Security, Compliance, and Governance for AI Solutions
Free AWS Certified AI Practitioner (AIF-C01) practice — 6 questions on Security, Compliance, and Governance for AI Solutions, with explanations. No sign-up.
Full 12-question mixed test →
Question 1 of 6 · Domain 5: Security, Compliance, and Governance for AI Solutions
A healthcare company is deploying a Amazon Bedrock application that processes patient diagnostic data. The company must ensure that all prompt inputs and model outputs containing Protected Health Information (PHI) are encrypted at rest and in transit, with the company maintaining full control over encryption keys. The solution must support automatic key rotation every 90 days and provide detailed audit logs of all key usage. Which approach BEST meets these requirements?
Customer managed KMS keys provide full control over encryption, support automatic rotation (configurable at 90 days or annually), and integrate with CloudTrail for detailed audit logging of all key usage. This meets all requirements: encryption at rest and in transit, customer control, automatic rotation at the specified interval, and comprehensive audit trails for compliance.
Question 2 of 6 · Domain 5: Security, Compliance, and Governance for AI Solutions
A financial services company uses Amazon SageMaker to deploy credit risk assessment models across 15 endpoints in multiple AWS accounts. Regulatory auditors require proof that model predictions have not drifted beyond acceptable thresholds and that all prediction requests are traceable to specific data inputs. Which solution provides the MOST operationally efficient approach to meet both requirements?
SageMaker Model Monitor with DataCaptureConfig provides native, automated drift detection by comparing predictions against baseline statistics, addressing the drift requirement. CloudTrail data events for SageMaker specifically capture InvokeEndpoint API calls with request/response payloads, providing the required traceability from predictions to inputs. This combination is operationally efficient as both services are managed, scale automatically across accounts, and require minimal custom code.
Question 3 of 6 · Domain 5: Security, Compliance, and Governance for AI Solutions
A company is building a RAG-based chatbot using Amazon Bedrock and Amazon Kendra. The system will access confidential documents stored in S3 across multiple departments (Finance, Legal, HR). Each department has strict requirements that users can only access documents and receive AI-generated responses based on documents they are authorized to view. The company needs to prevent prompt injection attacks where users might try to bypass access controls through crafted prompts. Which solution provides the MOST secure implementation?
This solution implements defense in depth: S3 Access Points provide fine-grained S3 access control, Kendra ACLs ensure document-level authorization during retrieval, Bedrock Agents with action groups can programmatically validate permissions before document retrieval (preventing unauthorized context), and WAF rules add protection against prompt injection attempts. This creates multiple security layers that work together to prevent both access control bypasses and prompt injection.
Question 4 of 6 · Domain 5: Security, Compliance, and Governance for AI Solutions
A global media company is using Amazon Transcribe to convert customer support calls to text, then using Amazon Comprehend to analyze sentiment. The company operates in the EU and must comply with GDPR, requiring that all personal data is processed only within EU regions and that customers can request complete deletion of their data within 30 days. Call recordings are stored in S3 for up to 7 years for regulatory compliance, but transcripts containing PII must be deletable. Which architecture BEST satisfies these requirements?
This solution addresses all requirements: EU region processing (GDPR data residency), S3 Glacier vault lock ensures 7-year retention of original recordings cannot be altered (regulatory compliance), separate storage for deletable transcripts, DynamoDB provides efficient mapping for deletion requests, Macie automatically detects PII for proper tagging, and Step Functions orchestrates the complex workflow of deleting transcripts while preserving locked recordings. The architecture separates immutable compliance data from deletable personal data.
Question 5 of 6 · Domain 5: Security, Compliance, and Governance for AI Solutions
A pharmaceutical company is fine-tuning a foundation model using Amazon Bedrock for drug discovery research. The training data contains proprietary molecular structures and clinical trial results worth billions of dollars. The company's security team requires that the fine-tuned model weights never leave the company's control, all training jobs must be traceable to specific data scientists with non-repudiation, and any attempt to export model artifacts must be blocked and immediately investigated. Which combination of controls BEST meets these requirements?
This solution provides comprehensive controls: KMS encryption protects at rest, IAM permission boundaries prevent privilege escalation and block exports at the principal level, SCPs provide organization-wide preventive controls that can't be overridden, aws:PrincipalOrgID prevents accidental cross-org sharing, session names in IAM roles provide non-repudiation by tying actions to specific employees, CloudTrail log file integrity validation ensures audit logs can't be tampered with, and separate security account for logs prevents deletion. This creates multiple layers of preventive and detective controls.
Question 6 of 6 · Domain 5: Security, Compliance, and Governance for AI Solutions
An insurance company uses Amazon Textract to extract data from claim forms, then Amazon Comprehend Medical to identify medical conditions. A recent audit revealed that some processed documents contained incorrect PII redaction, and there's no reliable way to trace which human reviewers approved specific ML predictions before data entered downstream systems. The company needs to implement a governance framework that ensures all ML predictions above 85% confidence are automatically approved, predictions between 60-85% are sent for human review with full audit trails, and predictions below 60% are rejected. Which solution provides the MOST comprehensive governance and auditability?
Amazon A2I is purpose-built for this exact use case—human review of ML predictions with built-in workflow management. It natively supports confidence threshold configuration, integrates with Textract and Comprehend, provides worker authentication through Cognito, automatically captures complete audit trails (who reviewed, when, what decision, input/output data), and integrates with CloudTrail for API-level governance. DynamoDB provides queryable audit history, and S3 versioning ensures document lineage. This is the AWS-native, fully managed solution designed specifically for ML governance with human-in-the-loop.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$54.99$17.99 with code FREETEST33 — valid through August 22.
