Security, Compliance, and Governance for AI Solutions practice questions

Modify the trust policy of the IAM role

Why wrong: Trust policies are used for cross-account access, not for restricting API calls to a specific role within the same account.

Place the notebook instance in a private VPC subnet

Why wrong: Placing the notebook in a private VPC subnet controls network access but does not restrict which IAM role can invoke the API.

Use a resource-based policy on the notebook instance

Why wrong: Incorrect. Amazon SageMaker notebook instances do not support resource-based policies.

Use AWS Lake Formation to share the notebook

Why wrong: Use AWS Lake Formation to share the notebook — Lake Formation is for data lake permissions and not designed for sharing SageMaker notebooks directly. Incorrect.

Attach a resource-based policy to the notebook instance that grants the colleague's IAM role permissions to open and run, and deny delete

Why wrong: Attach a resource-based policy to the notebook instance — SageMaker notebook instances do not support resource-based policies. Incorrect.

Create an IAM role in the colleague's account with permissions to create and manage SageMaker notebooks

Why wrong: Create an IAM role in the colleague's account with permissions to create and manage SageMaker notebooks — This would allow creation/deletion, not limited to opening and running. Incorrect.

Topic restriction to limit topics

Why wrong: Topic restriction limits the model to certain conversation topics but does not directly remove sensitive information from responses.

Word filter to block specific words

Why wrong: Word filter blocks specific predefined words, but it is not comprehensive enough to reliably prevent all sensitive data from appearing.

Grounding check to verify responses are grounded in source documents

Why wrong: Grounding check verifies that responses are grounded in source documents but does not filter out sensitive information.

Content policy to filter out harmful content

Why wrong: Content policy filters outputs based on harmful content categories such as hate speech or violence, not for sensitive data like PII. It does not address the requirement to prevent sensitive information in responses.

AWS Secrets Manager

Why wrong: Secrets Manager stores secrets like database credentials, not encryption keys for data at rest.

AWS CloudHSM

Why wrong: CloudHSM provides hardware security modules but is not the standard service for SageMaker encryption; KMS is the primary key management service.

AWS Certificate Manager

Why wrong: ACM manages SSL/TLS certificates, not encryption keys for data at rest.

Use AWS Lake Formation to grant cross-account access to the bucket

Why wrong: Lake Formation governs data lakes in the same account or via Resource Access Manager, but direct S3 bucket access for Bedrock is not managed by Lake Formation.

Copy the S3 bucket to the same account as Bedrock

Why wrong: Copying data is inefficient and may violate data residency requirements; cross-account access can be secured with policies.

Make the S3 bucket public and use a pre-signed URL

Why wrong: Making the bucket public violates security best practices; pre-signed URLs are for temporary access, not for ongoing model access.

Content filters

Why wrong: Content filters block categories like hate, insults, or violence, not specific topics.

Grounding check

Why wrong: Grounding check verifies model responses against a source, but does not block topics.

Word filters

Why wrong: Word filters block specific words or phrases, but are not designed to block entire topics.

Amazon S3 server access logs

Why wrong: S3 server access logs capture requests to S3 buckets, not Bedrock API calls.

Amazon CloudWatch Logs

Why wrong: CloudWatch Logs can store application logs but does not natively capture AWS API calls.

AWS Config

Why wrong: AWS Config tracks resource configuration changes, not API calls.

Amazon Inspector

Why wrong: Inspector assesses network and application vulnerabilities, not sensitive data.

AWS Shield

Why wrong: Shield protects against DDoS attacks.

Amazon GuardDuty

Why wrong: GuardDuty is a threat detection service, not for data classification.

SageMaker Pipelines

Why wrong: Pipelines orchestrate ML workflows but are not specifically for scheduled bias monitoring.

SageMaker Experiments

Why wrong: Experiments track training runs, not scheduled monitoring.

SageMaker Data Wrangler

Why wrong: Data Wrangler is for data preparation, not scheduled bias detection.

Cell-level security

Why wrong: Lake Formation does not support cell-level security natively.

Column-level security

Why wrong: Column-level security restricts access to columns, not rows.

Tag-based access control

Why wrong: Tag-based access controls access at resource level, not row level.

Topic restrictions

Why wrong: Topic restrictions prevent certain topics but do not ground responses.

Word filters

Why wrong: Word filters block specific terms, not grounding.

Content filters

Why wrong: Content filters block harmful content but do not ensure factual accuracy.

Enable multi-factor authentication for the notebook

Why wrong: MFA adds authentication security but does not restrict network access.

Use an IAM policy to allow only corporate users

Why wrong: IAM controls who can access the notebook but does not restrict network-level access.

Use a SageMaker lifecycle configuration to block external IPs

Why wrong: Lifecycle configurations run scripts at startup but cannot enforce network-level restrictions.

Create a public endpoint and restrict access using IAM policies

Why wrong: Public endpoint still uses internet; IAM does not prevent internet exposure.

Use AWS PrivateLink for the endpoint, but keep public endpoint enabled

Why wrong: PrivateLink provides private connectivity, but leaving public endpoint enabled allows internet traffic.

Deploy the endpoint in a public subnet with a security group blocking all inbound traffic

Why wrong: Public subnet implies internet gateway; security group cannot block outbound internet entirely.

Content filters

Why wrong: Content filters block harmful categories, not PII.

Topic restrictions

Why wrong: Topic restrictions block topics, not sensitive data.

Word filters

Why wrong: Word filters block specific terms but cannot detect patterns like PII.

Use Bedrock's content filters to block sensitive data

Why wrong: Content filters do not prevent data usage by the provider.

Encrypt all data with KMS before sending to Bedrock

Why wrong: Encryption protects in transit and at rest, but the provider may still use decrypted data for training.

Use a custom model hosted on SageMaker instead

Why wrong: Using a different service avoids the issue but does not address the data handling concern.

AWS CloudTrail

Why wrong: CloudTrail logs API calls but does not govern model lifecycle.

Amazon S3

Why wrong: S3 stores artifacts but does not provide lifecycle governance.

AWS CodePipeline

Why wrong: CodePipeline is for CI/CD, not model governance.

Use AWS KMS multi-Region keys to encrypt data

Why wrong: Multi-Region keys allow decryption in multiple regions, violating data residency.

Enable cross-region replication for the S3 bucket

Why wrong: Cross-region replication would copy data to another region, violating data residency.

Amazon DynamoDB

Why wrong: DynamoDB is not supported as a log destination.

AWS CloudTrail

Why wrong: CloudTrail logs API calls, not model invocations.

Amazon Kinesis Data Firehose

Why wrong: Firehose is not a direct destination for Bedrock invocation logs.

S3 bucket policy on the model artifacts

Why wrong: S3 bucket policies control access to the model artifacts stored in S3, not the Bedrock model invocation.

AWS KMS key policy for the encryption key

Why wrong: KMS key policies control who can use the encryption key, not direct model invocation.

AWS CloudTrail log delivery policy

Why wrong: CloudTrail policies control logging delivery, not model invocation permissions.

Use AWS Certificate Manager (ACM) to issue a certificate for the training job and enable network isolation

Why wrong: ACM is for SSL/TLS certificates, not for encrypting training data at rest. Network isolation alone doesn't encrypt data.

Enable SageMaker data capture and use a private VPC with an internet gateway

Why wrong: Data capture is for inference logging, not encryption; an internet gateway would expose the training job to the internet, violating the no-internet requirement.

Store training data in an encrypted S3 bucket and use a SageMaker notebook instance inside a VPC

Why wrong: Encrypting S3 data is good but does not encrypt the SageMaker storage volumes. A notebook instance is not the same as a training job configuration.