Task Statement 5.1: Explain Methods to Secure AI Systems. AIF-C01 Practice Questions (Page 7)

Questions 31–33

1. 31foundation · easy

   Which AWS feature is used to grant a Lambda function permission to invoke a Bedrock agent?

   • AAn S3 bucket policy
   • BA security group rule
   • CA CloudWatch alarm
   • DAn IAM role with a policy that allows the bedrock:InvokeAgent action
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which approach is a recommended best practice for securely managing credentials used by an AI data pipeline?

   • AStoring credentials in a public S3 bucket
   • BEmailing credentials to team members
   • CUsing AWS Secrets Manager to store and rotate credentials
   • DHardcoding credentials in the application code
   Reveal Solution Discussion Select an answer first
3. 33application · medium

   A data science team uses Amazon SageMaker Studio to train models. They need to access a training dataset stored in an S3 bucket owned by another AWS account. The bucket is encrypted with an AWS KMS key. The team wants to grant the SageMaker execution role access to the data without exposing the bucket to the public. What should the data platform team configure?

   • AAn S3 bucket policy that allows the SageMaker execution role to read the bucket, and a KMS key policy that allows the role to use the key.
   • BA VPC endpoint for S3 in the data platform account, and a bucket policy that allows access from that endpoint.
   • CAn IAM role in the data platform account with a trust policy for the SageMaker execution role, and attach a policy to that role allowing S3 and KMS access.
   • DA bucket policy that grants the SageMaker execution role read access, and an S3 Access Point with a policy that allows KMS decryption.
   Reveal Solution Discussion Select an answer first