AWS AI Practitioner Security, Compliance, and Governance for AI Solutions: 196 practice questions

12 of the 196 Security, Compliance, and Governance for AI Solutions questions in the Certsqill AWS AI Practitioner bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for AWS AI Practitioner? Take the free 5-min readiness check →

1. Use a dedicated role with narrowly scoped permissions: Which approach is best?

1. Use a content filter to decide which cloud resources the workload may access.

   Content filters inspect selected inputs or outputs; they do not define identity permissions for cloud resources.
2. Store a long-lived administrator credential in the application environment.

   Long-lived administrator credentials increase exposure and violate least-privilege and credential-protection practices.
3. Use a dedicated role with narrowly scoped permissions for required resources and actions. ✓

   A dedicated, narrowly scoped role limits workload access to resources and actions required for its documented purpose.
4. Grant broad administrator access so the workload can handle future features.

   Broad administrator access exceeds current needs and increases the impact of compromised credentials or unintended actions.

A dedicated role with narrowly scoped permissions gives the workload only the access necessary for its documented tasks.

2. Use a role that the workload assumes to obtain temporary: Which approach is best?

1. Use a role that the workload assumes to obtain temporary credentials. ✓

   Assumed roles provide temporary credentials that can be scoped, monitored, and renewed without embedding permanent secrets.
2. Embed a shared user password in the workload's deployment package.

   Shared passwords are difficult to control and audit, and embedding them creates avoidable credential exposure.
3. Use an administrator role permanently so credential renewal cannot interrupt processing.

   Permanent administrator access violates least privilege and does not satisfy the need for temporary, renewable credentials.
4. Create a permanent access key and rotate it only after an incident.

   Permanent keys remain exposed for longer periods and incident-only rotation provides weak protection against credential compromise.

Workloads should assume appropriately scoped roles that issue temporary credentials instead of embedding permanent secrets.

3. Encrypt stored confidential prompts: Select TWO protections that address the stated encryption requirements.

Select two. More than one option is correct — every correct one is ticked below.

1. Encrypt stored confidential prompts, summaries, and logs. ✓

   Encryption at rest protects confidential data held in storage if unauthorized parties gain access to the underlying systems.
2. Encrypt confidential data exchanged between the application and AI services. ✓

   Encryption in transit protects prompts and outputs from interception while moving between communicating systems.
3. Use private connectivity and assume stored outputs need no further protection.

   Private connectivity can reduce network exposure, but it does not encrypt stored outputs or replace other protections.
4. Use least-privilege permissions without applying encryption controls.

   Least privilege limits access but does not replace encryption for stored or transmitted confidential data.
5. Apply a content filter and treat detected sensitive material as encrypted.

   Content filters can detect or mask selected information, but they do not encrypt data at rest or in transit.

Confidential AI data needs encryption during storage and transmission; access controls and filtering address different security layers.

4. Use AWS PrivateLink for the supported service's private: Which approach best addresses that connectivity requi

1. Use AWS PrivateLink for the supported service's private connectivity option. ✓

   PrivateLink provides private connectivity for supported services, addressing the network path requirement without implying authorization.
2. Use a content safeguard to prevent documents from leaving the application.

   Content safeguards inspect or restrict information but do not create private network connectivity to an AWS service.
3. Place the application in a private subnet without configuring private service connectivity.

   A private subnet alone does not establish private connectivity to every supported AWS service endpoint.
4. Use public service endpoints and rely only on application-level authentication.

   Authentication controls who may use a service but does not provide the requested private network connectivity.

PrivateLink addresses private connectivity for supported services, while authentication and safeguards solve different security concerns.

5. Protect prompts and logs: Which customer responsibility is most appropriate?

1. Protect prompts and logs, restrict access, minimize retention, and assess authorization. ✓

   Customers must protect sensitive AI data throughout its lifecycle and make informed access, retention, and authorization decisions.
2. Assume the service provider automatically makes all prompts and logs harmless.

   Providers do not eliminate customer responsibility for sensitive inputs, outputs, logs, authorization, and retention decisions.
3. Disable all logging permanently so confidential information cannot be recorded.

   Disabling all logs may hinder troubleshooting and does not address sensitive data already present in prompts or outputs.
4. Use a guardrail and consider customer data protection complete.

   Guardrails provide selected safeguards but do not replace encryption, access control, retention, or authorization responsibilities.

Customers remain responsible for protecting prompts and logs, controlling access, minimizing retention, and confirming authorized data use.

6. Apply least-privilege permissions to the approved: Which approach is best?

1. Apply least-privilege permissions to the approved training-data repository and its users. ✓

   Least-privilege permissions restrict reading and modification to authorized personnel and required training activities.
2. Publish the dataset internally so more reviewers can identify quality issues.

   Broad internal publication increases exposure and does not ensure that only authorized personnel can read or modify data.
3. Store the dataset in a public location while relying on model safeguards.

   Public storage exposes training data, while model safeguards do not control storage permissions or personnel access.
4. Remove demographic fields and assume the remaining dataset requires no access restrictions.

   Removing demographic fields does not eliminate sensitive information, proxies, or the need for access controls.

Least-privilege repository permissions ensure only authorized personnel can access or modify approved training data.

7. Redact sensitive fields: Which approach best meets the requirement?

1. Redact sensitive fields, restrict access, encrypt logs, and expire them. ✓

   These controls minimize exposure while preserving appropriately protected troubleshooting evidence.
2. Log prompts and responses without field-level filtering.

   Unfiltered records can retain personal, payment, or confidential information unnecessarily.
3. Retain all troubleshooting records indefinitely under access controls.

   Restricted access does not remove the privacy and exposure risks of indefinite retention.
4. Delete operational logs whenever a troubleshooting case is closed.

   Immediate deletion can remove evidence needed for monitoring, recurring-issue analysis, or investigations.

Minimize sensitive log data and protect necessary records with access, encryption, and retention controls.

8. Enforce explicit tool-call policies and permissions: Which approach is best?

1. Use MCP so connected tools automatically reject unsafe requests.

   MCP connects applications with tools and resources but does not guarantee trustworthy outputs or enforce business authorization automatically.
2. Use a larger foundation model to interpret instructions more accurately.

   A larger model may improve language performance but does not independently authorize or constrain sensitive tool calls.
3. Enforce explicit tool-call policies and permissions outside the agent’s prompt. ✓

   Independent policy and permission controls can restrict tools and actions even when retrieved text contains manipulative instructions.
4. Add the warning “ignore malicious instructions” to the system prompt.

   Prompt warnings can help behavior but are not a dependable authorization boundary for refunds or order changes.

Prompt injection requires independent authorization and tool restrictions; model instructions and connectivity protocols alone are insufficient.

9. Apply Bedrock Guardrails to configured output filters: Which approach best addresses this output-validation re

1. Apply Bedrock Guardrails to configured output filters, then evaluate residual risk. ✓

   Bedrock Guardrails support configurable sensitive-information, content, and denied-topic filters; evaluation addresses their limits.
2. Review responses after customers receive them.

   Post-delivery review cannot reliably prevent prohibited information from reaching customers.
3. Use retrieval grounding and approved documents to enforce every content rule.

   Grounding assesses relation to supplied sources but does not enforce every sensitive-information or topic policy.
4. Increase model temperature to vary the generated wording.

   Generation variability does not validate sensitive-information exposure or prohibited topics.

Bedrock Guardrails can filter configured sensitive information and topics, but detection is not perfect.

10. Apply IAM permissions and least-privilege access: Which control is most important?

1. Use contextual grounding checks to decide whether each user may view a document.

   Grounding checks source relevance, not whether a particular identity is authorized to access that source.
2. Apply IAM permissions and least-privilege access to the users, workloads, and data. ✓

   IAM and least privilege determine which identities and workloads can access protected documents.
3. Add more retrieved documents so the model has broader context.

   Broader retrieval can increase unauthorized exposure and does not establish document access permissions.
4. Use a higher-capability model to enforce donor and volunteer separation.

   Model capability does not replace enforceable identity, resource, and workload permissions.

RAG grounding supports relevant answers, but IAM and least privilege determine whether identities may access retrieved documents.

11. AgentCore Identity for workload authentication: Which AgentCore capability is most directly relevant?

1. AgentCore Gateway for exposing supported tools and resources through MCP.

   Gateway exposes supported tools and resources through MCP, but the requirement focuses on identity and access integration.
2. AgentCore Observability for monitoring agent activity.

   Observability provides visibility and diagnosis but does not manage service authentication or access integration.
3. AgentCore Identity for workload authentication and enterprise access integration. ✓

   Identity is the AgentCore capability aligned with authentication and integration of access to enterprise services.
4. AgentCore Memory for preserving conversation context.

   Memory preserves session or cross-session context but does not provide authentication or access integration.

AgentCore Identity addresses authentication and access integration; Memory, Gateway, and Observability serve different purposes.

12. Use AgentCore Policy through Gateway to enforce permitted: Select TWO requirements the design should satisfy.

Select two. More than one option is correct — every correct one is ticked below.

1. Use AgentCore Policy through Gateway to enforce permitted tool-call constraints. ✓

   AgentCore Policy can enforce tool-call constraints through Gateway, providing an independent restriction on agent actions.
2. Grant broad permissions so the agent can recover from unexpected workflow conditions.

   Broad permissions increase possible impact and contradict least-privilege protection for billing and customer data.
3. Apply IAM least-privilege permissions and temporary role-based access to required resources. ✓

   IAM limits which identities and workloads can access resources, complementing tool-specific policy enforcement.
4. Use MCP connectivity alone to guarantee safe outputs from connected tools.

   MCP connects applications with tools and resources but does not guarantee tool trustworthiness or business authorization.
5. Trust the agent’s system prompt to prevent every unauthorized billing action.

   Prompts influence behavior but are not a dependable authorization boundary for sensitive business operations.

Agent safety requires both tool-call policy enforcement and least-privilege resource access; prompts and MCP alone are insufficient.

Other AWS AI Practitioner domains

• Applications of Foundation Models — 390 questions →
• Fundamentals of GenAI — 336 questions →
• Fundamentals of AI and ML — 279 questions →
• Guidelines for Responsible AI — 195 questions →
• All 1396 AWS AI Practitioner questions →
• AWS AI Practitioner certification: requirements, cost and exam format →