Task Statement 5.1: Explain Methods to Secure AI Systems. AIF-C01 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Under the AWS shared responsibility model, which security task is the customer's responsibility when using a managed AI service such as Amazon Comprehend?

   • AManaging the physical security of AWS data centers
   • BPatching the underlying operating system of the service
   • CApplying security patches to the service's application code
   • DConfiguring IAM policies to control access to the service
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company stores training data in S3. The data may contain credit card numbers and social security numbers. The security team wants to automatically detect and classify this sensitive data, and then apply appropriate access controls. What should they use?

   • AAmazon GuardDuty to detect the sensitive data, and then use S3 bucket policies to restrict access.
   • BAmazon Inspector to scan the data, and then use IAM roles to restrict access.
   • CAmazon Macie to discover and classify the sensitive data, and then use IAM policies to restrict access to the affected buckets.
   • DAWS Config to scan the data, and then use AWS Organizations to restrict access.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A machine learning team has developed a model that predicts loan defaults. The compliance team requires documentation of the model's intended use, training data, evaluation metrics, and known limitations. What should the team use to document this information?

   • AAmazon Macie
   • BAWS Glue Data Catalog
   • CSageMaker Model Cards
   • DAmazon SageMaker Experiments
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which AWS service can automatically detect sensitive data such as credit card numbers in an S3 bucket used for AI training data?

   • AAmazon CloudWatch
   • BAWS Config
   • CAWS CloudTrail
   • DAmazon Macie
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has a VPC with a private subnet and a public subnet. An application in the private subnet needs to call the Amazon Textract API to extract text from documents. The security team requires that the traffic not traverse the public internet and that only the application can call Textract. The application uses an IAM role. What should the company configure?

   • AA NAT gateway in the public subnet, and a security group that allows outbound traffic to Textract.
   • BAn interface VPC endpoint for Textract in the private subnet, and an IAM policy that allows the application's role to call Textract actions.
   • CAn S3 VPC endpoint, and a bucket policy that allows the application to access Textract.
   • DA VPC peering connection to the Textract service, and a route table entry.
   Reveal Solution Discussion Select an answer first