S3 buckets
AnswersB, C

The SageMaker role must be authorized in Lake Formation to access the data.

Why this answer

Lake Formation requires that the data scientist's IAM role be granted SELECT permission on the database/table. Additionally, the SageMaker execution role needs access to the data, and Lake Formation integration requires the role to have Lake Formation permissions. Just granting IAM permissions without Lake Formation or vice versa will not work.

Practice this question →
29
MCQmedium

A data governance team wants to enforce fine-grained access control on data in an Amazon S3 data lake used by multiple business units for AI training. Which AWS service should they use to define and manage data permissions at the table and column level?

A.AWS Identity and Access Management (IAM)
B.AWS Lake Formation
C.AWS CloudTrail
D.Amazon Macie
AnswerB

Lake Formation provides column-level and row-level security for data in S3 data lakes.

Why this answer

AWS Lake Formation provides fine-grained access control for data lakes, allowing you to set permissions on tables and columns across AWS analytics and ML services.

Practice this question →
30
MCQhard

An organization uses a third-party foundation model accessed through Amazon Bedrock. The compliance team requires that all model inputs and outputs be auditable and retained for one year. Which approach should the team implement?

A.Store all prompts and responses in a DynamoDB table via custom code in the application
B.Use VPC Flow Logs to capture network traffic to Bedrock
C.Enable Bedrock model invocation logging and configure destination to S3 with a lifecycle policy to retain logs for one year
D.Enable CloudTrail data events for Bedrock
AnswerC

This logs the inputs and outputs and retains them for the required period.

Why this answer

Bedrock model invocation logging captures all requests and responses and can be sent to CloudWatch Logs or S3 for retention. CloudTrail logs only API-level events (e.g., InvokeModel calls) but not the actual payloads. The other options do not provide payload logging.

Practice this question →
31
MCQhard

A company has deployed a model on Amazon SageMaker and enabled Model Monitor. They notice that the model's prediction accuracy has declined over time. Which type of drift is this, and what should they do?

A.This is bias drift; they should run SageMaker Clarify
B.This is concept drift; they should retrain the model with new data
C.This is model drift; they should delete and redeploy the model
D.This is data drift; they should update the training data
AnswerB

Concept drift occurs when the relationship between input and output changes, leading to accuracy decline. Retraining addresses it.

Why this answer

Model drift refers to the degradation of model performance over time due to changes in data or relationships. SageMaker Model Monitor can detect data drift, but model drift (accuracy decline) requires retraining or updating the model.

Practice this question →
32
MCQeasy

A data scientist needs to train a model in Amazon SageMaker using a dataset that contains personally identifiable information (PII). The company policy requires all data at rest to be encrypted with a customer-managed key. Which configuration meets this requirement?

A.Enable default encryption for the S3 bucket using AWS-managed S3 keys (SSE-S3)
B.Specify a KMS customer-managed key when creating the SageMaker training job and enable data encryption for the S3 bucket with the same key
C.Encrypt the data before uploading to S3 using a client-side library
D.Use SageMaker's local mode and store data on the instance's ephemeral storage
AnswerB

This encrypts both the training data and the model artifacts with a customer-managed key.

Why this answer

Using a KMS customer-managed key (CMK) for SageMaker's EBS volumes and S3 buckets ensures encryption at rest with a key the customer controls. The other options either use AWS-managed keys, skip encryption, or are not applicable to SageMaker training jobs.

Practice this question →
33
MCQeasy

A company uses AWS Lake Formation to manage data lakes for analytics. They want to ensure that only authorized users can access specific columns in a table containing sensitive data used for ML training. Which Lake Formation feature should they use?

A.Row-level security filters
B.Cell-level security
C.S3 bucket policies
D.Column-level permissions
AnswerD

Lake Formation supports granting permissions on specific columns.

Why this answer

Lake Formation column-level permissions allow fine-grained access control to specific columns within a table.

Practice this question →
34
MCQmedium

A company wants to use a third-party foundation model in Bedrock and is concerned about the provider's data handling policies. Which action should they take to ensure their data is not used for model training by the provider?

A.Use Bedrock's content filters to block sensitive data
B.Encrypt all data with KMS before sending to Bedrock
C.Use a custom model hosted on SageMaker instead
D.Review the provider's data privacy policy and enable the opt-out option for training data use if available
AnswerD

Reviewing the policy and opting out ensures data is not used for training.

Why this answer

AWS provides model access approval settings where customers can review and accept data handling policies; many providers offer opt-out options for training data use.

Practice this question →
35
MCQmedium

A company is deploying an AI-powered document summarization system using Amazon Bedrock. They must ensure that the model only uses information from provided source documents and does not generate unsupported claims. Which Bedrock Guardrails feature should they enable?

A.Content filtering with category-based harmful content filters
B.Contextual grounding check
C.Word filters
D.Topic restrictions
AnswerB

Grounding checks validate that the model's output is based on the provided source documents.

Why this answer

Contextual grounding checks ensure that model responses are factually supported by the reference sources, reducing hallucinations.

Practice this question →
36
MCQmedium

A data scientist is training a model using Amazon SageMaker and needs to ensure the training data is encrypted at rest and in transit. The data is stored in S3. Which combination of steps meets this requirement?

A.Use an S3 bucket with SSE-KMS encryption and configure the SageMaker training job to use a VPC with no internet access
B.Enable S3 Transfer Acceleration and use a public SageMaker training job
C.Use client-side encryption before uploading to S3 and disable SageMaker internet access
D.Enable default S3 bucket encryption and use a SageMaker notebook instance in a private subnet
AnswerA

SSE-KMS encrypts data at rest; VPC with no internet ensures data in transit stays within AWS network, and SageMaker uses HTTPS for encryption.

Why this answer

S3 server-side encryption (SSE-S3 or KMS) protects data at rest. SageMaker uses HTTPS for data in transit between S3 and the training instance, and VPC configuration can enforce network isolation.

Practice this question →
37
MCQmedium

A company uses Amazon Bedrock to generate content and wants to prevent the model from producing harmful or biased responses. Which AWS service should they configure to enforce content safety policies?

A.Amazon Comprehend for toxicity detection
B.Amazon SageMaker Clarify
C.AWS WAF to filter model responses
D.Amazon Bedrock Guardrails
AnswerD

Bedrock Guardrails allows you to define policies to filter harmful content, redact PII, restrict topics, and more.

Why this answer

Amazon Bedrock Guardrails provides content filtering, PII redaction, topic restrictions, and other safety controls. It is purpose-built for content safety in Bedrock.

Practice this question →
38
Multi-Selecthard

An organization is implementing governance for machine learning models using SageMaker. They need to track model versions, monitor for drift after deployment, and automatically decommission models that have been deprecated for over 30 days. Which THREE services or features should they use?

Select 3 answers
A.Amazon SageMaker Ground Truth
B.Amazon SageMaker Clarify
C.Amazon SageMaker Model Registry
D.Amazon SageMaker Projects (MLOps templates)
E.Amazon SageMaker Model Monitor
AnswersC, D, E

Model Registry manages model versions and lifecycle stages.

Why this answer

SageMaker Model Registry tracks versions, Model Monitor detects drift, and SageMaker Projects with MLOps can automate decommissioning. Clarify is for bias, not lifecycle management. Ground Truth is for labeling.

Practice this question →
39
MCQmedium

A company wants to use a third-party foundation model from Amazon Bedrock but is concerned about data privacy because the model provider might store prompts and responses. How should they address this concern?

A.Enable Amazon Bedrock model invocation logging to capture all interactions
B.Review the third-party model provider's data handling policy and choose a model that does not retain data
C.Use Amazon Macie to scan prompts before they are sent
D.Use AWS KMS to encrypt the prompts and responses before sending to the model
AnswerB

The provider's policy governs data retention; choosing a compliant model is the best approach.

Why this answer

Each third-party model provider in Bedrock has its own data handling policies. Customers should review those policies and can choose models that do not store data or use Bedrock features like Guardrails to redact sensitive data. However, the direct action is to review the provider's policy and select a model that meets privacy requirements.

Practice this question →
40
Multi-Selecteasy

A data scientist needs to use Amazon SageMaker to train a model and must ensure that the training data and the model artifacts are encrypted using customer-managed KMS keys. Which TWO resources can be encrypted with KMS keys in this scenario? (Select TWO.)

Select 2 answers
A.SageMaker ML storage volume (attached to training instances)
B.SageMaker notebook instances
C.Amazon SageMaker Model Registry
D.Amazon CloudWatch Logs
E.S3 buckets storing training data
AnswersA, E

SageMaker encrypts the local storage volume using a KMS key.

Why this answer

SageMaker can use KMS keys to encrypt the ML storage volume (attached to training instances) and S3 buckets storing training data. Model artifacts in S3 can also be encrypted with KMS.

Practice this question →
41
Multi-Selecthard

A financial services company is deploying a large language model (LLM) on Amazon Bedrock for customer-facing applications. The compliance team mandates that the model must not generate any content containing personally identifiable information (PII). Additionally, the company wants to ensure that the model only answers questions related to its product documentation and refuses off-topic queries. Which THREE Bedrock Guardrails configurations should be applied?

Select 3 answers
A.Denied topics
B.PII redaction
C.Word filters
D.Grounding check
E.Content filters
AnswersA, B, E

Define topics the model should not discuss, such as off-topic queries.

Why this answer

To prevent PII leakage, enable PII redaction. To restrict to product documentation, use topic restrictions (denied topics for off-topic). To prevent harmful content, use content filters.

Word filters are for specific words, and grounding check is for hallucination prevention but not directly for topic restriction.

Practice this question →
42
MCQhard

An organization uses AWS Lake Formation to govern access to data used for machine learning in Amazon SageMaker. They want to ensure that a particular IAM role used by SageMaker can only query a subset of columns in a table containing sensitive customer data. Which Lake Formation permission should be granted to the role?

A.Grant DESCRIBE on the table
B.Grant INSERT on the table
C.Create a view with only the allowed columns and grant SELECT on the view
D.Grant SELECT on the table with column-level filter
AnswerD

Lake Formation allows granting SELECT on specific columns, achieving column-level access control.

Why this answer

Lake Formation supports column-level permissions via Data Permissions. You can grant SELECT permission on specific columns of a table to an IAM role, restricting access to only those columns.

Practice this question →
43
MCQmedium

A company is deploying a real-time inference endpoint using Amazon SageMaker. The security team requires that all data sent to the endpoint be encrypted in transit and that the endpoint is only accessible from within the company's VPC. Which configuration should be used?

A.Deploy the endpoint in a private subnet with a VPC endpoint for SageMaker Runtime
B.Deploy the endpoint in a public subnet and use a security group to restrict source IPs
C.Enable network isolation on the endpoint
D.Use an AWS Lambda function to proxy requests and restrict access via IAM
AnswerA

This makes the endpoint accessible only via the VPC endpoint, ensuring no public internet access, and HTTPS is used automatically.

Why this answer

SageMaker endpoints can be deployed in a VPC and configured to use a private VPC endpoint (AWS PrivateLink) so that they are accessible only from within the VPC. HTTPS ensures encryption in transit; SageMaker endpoints automatically use HTTPS.

Practice this question →
44
Multi-Selecthard

A company is using Amazon SageMaker to manage the lifecycle of their machine learning models. They need to implement a governance framework that includes model versioning, monitoring for drift, and decommissioning of outdated models. Which THREE AWS services or features should they use together to meet these requirements? (Select THREE.)

Select 3 answers
A.AWS CloudTrail
B.SageMaker Pipelines
C.SageMaker Model Registry
D.SageMaker Role Manager
E.SageMaker Model Monitor
AnswersB, C, E

Pipelines can automate the decommissioning of outdated models by triggering endpoints to update or delete.

Why this answer

SageMaker Model Registry handles versioning, SageMaker Model Monitor detects drift, and SageMaker Pipelines can orchestrate decommissioning workflows. Together they cover the governance lifecycle.

Practice this question →
45
MCQmedium

A company is using Amazon Bedrock to generate text summaries of customer emails. The compliance team requires that any email containing a Social Security Number (SSN) must be blocked from being sent to the model for summarization. Which Bedrock Guardrail configuration should be used?

A.Configure a topic restriction to block 'PII' topics
B.Enable model invocation logging and manually review all inputs
C.Add a word filter with a list of common SSN patterns
D.Use a content policy with a PII filter set to 'Deny' for SSN
AnswerD

Bedrock Guardrails include managed PII filters that can deny input containing specific PII types like SSNs.

Why this answer

Bedrock Guardrails can be configured to filter content before it is sent to the model. PII redaction with a deny action will block the input if SSNs are detected. The guardrail is applied at invocation time.

Practice this question →
46
MCQmedium

A financial services firm needs to ensure that all calls to Amazon Bedrock APIs are logged for audit purposes. Which AWS service should they enable to capture API calls?

A.AWS CloudTrail
B.Amazon S3 server access logs
C.Amazon CloudWatch Logs
D.AWS Config
AnswerA

CloudTrail records all AWS API calls, including Bedrock, for auditing and compliance.

Why this answer

AWS CloudTrail records API activity in AWS accounts, including Bedrock API calls, providing audit logs.

Practice this question →
47
MCQmedium

A healthcare startup is using Amazon SageMaker to train a model on patient data. They need to ensure that the training data does not contain any personally identifiable information (PII) before being used. Which AWS service can automatically detect and report PII in the data stored in S3?

A.Amazon Rekognition
B.AWS Glue DataBrew
C.Amazon Comprehend Medical
D.Amazon Macie
AnswerD

Macie is the correct service for automated discovery of sensitive data in S3.

Why this answer

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in S3. It can detect PII such as names, addresses, and health information.

Practice this question →
48
MCQhard

A company using Amazon Bedrock needs to redact personally identifiable information (PII) from user inputs before sending them to the foundation model. Which Bedrock Guardrails component should be configured?

A.Content filters
B.Topic restrictions
C.Word filters
D.Sensitive information filters
AnswerD

Sensitive information filters (PII redaction) detect and redact PII.

Why this answer

PII redaction in Guardrails automatically detects and redacts PII in user inputs or model responses.

Practice this question →
49
MCQeasy

A company needs to audit all API calls made to Amazon Bedrock, including model invocations and guardrail evaluations. Which AWS service should they enable to capture these API calls for compliance?

A.AWS CloudTrail
B.Amazon Macie
C.AWS Config
D.Amazon GuardDuty
AnswerA

CloudTrail logs all AWS API calls for auditing.

Why this answer

AWS CloudTrail records API calls for all AWS services, including Bedrock. It captures the caller identity, API, parameters, and response elements, which can be used for auditing and compliance.

Practice this question →
50
MCQmedium

A financial services firm uses Amazon Bedrock to generate investment summaries. They need to prevent the model from generating content containing personally identifiable information (PII) such as social security numbers. Which feature should they configure in Bedrock Guardrails?

A.Contextual grounding checks
B.Content filtering with category-based harmful content filters
C.Sensitive information filters with PII redaction
D.Word filters with a custom list of terms
AnswerC

Sensitive information filters in Guardrails include PII detection and redaction, which can block or mask PII.

Why this answer

Bedrock Guardrails include a PII redaction filter that can detect and block or mask PII in model inputs and outputs.

Practice this question →
51
MCQmedium

A machine learning team wants to detect bias in a deployed model's predictions on new data. They use Amazon SageMaker. Which service should they use to generate bias reports after deployment?

A.Amazon SageMaker Clarify
B.Amazon SageMaker Debugger
C.Amazon SageMaker Model Monitor
D.Amazon SageMaker Role Manager
AnswerA

Clarify can run bias metrics on predictions after deployment.

Why this answer

Amazon SageMaker Clarify provides bias detection and explainability for ML models, both during training and after deployment. SageMaker Model Monitor detects data drift but not bias. SageMaker Debugger is for training debugging.

SageMaker Role Manager is for managing IAM roles.

Practice this question →
52
MCQhard

A security engineer is configuring logging for Amazon Bedrock model invocations. They need to capture both the input and output of all API calls for compliance audits. Which set of steps should they take?

A.Enable Bedrock model invocation logging and specify an S3 bucket and optionally CloudWatch Logs as the destination
B.Enable CloudTrail for the Bedrock API and configure S3 event notifications
C.Use VPC Flow Logs to capture network traffic and reconstruct model inputs from packet data
D.Enable AWS Config rules for Bedrock and stream logs to Amazon Kinesis
AnswerA

Model invocation logging captures the content of requests and responses and stores them in S3 or CloudWatch.

Why this answer

Bedrock model invocation logging captures inputs and outputs to S3 and/or CloudWatch Logs. CloudTrail records API calls but not the model inputs/outputs.

Practice this question →
53
Multi-Selecthard

A company wants to enforce strict data residency for training data used in SageMaker. The data must never leave a specific AWS Region. Which THREE actions should they take? (Choose 3)

Select 3 answers
A.Use KMS customer managed keys specific to the region
B.Use AWS KMS multi-Region keys to encrypt data
C.Use S3 bucket policies to deny access if the request originates from outside the region
D.Enable cross-region replication for the S3 bucket
E.Create a VPC in the desired region and place all SageMaker resources in that VPC
AnswersA, C, E

Regional KMS keys ensure data can only be decrypted in that region.

Why this answer

To enforce data residency, the company must use a VPC in the desired region, configure S3 bucket policies to block cross-region access, and use KMS keys regional to that region.

Practice this question →
54
Multi-Selecteasy

A company wants to log all model invocation requests in Amazon Bedrock for audit and troubleshooting. Which TWO destinations can they configure for invocation logging? (Choose 2)

Select 2 answers
A.Amazon CloudWatch Logs
B.Amazon S3
C.Amazon DynamoDB
D.AWS CloudTrail
E.Amazon Kinesis Data Firehose
AnswersA, B

Invocation logs can be sent to CloudWatch Logs.

Why this answer

Bedrock invocation logging supports S3 and CloudWatch Logs as destinations.

Practice this question →
55
MCQeasy

A data scientist wants to use a third-party foundation model from Amazon Bedrock for a generative AI application. The compliance officer needs to understand how the third-party model provider handles data privacy. Where can the data scientist find this information?

A.Contact the model provider directly via email
B.In the Amazon Bedrock service documentation for the specific model provider
C.Use Amazon Macie to analyze the model provider's privacy policy
D.In the AWS Artifact reports
AnswerB

Bedrock documentation includes data privacy information for each model provider, as required by AWS.

Why this answer

AWS provides a service-specific data privacy page for each Bedrock model provider, detailing data handling, retention, and privacy practices. This is part of the Bedrock documentation.

Practice this question →
56
MCQmedium

A machine learning team is training a model using Amazon SageMaker with data stored in an S3 bucket. The security policy requires that all data be encrypted at rest and in transit, and that the training job cannot access the internet. Which combination of settings should the team use?

A.Enable Network Isolation and use an S3 VPC Endpoint
B.Disable Network Isolation, place the training job in a private VPC subnet, and use an S3 VPC Endpoint
C.Enable Network Isolation and use a VPC with a NAT gateway
D.Disable Network Isolation and use a public VPC subnet
AnswerB

This allows the job to access S3 via the VPC endpoint without internet access, meeting the no-internet requirement.

Why this answer

SageMaker training jobs can be run in a VPC without internet access by disabling 'Enable Network Isolation' (which actually blocks all network access) and using a VPC with no NAT gateway or internet gateway. KMS encryption for both S3 and the attached ML storage volume ensures encryption at rest.

Practice this question →
57
MCQmedium

A company uses Amazon Bedrock and needs to log all model invocations for audit purposes. The logs must be stored in a central S3 bucket and also sent to CloudWatch Logs for real-time monitoring. Which configuration should they use?

A.Enable Amazon Macie to monitor Bedrock responses
B.Enable AWS CloudTrail to capture Bedrock API calls and configure CloudTrail logs to S3 and CloudWatch
C.Use AWS Lambda to capture responses and write to S3 and CloudWatch
D.Configure Amazon Bedrock model invocation logging to send logs to both S3 and CloudWatch Logs
AnswerD

Bedrock supports logging model invocations to S3 and CloudWatch for audit and monitoring.

Why this answer

Bedrock model invocation logging can be configured to send logs to both S3 and CloudWatch Logs simultaneously. This is a built-in feature of Bedrock logging settings.

Practice this question →
58
MCQmedium

A company has deployed a machine learning model using Amazon SageMaker and wants to monitor the model for bias over time. Which SageMaker feature should they use to detect bias in the model's predictions after deployment?

A.SageMaker Debugger
B.SageMaker Model Monitor
C.SageMaker Clarify
D.SageMaker Role Manager
AnswerC

Clarify provides bias detection and explainability for ML models.

Why this answer

SageMaker Clarify is designed to detect bias in ML models both before and after deployment. It can analyze predictions to identify potential bias against certain groups.

Practice this question →
59
MCQeasy

A data scientist wants to restrict which IAM roles can invoke a specific Amazon Bedrock base model. Which AWS feature should they use?

A.S3 bucket policy on the model artifacts
B.Bedrock resource-based policy
C.AWS KMS key policy for the encryption key
D.AWS CloudTrail log delivery policy
AnswerB

Bedrock resource policies are applied to the model resource itself and can restrict invocation to specific IAM roles.

Why this answer

Bedrock resource policies allow you to attach fine-grained permissions to a specific model, specifying which principals (IAM roles) can invoke it.

Practice this question →
60
Multi-Selecthard

A company is implementing an AI governance framework for their machine learning models deployed on Amazon SageMaker. Which THREE actions should they include to manage the model lifecycle effectively? (Select THREE.)

Select 3 answers
A.Enable Amazon CloudWatch alarms for model accuracy metrics
B.Automatically delete all previous model versions after deployment
C.Create a decommissioning policy that retires old models
D.Use AWS CloudTrail to track model inference requests
E.Use SageMaker Model Registry to version models
AnswersA, C, E

Monitoring for drift is essential; CloudWatch can alert on accuracy drops.

Why this answer

Model versioning tracks changes, monitoring for drift ensures performance, and a decommissioning process retires outdated models. These are key lifecycle management practices.

Practice this question →
61
MCQmedium

A company needs to ensure that model inference endpoints in SageMaker are only accessible from a private subnet in their VPC, and no traffic goes over the public internet. Which network configuration should they use?

A.Create a public endpoint and restrict access using IAM policies
B.Use AWS PrivateLink for the endpoint, but keep public endpoint enabled
C.Use a VPC interface endpoint for SageMaker and disable public access
D.Deploy the endpoint in a public subnet with a security group blocking all inbound traffic
AnswerC

An interface endpoint connects SageMaker to the VPC privately, and disabling public access ensures no internet traffic.

Why this answer

A VPC-only endpoint (interface endpoint) or private endpoint without public internet access ensures traffic stays within the VPC.

Practice this question →
62
MCQeasy

A company uses Amazon SageMaker to train sensitive ML models. Which AWS service should they use to encrypt the training data and model artifacts at rest?

A.AWS Secrets Manager
B.AWS CloudHSM
C.AWS Key Management Service (KMS)
D.AWS Certificate Manager
AnswerC

KMS provides centralized control over encryption keys used to encrypt data at rest in SageMaker.

Why this answer

AWS Key Management Service (KMS) allows customers to create and manage encryption keys used to encrypt data at rest in SageMaker, including training data and model artifacts.

Practice this question →
63
MCQmedium

A company uses Amazon Bedrock Guardrails to filter harmful content. They want to ensure that the model does not generate responses containing specific keywords related to their internal project names. Which Guardrails component should they configure?

A.Harmful content filters
B.Topic restrictions
C.Word filters
D.Grounding checks
AnswerC

Word filters allow blocking specific words or phrases.

Why this answer

Word filters in Bedrock Guardrails allow you to specify custom words or phrases that should be blocked in model responses.

Practice this question →
64
Multi-Selecthard

A financial institution is using Amazon Bedrock for a customer-facing application. They must ensure compliance with data residency requirements: model inputs and outputs must not leave a specific AWS Region. Which THREE steps should they take? (Choose THREE)

Select 3 answers
A.Set up an S3 bucket for model invocation logs in a different Region for disaster recovery
B.Enable Bedrock model invocation logging to an S3 bucket and CloudWatch Logs in the same Region
C.Use AWS KMS to encrypt all data at rest with a customer managed key in the desired Region
D.Configure an AWS PrivateLink VPC endpoint for Amazon Bedrock in the desired Region
E.Use AWS Global Accelerator to route traffic to Bedrock across regions for better performance
AnswersB, C, D

Logging data must stay in the Region to meet residency requirements.

Why this answer

To ensure data residency, the Bedrock model must be accessed only via a VPC endpoint (so traffic stays within AWS network), and all storage and logging must be in the desired Region. CloudTrail and invocation logs must also be stored in that Region.

Practice this question →
65
Multi-Selectmedium

A company uses Amazon Macie to discover sensitive data in an S3 bucket containing training datasets. The bucket policy currently prohibits access from external accounts. Which TWO steps are necessary to allow a cross-account SageMaker training job to access this bucket while maintaining security?

Select 2 answers
A.Configure Macie to automatically grant access to the SageMaker execution role
B.Create a VPC endpoint for S3 and associate it with the SageMaker VPC
C.Add a bucket policy that grants the SageMaker execution role from the other account s3:GetObject and s3:ListBucket permissions
D.Attach an IAM policy to the SageMaker execution role that allows s3:GetObject and s3:ListBucket on the source bucket
E.Remove the bucket policy that prohibits external access
AnswersC, D

The bucket policy must explicitly allow the cross-account role.

Why this answer

For cross-account access, the bucket policy must grant the required permissions to the SageMaker execution role (from the other account), and the SageMaker execution role must have an IAM policy that allows it to access the S3 bucket. Macie doesn't control access. VPC endpoints are optional.

Practice this question →
66
MCQmedium

A machine learning team uses Amazon SageMaker to train and deploy models. They need to ensure that only approved base models from the AWS Marketplace are used. Which feature should they use to enforce this policy?

A.SageMaker Role Manager
B.IAM policies that allow only specific model package ARNs from the AWS Marketplace
C.AWS Config rules to detect non-compliant models
D.SageMaker Model Registry
AnswerB

By using resource-level permissions in IAM, you can restrict users to only use certain model package ARNs.

Why this answer

SageMaker Role Manager helps administrators create least-privilege IAM roles, but it does not restrict which models can be used. Model access in SageMaker is controlled via IAM policies on the CreateTrainingJob and CreateModel APIs, combined with resource-level permissions.

Practice this question →
67
Multi-Selectmedium

A company wants to use AWS Lake Formation to govern access to data used for AI training. They need to ensure that only approved columns of sensitive tables are visible to data scientists. Which THREE steps should they implement? (Choose THREE)

Select 3 answers
A.Use AWS Glue crawlers to catalog the data and populate the Data Catalog
B.Create a SageMaker notebook instance and attach an IAM role
C.Define column-level permissions in Lake Formation to grant access to specific columns for the data scientist role
D.Enable S3 versioning on the training data bucket
E.Register the S3 bucket containing the training data with Lake Formation
AnswersA, C, E

A Glue Data Catalog is required for Lake Formation to manage permissions on tables and columns.

Why this answer

Lake Formation allows you to register S3 locations, create resource links, and grant permissions at column level. The other options are not specific to Lake Formation column-level access control.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Security, Compliance, and Governance for AI Solutions questions.

Start 20-question session