AWS AI Practitioner Security, Compliance, and Governance for AI Solutions: 157 practice questions

12 of the 157 Security, Compliance, and Governance for AI Solutions questions in the Certsqill AWS AI Practitioner bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AWS AI Practitioner? Take the free 5-min readiness check →

1. Use a dedicated role with narrowly scoped permissions: Which approach is best?

1. Use a content filter to decide which cloud resources the workload may access.

   Content filters inspect selected inputs or outputs; they do not define identity permissions for cloud resources.
2. Store a long-lived administrator credential in the application environment.

   Long-lived administrator credentials increase exposure and violate least-privilege and credential-protection practices.
3. Use a dedicated role with narrowly scoped permissions for required resources and actions. ✓

   A dedicated, narrowly scoped role limits workload access to resources and actions required for its documented purpose.
4. Grant broad administrator access so the workload can handle future features.

   Broad administrator access exceeds current needs and increases the impact of compromised credentials or unintended actions.

A dedicated role with narrowly scoped permissions gives the workload only the access necessary for its documented tasks.

2. Use a role that the workload assumes to obtain temporary: Which approach is best?

1. Use a role that the workload assumes to obtain temporary credentials. ✓

   Assumed roles provide temporary credentials that can be scoped, monitored, and renewed without embedding permanent secrets.
2. Embed a shared user password in the workload's deployment package.

   Shared passwords are difficult to control and audit, and embedding them creates avoidable credential exposure.
3. Use an administrator role permanently so credential renewal cannot interrupt processing.

   Permanent administrator access violates least privilege and does not satisfy the need for temporary, renewable credentials.
4. Create a permanent access key and rotate it only after an incident.

   Permanent keys remain exposed for longer periods and incident-only rotation provides weak protection against credential compromise.

Workloads should assume appropriately scoped roles that issue temporary credentials instead of embedding permanent secrets.

3. Use AWS PrivateLink for the supported service's private: Which approach best addresses that connectivity requi

1. Use AWS PrivateLink for the supported service's private connectivity option. ✓

   PrivateLink provides private connectivity for supported services, addressing the network path requirement without implying authorization.
2. Use a content safeguard to prevent documents from leaving the application.

   Content safeguards inspect or restrict information but do not create private network connectivity to an AWS service.
3. Place the application in a private subnet without configuring private service connectivity.

   A private subnet alone does not establish private connectivity to every supported AWS service endpoint.
4. Use public service endpoints and rely only on application-level authentication.

   Authentication controls who may use a service but does not provide the requested private network connectivity.

PrivateLink addresses private connectivity for supported services, while authentication and safeguards solve different security concerns.

4. Protect prompts and logs: Which customer responsibility is most appropriate?

1. Protect prompts and logs, restrict access, minimize retention, and assess authorization. ✓

   Customers must protect sensitive AI data throughout its lifecycle and make informed access, retention, and authorization decisions.
2. Assume the service provider automatically makes all prompts and logs harmless.

   Providers do not eliminate customer responsibility for sensitive inputs, outputs, logs, authorization, and retention decisions.
3. Disable all logging permanently so confidential information cannot be recorded.

   Disabling all logs may hinder troubleshooting and does not address sensitive data already present in prompts or outputs.
4. Use a guardrail and consider customer data protection complete.

   Guardrails provide selected safeguards but do not replace encryption, access control, retention, or authorization responsibilities.

Customers remain responsible for protecting prompts and logs, controlling access, minimizing retention, and confirming authorized data use.

5. Apply least-privilege permissions to the approved: Which approach is best?

1. Apply least-privilege permissions to the approved training-data repository and its users. ✓

   Least-privilege permissions restrict reading and modification to authorized personnel and required training activities.
2. Publish the dataset internally so more reviewers can identify quality issues.

   Broad internal publication increases exposure and does not ensure that only authorized personnel can read or modify data.
3. Store the dataset in a public location while relying on model safeguards.

   Public storage exposes training data, while model safeguards do not control storage permissions or personnel access.
4. Remove demographic fields and assume the remaining dataset requires no access restrictions.

   Removing demographic fields does not eliminate sensitive information, proxies, or the need for access controls.

Least-privilege repository permissions ensure only authorized personnel can access or modify approved training data.

6. Redact sensitive fields: Which approach best meets the requirement?

1. Redact sensitive fields, restrict access, encrypt logs, and expire them. ✓

   These controls minimize exposure while preserving appropriately protected troubleshooting evidence.
2. Log prompts and responses without field-level filtering.

   Unfiltered records can retain personal, payment, or confidential information unnecessarily.
3. Retain all troubleshooting records indefinitely under access controls.

   Restricted access does not remove the privacy and exposure risks of indefinite retention.
4. Delete operational logs whenever a troubleshooting case is closed.

   Immediate deletion can remove evidence needed for monitoring, recurring-issue analysis, or investigations.

Minimize sensitive log data and protect necessary records with access, encryption, and retention controls.

7. Enforce explicit tool-call policies and permissions: Which approach is best?

1. Use MCP so connected tools automatically reject unsafe requests.

   MCP connects applications with tools and resources but does not guarantee trustworthy outputs or enforce business authorization automatically.
2. Use a larger foundation model to interpret instructions more accurately.

   A larger model may improve language performance but does not independently authorize or constrain sensitive tool calls.
3. Enforce explicit tool-call policies and permissions outside the agent’s prompt. ✓

   Independent policy and permission controls can restrict tools and actions even when retrieved text contains manipulative instructions.
4. Add the warning “ignore malicious instructions” to the system prompt.

   Prompt warnings can help behavior but are not a dependable authorization boundary for refunds or order changes.

Prompt injection requires independent authorization and tool restrictions; model instructions and connectivity protocols alone are insufficient.

8. Apply Bedrock Guardrails to configured output filters: Which approach best addresses this output-validation re

1. Apply Bedrock Guardrails to configured output filters, then evaluate residual risk. ✓

   Bedrock Guardrails support configurable sensitive-information, content, and denied-topic filters; evaluation addresses their limits.
2. Review responses after customers receive them.

   Post-delivery review cannot reliably prevent prohibited information from reaching customers.
3. Use retrieval grounding and approved documents to enforce every content rule.

   Grounding assesses relation to supplied sources but does not enforce every sensitive-information or topic policy.
4. Increase model temperature to vary the generated wording.

   Generation variability does not validate sensitive-information exposure or prohibited topics.

Bedrock Guardrails can filter configured sensitive information and topics, but detection is not perfect.

9. Apply IAM permissions and least-privilege access: Which control is most important?

1. Use contextual grounding checks to decide whether each user may view a document.

   Grounding checks source relevance, not whether a particular identity is authorized to access that source.
2. Apply IAM permissions and least-privilege access to the users, workloads, and data. ✓

   IAM and least privilege determine which identities and workloads can access protected documents.
3. Add more retrieved documents so the model has broader context.

   Broader retrieval can increase unauthorized exposure and does not establish document access permissions.
4. Use a higher-capability model to enforce donor and volunteer separation.

   Model capability does not replace enforceable identity, resource, and workload permissions.

RAG grounding supports relevant answers, but IAM and least privilege determine whether identities may access retrieved documents.

10. AgentCore Identity for workload authentication: Which AgentCore capability is most directly relevant?

1. AgentCore Gateway for exposing supported tools and resources through MCP.

   Gateway exposes supported tools and resources through MCP, but the requirement focuses on identity and access integration.
2. AgentCore Observability for monitoring agent activity.

   Observability provides visibility and diagnosis but does not manage service authentication or access integration.
3. AgentCore Identity for workload authentication and enterprise access integration. ✓

   Identity is the AgentCore capability aligned with authentication and integration of access to enterprise services.
4. AgentCore Memory for preserving conversation context.

   Memory preserves session or cross-session context but does not provide authentication or access integration.

AgentCore Identity addresses authentication and access integration; Memory, Gateway, and Observability serve different purposes.

11. Use IAM policies and least privilege to restrict: Which control addresses the permission requirement?

1. Use a lower-temperature model to prevent unauthorized record disclosure.

   Temperature affects response variation but does not enforce permissions over retrieved records.
2. Use broader retrieval so the model can compare more educational materials.

   Broader retrieval may expose restricted records and does not determine whether an instructor is authorized.
3. Use contextual grounding to determine whether instructors may retrieve student records.

   Contextual grounding evaluates source relationship and query relevance, not the requester’s authorization.
4. Use IAM policies and least privilege to restrict instructor and workload access. ✓

   IAM policies and least privilege enforce identity and workload permissions for restricted student records.

Grounding supports source relevance, whereas IAM permissions and least privilege control who may access restricted records.

12. Use approved sources: Which approach is best?

1. Trust fluent summaries as evidence that source data is reliable.

   Fluency reflects presentation quality, not source authenticity, completeness, or authorization.
2. Use approved sources, restrict changes, verify records, and retain provenance. ✓

   Source approval, controlled modification, verification, and provenance address integrity and accountability before reliance.
3. Increase model size to detect altered records more reliably.

   Model size does not establish source authenticity, authorization, or complete alteration detection.
4. Allow connected systems broad write access to keep updates available.

   Broad write access can increase unauthorized changes and weaken accountability for source integrity.

Trustworthy AI decisions require approved sources, controlled changes, verification, and provenance—not fluent output alone.

Other AWS AI Practitioner domains

• Applications of Foundation Models — 311 questions →
• Fundamentals of GenAI — 269 questions →
• Fundamentals of AI and ML — 223 questions →
• Guidelines for Responsible AI — 156 questions →
• All 1116 AWS AI Practitioner questions →