AWS Certified AI Practitioner (AIF-C01) — All Questions

Which AWS service controls who can access AI resources and what actions they are permitted to perform?

• a.Amazon Polly, which converts written input text into natural-sounding spoken audio output
• b.AWS Identity and Access Management, which governs authentication and authorization✓
• c.AWS Ground Station, which provides access to satellite ground stations
• d.Amazon Comprehend, which finds entities, and sentiment inside text

IAM manages authentication and authorization across AWS, defining which users and roles can access which resources and actions, including AI services like Amazon Bedrock and SageMaker. The others are unrelated services.

What does the principle of least privilege recommend when granting access to AI and ML resources?

• a.Grant each user or service only the minimum permissions its task needs, nothing more✓
• b.Grant every single user full administrator access in order to avoid any permission errors later
• c.Disable all of the access controls entirely once the project has finally reached production stage
• d.Share one single root account across the whole team so that access is more convenient for all

Least privilege minimizes risk by giving each identity only the permissions required for its role. Broad admin access, shared root credentials, and disabled controls all dramatically widen the potential blast radius of a breach.

How does the AWS shared responsibility model apply to a managed service like Amazon Bedrock?

• a.Neither AWS nor the customer holds any real security responsibility at all under this shared model
• b.The customer alone must build, staff, and patch the underlying physical data centers themselves
• c.AWS alone is responsible for absolutely everything, including the customer's own data and permissions
• d.AWS secures the underlying infrastructure; the customer secures access, data, and usage✓

Under the shared responsibility model, AWS secures the cloud infrastructure ('security of the cloud'), while customers secure what they put in it, their data, access policies, and configurations ('security in the cloud').

Why is encrypting data both at rest and in transit important for AI workloads?

• a.It completely removes the need to configure or manage any access permissions on the resources
• b.It permanently increases the model's prediction accuracy
• c.It keeps sensitive training data and model inputs unreadable if they are intercepted✓
• d.It is only ever needed for public data anyone may already read

Encryption at rest and in transit safeguards confidentiality: even if storage or network traffic is accessed by an unauthorized party, the data stays unreadable. It complements, not replaces, access controls.

Which service continuously assesses the configuration of AWS resources against desired policies for compliance?

• a.Amazon Polly, which converts written input text into natural-sounding spoken audio output
• b.Amazon Lex, which builds conversational chatbots using speech and language understanding
• c.AWS Config, which records configurations and evaluates them against defined rules✓
• d.Amazon Rekognition, which detects objects, scenes, and faces within images and in video

AWS Config records resource configurations and evaluates them against rules for compliance and governance, alerting on drift. Lex, Rekognition, and Polly are AI application services, not governance tools.

Which service automatically discovers and helps protect sensitive data such as personal information stored in Amazon S3?

• a.Amazon Macie, which finds and classifies sensitive data like personal information✓
• b.Amazon Translate, which converts written text from one human language into another one
• c.Amazon Transcribe, which converts speech into written text
• d.Amazon Forecast, which predicts future values from time-series datasets

Amazon Macie uses machine learning to discover, classify, and help protect sensitive data like PII in S3, supporting data-privacy and governance goals. The other services translate, transcribe, or forecast.

When using data to train or customize an AI model, why does data governance emphasize provenance and quality?

• a.Because governance rules require deleting all data-source records
• b.Because tracking provenance is what actually lets the finished model run on much cheaper hardware
• c.Because the quality of the data only matters after the model is retired
• d.Because the origin and accuracy of training data directly affect reliability and compliance✓

Knowing where data came from and ensuring it is accurate, permitted, and representative is central to trustworthy models: poor or improperly sourced data can create bias, errors, and legal exposure. Governance documents these sources rather than erasing them.

Which AWS service records API calls and user activity to provide an audit trail for security and governance?

• a.AWS CloudTrail, which logs API calls and account activity as an audit trail✓
• b.Amazon Polly, which converts written input text into natural-sounding spoken audio
• c.Amazon Kendra, which provides intelligent search across enterprise content sources
• d.Amazon Textract, which extracts text, forms, and tables from scanned document files

AWS CloudTrail logs API calls and account activity, creating an audit trail for security analysis, compliance, and investigating who did what and when. The other options are AI application services, not audit tools.

Which AWS service creates and manages the cryptographic keys used to encrypt data for AI and ML workloads?

• a.Amazon Macie
• b.AWS CloudTrail
• c.AWS Key Management Service (AWS KMS)✓
• d.Amazon Comprehend

AWS KMS creates, stores, and controls the encryption keys used to protect data at rest across services. Macie discovers sensitive data, CloudTrail logs activity, and Comprehend analyzes text.

What is the recommended way to give an application running on AWS temporary permissions to call Amazon Bedrock?

• a.Assign an IAM role, rather than embedding long-term access keys in the application✓
• b.Hard-code the root account credentials into the app
• c.Share one access key across the whole team
• d.Disable authentication for the service entirely

IAM roles grant temporary, automatically rotated credentials to applications, avoiding risky long-term keys. Root credentials, shared keys, and disabled auth all dramatically increase security risk.

Under Amazon Bedrock's data privacy terms, what happens to the prompts and data a customer sends to a base foundation model?

• a.They are published publicly for transparency
• b.They are sold to advertisers
• c.They are not used to train the base foundation models and are not shared with model providers✓
• d.They are automatically shared with all other customers

Amazon Bedrock does not use your prompts or completions to train the base models, and your data is not shared with third-party model providers, supporting confidentiality. It stays within your control.

How can a company access Amazon Bedrock or SageMaker without its traffic traversing the public internet?

• a.By disabling all encryption on the network connection
• b.By making the S3 buckets public
• c.By emailing the data to AWS
• d.By using VPC endpoints powered by AWS PrivateLink✓

VPC endpoints via AWS PrivateLink provide private connectivity to AWS services, keeping traffic off the public internet. Disabling encryption or making buckets public would reduce security, not improve privacy.

To create an audit record of every prompt sent to and response received from Amazon Bedrock, which feature would you enable?

• a.Model invocation logging to Amazon CloudWatch and/or Amazon S3✓
• b.Amazon Polly speech output
• c.Amazon Rekognition content moderation
• d.AWS Budgets spending alerts

Bedrock model invocation logging captures request and response details to CloudWatch Logs and/or S3 for auditing and troubleshooting. Polly, Rekognition, and Budgets serve unrelated purposes.

Where can a customer download AWS compliance reports, such as SOC and ISO certifications, to support governance?

• a.Amazon Kendra
• b.AWS Artifact✓
• c.Amazon Polly
• d.Amazon Textract

AWS Artifact is the self-service portal for AWS compliance reports and agreements (SOC, ISO, PCI, and more). The other services search content, synthesize speech, or extract document text; none provide compliance artifacts.

Which service collects metrics, logs, and alarms to monitor the operational health and usage of AI workloads?

• a.Amazon Macie for sensitive-data discovery
• b.AWS Artifact
• c.Amazon Translate
• d.Amazon CloudWatch✓

Amazon CloudWatch gathers metrics and logs and can trigger alarms, giving operational visibility into AI and other workloads. Macie finds sensitive data, Artifact provides compliance docs, and Translate converts languages.

What is the recommended AWS service for securely storing and automatically rotating an API key used by an AI application?

• a.AWS Secrets Manager✓
• b.Amazon S3 with public access enabled
• c.A plaintext file in the code repository
• d.Amazon Rekognition

AWS Secrets Manager securely stores credentials and can rotate them automatically, keeping secrets out of code. Public S3 or plaintext-in-repo would expose secrets, and Rekognition is a vision service.

Which AWS service uses machine learning and threat intelligence to continuously detect malicious activity across your AWS accounts?

• a.Amazon Comprehend
• b.Amazon GuardDuty✓
• c.Amazon Polly
• d.Amazon Lex

Amazon GuardDuty continuously analyzes account activity and network data to detect threats and anomalies. Comprehend analyzes text, Polly synthesizes speech, and Lex builds chatbots; none are threat-detection services.

A company must keep its data within a specific country to meet compliance rules. Which choice most directly supports this for an AI workload?

• a.Increasing the model's temperature
• b.Making the data public
• c.Selecting an AWS Region located in that country to process and store the data✓
• d.Turning off CloudTrail logging

Choosing an AWS Region in the required country keeps data processing and storage within that jurisdiction, supporting data-residency requirements. Inference settings and logging toggles do not address residency.

How can you keep an Amazon SageMaker training job isolated from the public internet?

• a.By running it under the root account
• b.By making the training bucket public
• c.By increasing the instance size
• d.By running the job within a VPC with network isolation enabled✓

Running SageMaker jobs inside a VPC with network isolation prevents outbound internet access, tightening security for sensitive data. Instance size, root usage, or public buckets do not provide network isolation.

Which AWS service helps continuously collect evidence and map it to frameworks to simplify audits of AI/ML and other workloads?

• a.AWS Audit Manager✓
• b.Amazon Polly
• c.Amazon Rekognition
• d.Amazon Translate

AWS Audit Manager automates evidence collection and maps it to compliance frameworks, streamlining audits. Polly, Rekognition, and Translate are AI application services, not audit-automation tools.

Across many AWS accounts, how can a company centrally enforce guardrails such as restricting which AI services or Regions may be used?

• a.By sharing a single common IAM user across all of the member accounts
• b.By applying AWS Organizations service control policies (SCPs)✓
• c.By disabling CloudTrail everywhere
• d.By making every S3 bucket public

AWS Organizations SCPs set permission guardrails across accounts, so you can centrally restrict services, actions, or Regions. Sharing users, disabling logging, or public buckets would weaken security and governance.