AWS Certified AI Practitioner AIF-C01 Practice Test 45
Question 440
A business agent should call external APIs on behalf of users without sharing one permanent master credential. A pilot uses this approach instead: Give all agents a permanent account-wide administrative secret. Which limitation MOST DIRECTLY explains why the requirement is not met?
- Shared high-privilege credentials create excessive blast radius
- Semantic relevance does not establish the caller's authority
- Plain language is not a cryptographically verified identity
- Identity-aware agents should authenticate to tools with appropriate caller scope
Explanation
Correct Answer
A:This is the actual failure mode of the proposed approach: Give all agents a permanent account-wide administrative secret. Shared high-privilege credentials create excessive blast radius
Incorrect Answers
B:This limitation concerns Use vector similarity as proof of permission to invoke an API; it does not diagnose the proposed Give all agents a permanent account-wide administrative secret approach.
C:This limitation concerns Rely on a prompt statement that the user is authorized; it does not diagnose the proposed Give all agents a permanent account-wide administrative secret approach.
D:Identity-aware agents should authenticate to tools with appropriate caller scope This explains the recommended design, but it is not the requested diagnosis of Give all agents a permanent account-wide administrative secret.
Question 441
A regulated assistant must show where each policy answer originated. During a design review, someone proposes Use only the model's confidence as source documentation. Which technical objection is specifically relevant to this proposal?
- Availability does not establish informational origins
- Removing provenance weakens answer verification
- Data lineage supports audits and tracing unsupported outputs
- Confidence does not identify the underlying document
Explanation
Correct Answer
D:This is the actual failure mode of the proposed approach: Use only the model's confidence as source documentation. Confidence does not identify the underlying document
Incorrect Answers
A:This limitation concerns Use a service uptime metric as proof every fact has a source; it does not diagnose the proposed Use only the model's confidence as source documentation approach.
B:This limitation concerns Strip source identifiers to make prompts shorter; it does not diagnose the proposed Use only the model's confidence as source documentation approach.
C:Data lineage supports audits and tracing unsupported outputs This explains the recommended design, but it is not the requested diagnosis of Use only the model's confidence as source documentation.
Question 442
An AI chat app exchanges sensitive requests with a backend over a public network. Which option BEST meets the business requirement?
- Treat a model safety prompt as transport confidentiality
- Rely on S3 bucket versioning as the network encryption
- Use only at-rest encryption and send plaintext HTTP
- Protect the channel with TLS in transit
Explanation
Correct Answer
D:TLS reduces exposure of data in transit between endpoints The specified scenario makes this the most appropriate approach.
Incorrect Answers
A:Instructions to a model cannot encrypt network packets This prevents the approach from meeting the stated requirement.
B:Versioning protects object history rather than network sessions This prevents the approach from meeting the stated requirement.
C:Stored-data encryption does not cover unencrypted transit This prevents the approach from meeting the stated requirement.
Question 443
An organization must honor regional data residency and retention rules for AI interaction logs. A pilot uses this approach instead: Assume encryption makes retention and residency irrelevant. Which limitation MOST DIRECTLY explains why the requirement is not met?
- Encryption does not change legal location or deletion obligations
- Governance requires knowing where data is stored and when it is removed
- Indefinite retention may conflict with minimization policies
- Token limits do not choose storage regions
Explanation
Correct Answer
A:This is the actual failure mode of the proposed approach: Assume encryption makes retention and residency irrelevant. Encryption does not change legal location or deletion obligations
Incorrect Answers
B:Governance requires knowing where data is stored and when it is removed This explains the recommended design, but it is not the requested diagnosis of Assume encryption makes retention and residency irrelevant.
C:This limitation concerns Keep every prompt and response forever by default; it does not diagnose the proposed Assume encryption makes retention and residency irrelevant approach.
D:This limitation concerns Use model output length as a data residency setting; it does not diagnose the proposed Assume encryption makes retention and residency irrelevant approach.
Question 444
An auditor needs to know which principal invoked a production AI administration API and when. During a design review, someone proposes Use only a model's benchmark score as the actor log. Which technical objection is specifically relevant to this proposal?
- CloudTrail records AWS account API activity for security audits
- Quality scores do not identify callers or timestamps
- Model responses do not prove actual service API events
- An editable assertion is not provider-recorded API history
Explanation
Correct Answer
B:This is the actual failure mode of the proposed approach: Use only a model's benchmark score as the actor log. Quality scores do not identify callers or timestamps
Incorrect Answers
A:CloudTrail records AWS account API activity for security audits This explains the recommended design, but it is not the requested diagnosis of Use only a model's benchmark score as the actor log.
C:This limitation concerns Use model generated prose as the authoritative account activity log; it does not diagnose the proposed Use only a model's benchmark score as the actor log approach.
D:This limitation concerns Store an unverified spreadsheet of claimed actions; it does not diagnose the proposed Use only a model's benchmark score as the actor log approach.
Question 445
A procurement team asks for AWS third-party compliance reports and agreements. A pilot uses this approach instead: Use AWS Config as the repository for signed AWS third-party audits. Which limitation MOST DIRECTLY explains why the requirement is not met?
- Artifact provides access to AWS compliance reports and agreements
- Config focuses on resource configuration, not compliance report distribution
- Account activity logs do not replace provider audit reports
- Model documentation is not AWS provider certification evidence
Explanation
Correct Answer
B:This is the actual failure mode of the proposed approach: Use AWS Config as the repository for signed AWS third-party audits. Config focuses on resource configuration, not compliance report distribution
Incorrect Answers
A:Artifact provides access to AWS compliance reports and agreements This explains the recommended design, but it is not the requested diagnosis of Use AWS Config as the repository for signed AWS third-party audits.
C:This limitation concerns Use CloudTrail events as an external auditor's signed report; it does not diagnose the proposed Use AWS Config as the repository for signed AWS third-party audits approach.
D:This limitation concerns Assume a customer-authored model card constitutes AWS SOC evidence; it does not diagnose the proposed Use AWS Config as the repository for signed AWS third-party audits approach.
Question 446
A governance team must detect prohibited changes in AWS resource settings associated with AI workloads. A pilot uses this approach instead: Use a generative prompt to monitor every actual AWS configuration change. Which limitation MOST DIRECTLY explains why the requirement is not met?
- Prompt text cannot observe resource state without integrations
- Speech synthesis is unrelated to resource-configuration recording
- Semantic vectors are not a resource-configuration history
- Config tracks resource configuration and compliance against configured rules
Explanation
Correct Answer
A:This is the actual failure mode of the proposed approach: Use a generative prompt to monitor every actual AWS configuration change. Prompt text cannot observe resource state without integrations
Incorrect Answers
B:This limitation concerns Use Amazon Polly audio logs as the AWS compliance source; it does not diagnose the proposed Use a generative prompt to monitor every actual AWS configuration change approach.
C:This limitation concerns Use only model embeddings to decide security group configuration compliance; it does not diagnose the proposed Use a generative prompt to monitor every actual AWS configuration change approach.
D:Config tracks resource configuration and compliance against configured rules This explains the recommended design, but it is not the requested diagnosis of Use a generative prompt to monitor every actual AWS configuration change.
Question 447
A regulated assistant must show where each policy answer originated. A pilot uses this approach instead: Strip source identifiers to make prompts shorter. Which limitation MOST DIRECTLY explains why the requirement is not met?
- Data lineage supports audits and tracing unsupported outputs
- Removing provenance weakens answer verification
- Availability does not establish informational origins
- Confidence does not identify the underlying document
Explanation
Correct Answer
B:This is the actual failure mode of the proposed approach: Strip source identifiers to make prompts shorter. Removing provenance weakens answer verification
Incorrect Answers
A:Data lineage supports audits and tracing unsupported outputs This explains the recommended design, but it is not the requested diagnosis of Strip source identifiers to make prompts shorter.
C:This limitation concerns Use a service uptime metric as proof every fact has a source; it does not diagnose the proposed Strip source identifiers to make prompts shorter approach.
D:This limitation concerns Use only the model's confidence as source documentation; it does not diagnose the proposed Strip source identifiers to make prompts shorter approach.
Question 448
An internal service must invoke supported AWS endpoints without traversing the public internet path. After selecting the recommended approach, which evidence MOST DIRECTLY demonstrates that the actual required outcome has been achieved?
- A system inventory lists this competing approach as active: Assume a public S3 URL is equivalent to a VPC endpoint
- A reviewed design record approves this competing approach: Move the API key into a prompt and call a public endpoint
- Network tests verify endpoint DNS and private routing with access controls
- A component test invokes this alternate approach successfully: Use model temperature as a routing control
Explanation
Correct Answer
C:Network tests verify endpoint DNS and private routing with access controls. This checks the business result rather than just a configured feature.
Incorrect Answers
A:Public endpoints do not inherently supply the intended private network boundary An active setting cannot independently prove the requested business outcome.
B:Embedding credentials does not establish private connectivity Design approval is not evidence that the alternative meets the actual requirement.
D:Sampling settings do not change network connectivity A component invocation does not validate the necessary end-to-end outcome.
Question 449
A finance team must protect stored AI training data with customer-controlled cryptographic keys. After selecting the recommended approach, which evidence MOST DIRECTLY demonstrates that the actual required outcome has been achieved?
- A component test invokes this alternate approach successfully: Use CloudTrail as the encryption engine
- Stored test objects show encryption with the intended key and access policy
- A reviewed design record approves this competing approach: Use public model guardrail word lists as the KMS key policy
- A system inventory lists this competing approach as active: Rely on HTTPS alone as at-rest encryption
Explanation
Correct Answer
B:Stored test objects show encryption with the intended key and access policy. This checks the business result rather than just a configured feature.
Incorrect Answers
A:CloudTrail records actions rather than encrypting objects A component invocation does not validate the necessary end-to-end outcome.
C:Text filters do not manage cryptographic keys Design approval is not evidence that the alternative meets the actual requirement.
D:Transport encryption does not protect stored data by itself An active setting cannot independently prove the requested business outcome.
Question 450
A governance team must detect prohibited changes in AWS resource settings associated with AI workloads. Before approving a rollout, an architect suggests Use Amazon Polly audio logs as the AWS compliance source. Which mismatch should be documented for this precise design?
- Config tracks resource configuration and compliance against configured rules
- Speech synthesis is unrelated to resource-configuration recording
- Semantic vectors are not a resource-configuration history
- Prompt text cannot observe resource state without integrations
Explanation
Correct Answer
B:This is the actual failure mode of the proposed approach: Use Amazon Polly audio logs as the AWS compliance source. Speech synthesis is unrelated to resource-configuration recording
Incorrect Answers
A:Config tracks resource configuration and compliance against configured rules This explains the recommended design, but it is not the requested diagnosis of Use Amazon Polly audio logs as the AWS compliance source.
C:This limitation concerns Use only model embeddings to decide security group configuration compliance; it does not diagnose the proposed Use Amazon Polly audio logs as the AWS compliance source approach.
D:This limitation concerns Use a generative prompt to monitor every actual AWS configuration change; it does not diagnose the proposed Use Amazon Polly audio logs as the AWS compliance source approach.