AWS Certified AI Practitioner AIF-C01 Practice Test 46
Question 450
A governance team must detect prohibited changes in AWS resource settings associated with AI workloads. Before approving a rollout, an architect suggests Use Amazon Polly audio logs as the AWS compliance source. Which mismatch should be documented for this precise design?
- Config tracks resource configuration and compliance against configured rules
- Speech synthesis is unrelated to resource-configuration recording
- Semantic vectors are not a resource-configuration history
- Prompt text cannot observe resource state without integrations
Explanation
Correct Answer
B:This is the actual failure mode of the proposed approach: Use Amazon Polly audio logs as the AWS compliance source. Speech synthesis is unrelated to resource-configuration recording
Incorrect Answers
A:Config tracks resource configuration and compliance against configured rules This explains the recommended design, but it is not the requested diagnosis of Use Amazon Polly audio logs as the AWS compliance source.
C:This limitation concerns Use only model embeddings to decide security group configuration compliance; it does not diagnose the proposed Use Amazon Polly audio logs as the AWS compliance source approach.
D:This limitation concerns Use a generative prompt to monitor every actual AWS configuration change; it does not diagnose the proposed Use Amazon Polly audio logs as the AWS compliance source approach.
Question 451
An auditor needs to know which principal invoked a production AI administration API and when. A pilot uses this approach instead: Use model generated prose as the authoritative account activity log. Which limitation MOST DIRECTLY explains why the requirement is not met?
- CloudTrail records AWS account API activity for security audits
- An editable assertion is not provider-recorded API history
- Model responses do not prove actual service API events
- Quality scores do not identify callers or timestamps
Explanation
Correct Answer
C:This is the actual failure mode of the proposed approach: Use model generated prose as the authoritative account activity log. Model responses do not prove actual service API events
Incorrect Answers
A:CloudTrail records AWS account API activity for security audits This explains the recommended design, but it is not the requested diagnosis of Use model generated prose as the authoritative account activity log.
B:This limitation concerns Store an unverified spreadsheet of claimed actions; it does not diagnose the proposed Use model generated prose as the authoritative account activity log approach.
D:This limitation concerns Use only a model's benchmark score as the actor log; it does not diagnose the proposed Use model generated prose as the authoritative account activity log approach.
Question 452
A security team wants to discover possible personally identifiable information in an S3 corpus for an AI project. After selecting the recommended approach, which evidence MOST DIRECTLY demonstrates that the actual required outcome has been achieved?
- A component test invokes this alternate approach successfully: Use IAM roles alone as a sensitive-data classifier
- Macie findings identify reviewed sample objects containing sensitive values
- A system inventory lists this competing approach as active: Use Amazon Polly voice generation to find customer PII
- A reviewed design record approves this competing approach: Use a CloudTrail event count as a list of exposed personal fields
Explanation
Correct Answer
B:Macie findings identify reviewed sample objects containing sensitive values. This checks the business result rather than just a configured feature.
Incorrect Answers
A:Access policy limits access but does not analyze content for PII A component invocation does not validate the necessary end-to-end outcome.
C:Speech synthesis is not stored-object sensitive-data scanning An active setting cannot independently prove the requested business outcome.
D:API request counts do not identify PII within stored objects Design approval is not evidence that the alternative meets the actual requirement.
Question 453
An AI chat app exchanges sensitive requests with a backend over a public network. Before approving a rollout, an architect suggests Treat a model safety prompt as transport confidentiality. Which mismatch should be documented for this precise design?
- Instructions to a model cannot encrypt network packets
- Stored-data encryption does not cover unencrypted transit
- Versioning protects object history rather than network sessions
- TLS reduces exposure of data in transit between endpoints
Explanation
Correct Answer
A:This is the actual failure mode of the proposed approach: Treat a model safety prompt as transport confidentiality. Instructions to a model cannot encrypt network packets
Incorrect Answers
B:This limitation concerns Use only at-rest encryption and send plaintext HTTP; it does not diagnose the proposed Treat a model safety prompt as transport confidentiality approach.
C:This limitation concerns Rely on S3 bucket versioning as the network encryption; it does not diagnose the proposed Treat a model safety prompt as transport confidentiality approach.
D:TLS reduces exposure of data in transit between endpoints This explains the recommended design, but it is not the requested diagnosis of Treat a model safety prompt as transport confidentiality.
Question 454
An inference application should only invoke its designated Bedrock model and read an approved S3 prefix. A pilot uses this approach instead: Grant administrator privileges to every inference role. Which limitation MOST DIRECTLY explains why the requirement is not met?
- Prompt words cannot enforce AWS API authorization
- Least privilege limits unintended model and data access
- Broad permissions expose unrelated resources
- Public access is incompatible with restricted source data
Explanation
Correct Answer
C:This is the actual failure mode of the proposed approach: Grant administrator privileges to every inference role. Broad permissions expose unrelated resources
Incorrect Answers
A:This limitation concerns Put an access policy only in the chatbot system prompt; it does not diagnose the proposed Grant administrator privileges to every inference role approach.
B:Least privilege limits unintended model and data access This explains the recommended design, but it is not the requested diagnosis of Grant administrator privileges to every inference role.
D:This limitation concerns Use a public S3 bucket as the security boundary; it does not diagnose the proposed Grant administrator privileges to every inference role approach.
Question 455
An AI chat app exchanges sensitive requests with a backend over a public network. During a design review, someone proposes Use only at-rest encryption and send plaintext HTTP. Which technical objection is specifically relevant to this proposal?
- Instructions to a model cannot encrypt network packets
- Versioning protects object history rather than network sessions
- TLS reduces exposure of data in transit between endpoints
- Stored-data encryption does not cover unencrypted transit
Explanation
Correct Answer
D:This is the actual failure mode of the proposed approach: Use only at-rest encryption and send plaintext HTTP. Stored-data encryption does not cover unencrypted transit
Incorrect Answers
A:This limitation concerns Treat a model safety prompt as transport confidentiality; it does not diagnose the proposed Use only at-rest encryption and send plaintext HTTP approach.
B:This limitation concerns Rely on S3 bucket versioning as the network encryption; it does not diagnose the proposed Use only at-rest encryption and send plaintext HTTP approach.
C:TLS reduces exposure of data in transit between endpoints This explains the recommended design, but it is not the requested diagnosis of Use only at-rest encryption and send plaintext HTTP.
Question 456
Compliance analysts need evidence showing whether configured AWS controls were assessed over time. Before approving a rollout, an architect suggests Use only invoice data as proof all controls passed. Which mismatch should be documented for this precise design?
- Artifact reports alone do not assess each customer's current configuration
- Translated text does not provide control evidence
- Audit Manager helps collect and manage evidence for audit assessments
- Billing history is not a security control assessment
Explanation
Correct Answer
D:This is the actual failure mode of the proposed approach: Use only invoice data as proof all controls passed. Billing history is not a security control assessment
Incorrect Answers
A:This limitation concerns Treat AWS Artifact documents as a real-time report of every customer control; it does not diagnose the proposed Use only invoice data as proof all controls passed approach.
B:This limitation concerns Use translation service output as control attestation; it does not diagnose the proposed Use only invoice data as proof all controls passed approach.
C:Audit Manager helps collect and manage evidence for audit assessments This explains the recommended design, but it is not the requested diagnosis of Use only invoice data as proof all controls passed.
Question 457
Compliance analysts need evidence showing whether configured AWS controls were assessed over time. A pilot uses this approach instead: Treat AWS Artifact documents as a real-time report of every customer control. Which limitation MOST DIRECTLY explains why the requirement is not met?
- Audit Manager helps collect and manage evidence for audit assessments
- Artifact reports alone do not assess each customer's current configuration
- Billing history is not a security control assessment
- Translated text does not provide control evidence
Explanation
Correct Answer
B:This is the actual failure mode of the proposed approach: Treat AWS Artifact documents as a real-time report of every customer control. Artifact reports alone do not assess each customer's current configuration
Incorrect Answers
A:Audit Manager helps collect and manage evidence for audit assessments This explains the recommended design, but it is not the requested diagnosis of Treat AWS Artifact documents as a real-time report of every customer control.
C:This limitation concerns Use only invoice data as proof all controls passed; it does not diagnose the proposed Treat AWS Artifact documents as a real-time report of every customer control approach.
D:This limitation concerns Use translation service output as control attestation; it does not diagnose the proposed Treat AWS Artifact documents as a real-time report of every customer control approach.
Question 458
A procurement team asks for AWS third-party compliance reports and agreements. Which option BEST meets the business requirement?
- Use CloudTrail events as an external auditor's signed report
- Assume a customer-authored model card constitutes AWS SOC evidence
- Use AWS Config as the repository for signed AWS third-party audits
- Retrieve relevant documents through AWS Artifact
Explanation
Correct Answer
D:Artifact provides access to AWS compliance reports and agreements The specified scenario makes this the most appropriate approach.
Incorrect Answers
A:Account activity logs do not replace provider audit reports This prevents the approach from meeting the stated requirement.
B:Model documentation is not AWS provider certification evidence This prevents the approach from meeting the stated requirement.
C:Config focuses on resource configuration, not compliance report distribution This prevents the approach from meeting the stated requirement.
Question 459
A governance team must detect prohibited changes in AWS resource settings associated with AI workloads. During a design review, someone proposes Use only model embeddings to decide security group configuration compliance. Which technical objection is specifically relevant to this proposal?
- Semantic vectors are not a resource-configuration history
- Speech synthesis is unrelated to resource-configuration recording
- Prompt text cannot observe resource state without integrations
- Config tracks resource configuration and compliance against configured rules
Explanation
Correct Answer
A:This is the actual failure mode of the proposed approach: Use only model embeddings to decide security group configuration compliance. Semantic vectors are not a resource-configuration history
Incorrect Answers
B:This limitation concerns Use Amazon Polly audio logs as the AWS compliance source; it does not diagnose the proposed Use only model embeddings to decide security group configuration compliance approach.
C:This limitation concerns Use a generative prompt to monitor every actual AWS configuration change; it does not diagnose the proposed Use only model embeddings to decide security group configuration compliance approach.
D:Config tracks resource configuration and compliance against configured rules This explains the recommended design, but it is not the requested diagnosis of Use only model embeddings to decide security group configuration compliance.
Question 460
An internal service must invoke supported AWS endpoints without traversing the public internet path. Before approving a rollout, an architect suggests Move the API key into a prompt and call a public endpoint. Which mismatch should be documented for this precise design?
- Private connectivity can keep service traffic on AWS networking paths
- Public endpoints do not inherently supply the intended private network boundary
- Sampling settings do not change network connectivity
- Embedding credentials does not establish private connectivity
Explanation
Correct Answer
D:This is the actual failure mode of the proposed approach: Move the API key into a prompt and call a public endpoint. Embedding credentials does not establish private connectivity
Incorrect Answers
A:Private connectivity can keep service traffic on AWS networking paths This explains the recommended design, but it is not the requested diagnosis of Move the API key into a prompt and call a public endpoint.
B:This limitation concerns Assume a public S3 URL is equivalent to a VPC endpoint; it does not diagnose the proposed Move the API key into a prompt and call a public endpoint approach.
C:This limitation concerns Use model temperature as a routing control; it does not diagnose the proposed Move the API key into a prompt and call a public endpoint approach.