easyMultiple ChoiceObjective-mapped
AIF-C01 Practice Question: Refer to the exhibit
Exhibit
[CloudTrail Log Entry]
{
"eventSource": "sagemaker.amazonaws.com",
"eventName": "CreateTrainingJob",
"userIdentity": {
"arn": "arn:aws:iam::123456789012:user/john.doe"
},
"requestParameters": {
"trainingJobName": "my-training-job",
"hyperParameters": {
"batch_size": "32",
"epochs": "10"
},
"inputDataConfig": [
{
"channelName": "training",
"dataSource": {
"s3DataSource": {
"s3Uri": "s3://my-bucket/train/data.csv"
}
}
}
]
},
"responseElements": null,
"sourceIPAddress": "203.0.113.5",
"userAgent": "console.amazonaws.com"
}Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a training job creation from an IP address (203.0.113.5) that is not associated with the company's network. What is the most likely cause?
⚠ Common exam trap
AWS often tests the distinction between 'external IP' and 'unauthorized access'—the trap here is assuming any external IP indicates a security breach, when in fact VPN usage is a legitimate and common cause for such logs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user john.doe is accessing the AWS Management Console from a VPN.
The IP address 203.0.113.5 is a non-routable test IP (RFC 5737) and not associated with the company's network. The most likely cause is that user john.doe is accessing the AWS Management Console through a VPN, which would route traffic through the VPN's public IP rather than the corporate network. This explains why the source IP appears external while the user identity is legitimate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The user john.doe is accessing the AWS Management Console from a VPN.
Why this is correct
A VPN would route traffic through an external IP; this is a common scenario for remote workers.
- ✗
The CloudTrail log is being generated by a cross-account role.
Why it's wrong here
The userIdentity shows a specific user arn, not a cross-account role.
- ✗
The training job was created using the AWS CLI from an external machine.
Why it's wrong here
The userAgent is 'console', not 'cli', so it was done via the console.
- ✗
The training job was created by a malicious actor who stole credentials.
Why it's wrong here
Less likely; the user is identified and could be using a VPN. More evidence needed for malicious activity.
Go deeper
Related to this question
About these practice questions
One of 619 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.