AI0-001 AI Infrastructure and Technologies Practice Question
A security team needs to ensure that all data used for AI model training in the cloud is encrypted at rest and in transit. Which set of measures meets this requirement on AWS?
⚠ Common exam trap
AI0-001 often tests the distinction between network security controls (Security Groups, NACLs, VPN) and encryption controls; candidates mistakenly pick network options for encryption requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable S3 default encryption with SSE-S3 and use HTTPS for API calls
Encryption at rest is achieved by enabling default encryption on S3 (SSE-S3 or SSE-KMS), and encryption in transit is achieved by enforcing HTTPS/TLS for all API calls. Together, these two measures directly satisfy the requirement for data used in AI training on AWS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Security Groups and Network ACLs
Why it's wrong here
Security Groups and NACLs filter traffic by port and CIDR; they do not encrypt stored objects or apply TLS to transmissions, so neither requirement is satisfied. They tempt because they are core AWS network security controls, but they govern access, not encryption.
- ✗
Use client-side encryption and store keys in AWS Secrets Manager
Why it's wrong here
Client-side encryption with Secrets Manager keys covers data at rest only; it does nothing for data in transit, which requires TLS on every training and transfer path. It tempts because Secrets Manager genuinely centralises key management, but the stem demands both states be encrypted.
- ✓
Enable S3 default encryption with SSE-S3 and use HTTPS for API calls
Why this is correct
S3 default encryption with SSE-S3 applies AES-256 encryption to every object at rest automatically, satisfying the storage constraint without per-object configuration. HTTPS enforces TLS for data in transit during API calls. Together they cover both required states, though SSE-S3 lacks the customer-managed key control that SSE-KMS provides.
- ✗
Enable VPC peering and use VPN connections
Why it's wrong here
VPC peering and VPNs secure network paths between VPCs, not data at rest on S3 or EBS volumes, so the at-rest half of the requirement is unmet. It tempts because VPNs do encrypt traffic in transit, which is genuinely part of the ask.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
One of 962 original AI0-001 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This AI0-001 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI0-001 exam.