Task Statement 5.1: Explain Methods to Secure AI Systems. AIF-C01 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company stores data in S3 for use in AI training. The data includes both public and sensitive information. The security team wants to automatically detect sensitive data and then apply appropriate access controls. They also want to ensure that the sensitive data is encrypted at rest. What should they do?

   • AUse Amazon Inspector to scan the data, then use IAM roles to restrict access, and enable S3 object lock.
   • BUse Amazon Macie to discover and classify sensitive data, then use IAM policies to restrict access to the affected buckets, and enable S3 default encryption with SSE-KMS.
   • CUse Amazon GuardDuty to detect sensitive data, then use S3 bucket policies to restrict access, and enable S3 versioning.
   • DUse AWS Config to scan the data, then use AWS Organizations to restrict access, and enable S3 server-side encryption with SSE-S3.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which practice is a secure data engineering best practice for AI systems?

   • AEncrypting data at rest and in transit
   • BSharing database credentials in code repositories
   • CDisabling CloudTrail to reduce costs
   • DStoring all data in a single S3 bucket without access controls
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which AWS service is commonly used to build a data catalog for datasets used in AI?

   • AAmazon GuardDuty
   • BAWS CloudTrail
   • CAWS Glue Data Catalog
   • DAmazon Macie
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which Bedrock feature can be used to block toxic or inappropriate content in the responses of a generative AI model?

   • AGuardrails
   • BIAM policies
   • CModel Cards
   • DPrivateLink
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is deploying a generative AI application using Amazon Bedrock. The application processes user inputs that may contain personal data. The security team wants to ensure that the model does not output personal data that was not in the input, and that the model does not generate toxic content. What should they configure?

   • AEnable encryption at rest for the Bedrock service.
   • BAn IAM policy that restricts the model's output to non-personal data.
   • CA Bedrock Guardrail with PII redaction and content filters for toxicity.
   • DUse a different foundation model that is known to be safe.
   Reveal Solution Discussion Select an answer first