Skip to content

AIF-C01 Study Notes: Task Statement 5.1 — Explain Methods to Secure AI Systems

1. AWS Shared Responsibility Model

Security in an AI solution is shared between AWS and the customer.

AWS is responsible for Customer is responsible for
Security of the cloud Security in the cloud
Physical data centers, hardware, and foundational infrastructure IAM users, roles, policies, and permissions
Managed-service infrastructure Data classification, privacy, and access control
Physical and environmental security Encryption configuration and key management
Patching infrastructure controlled by AWS Application code, prompts, training data, and model inputs
Availability of managed AWS services Network configuration, logging, monitoring, and vulnerability management

The exact responsibility depends on the service. For example, AWS manages more of the underlying infrastructure for a fully managed service, but the customer still controls data, identities, permissions, and service configuration.

Exam tips and traps

  • The shared responsibility model does not mean AWS secures everything automatically.
  • Customers remain responsible for:
  • Correct IAM permissions
  • Protecting credentials
  • Data privacy
  • Encryption choices and key policies
  • Application security
  • Input and output handling
  • Logging and monitoring
  • “AWS is responsible for the physical security of the data center” is generally correct.
  • “AWS automatically prevents sensitive data from being included in prompts” is generally incorrect unless the customer configures an appropriate service or control.

2. IAM Roles, Policies, and Permissions

IAM roles

An IAM role is an identity that can be assumed by an AWS service, application, or user. Roles are preferred to embedding long-term access keys in applications.

Common AI use cases include:

  • Giving Amazon SageMaker access to Amazon S3 training data
  • Allowing a Lambda function to invoke an Amazon Bedrock model
  • Allowing a pipeline to access model artifacts
  • Allowing an application to write audit logs to Amazon CloudWatch Logs

Use temporary credentials whenever possible.

IAM policies

IAM policies are JSON documents that define permissions. A policy specifies:

  • Effect: Allow or Deny
  • Action: The operation permitted or denied
  • Resource: The AWS resource affected
  • Condition: Additional restrictions, such as source VPC, encryption, or tags

A permission is granted only when an applicable Allow exists and no applicable explicit Deny overrides it.

Least privilege

Grant only the permissions required for the task.

Examples:

  • Permit a training job to read only a specific S3 prefix.
  • Permit an inference application to invoke only approved foundation models.
  • Permit a model monitoring process to read metrics but not modify models.
  • Use separate roles for development, testing, and production.

Important IAM concepts

  • Identity-based policies: Attached to users, groups, or roles.
  • Resource-based policies: Attached to resources such as S3 buckets or KMS keys.
  • Permission boundaries: Limit the maximum permissions an IAM principal can receive.
  • Service control policies, or SCPs: Organization-level guardrails that define maximum available permissions for accounts. SCPs do not grant permissions by themselves.
  • Explicit deny: Overrides an allow.
  • IAM Access Analyzer: Helps identify unintended access and validate policies.

Exam tips and traps

  • An IAM role is generally safer than storing access keys in code.
  • An SCP does not grant access; it restricts what permissions can be used.
  • Least privilege applies to AI data, models, tools, APIs, and logs—not only to users.
  • A role used by a SageMaker job or application must have both:
  • A trust policy allowing the service to assume the role
  • Permissions policies allowing the required AWS actions

3. Encryption for AI Systems

Encryption should protect data at rest and in transit.

Encryption at rest

Encryption at rest protects stored data, including:

  • Training and validation data in Amazon S3
  • Model artifacts
  • Vector indexes and knowledge bases
  • Prompt and response logs
  • Database records
  • Backups and snapshots
  • CloudWatch Logs, where configured

AWS services commonly integrate with AWS Key Management Service, or AWS KMS, for customer-managed encryption keys.

Important KMS considerations include:

  • Key policies
  • IAM permissions
  • Key rotation
  • Separation of duties
  • Restrictions on which roles can use the key
  • Auditing key usage with AWS CloudTrail

Encryption in transit

Encryption in transit protects data as it moves between:

  • Users and applications
  • Applications and AWS services
  • Training jobs and data stores
  • Applications and model endpoints
  • Components in a private network

Use TLS-enabled endpoints and avoid transmitting sensitive data over unencrypted protocols.

Encryption comparison

Control Protects against Example
Encryption at rest Unauthorized access to stored data or disks Encrypting S3 objects with SSE-KMS
Encryption in transit Interception during network transfer HTTPS/TLS connection to an API
IAM Unauthorized AWS API actions Restricting who can invoke a model
KMS Key management and cryptographic operations Controlling use of a customer-managed key

Exam tips and traps

  • Encryption does not replace access control.
  • Encryption at rest does not protect data while it is being transmitted.
  • TLS does not determine whether a user is authorized to access a model.
  • Customer-managed KMS keys provide more control than AWS-owned or AWS-managed keys, but also require additional policy and operational management.

4. Amazon Macie

Amazon Macie is a data security and privacy service that uses machine learning to discover and classify sensitive data in Amazon S3.

Macie can help identify:

  • Personally identifiable information, or PII
  • Financial information
  • Credentials and secrets
  • Sensitive files and buckets
  • Publicly accessible or overly exposed S3 data

AI use cases include:

  • Scanning training datasets before model development
  • Finding PII in datasets used for fine-tuning
  • Identifying sensitive prompt or response logs in S3
  • Supporting data classification and privacy assessments
  • Detecting potentially risky S3 configurations

Macie comparison

Service Primary purpose
Amazon Macie Discover and classify sensitive data, especially in S3
Amazon GuardDuty Detect threats and suspicious activity
Amazon Inspector Find software vulnerabilities
AWS Config Assess resource configuration and compliance
Amazon Detective Investigate security findings and relationships
AWS Lake Formation Govern access to data lakes

Exam tip

If the question asks which service identifies sensitive information such as PII in S3, the likely answer is Amazon Macie.

Macie does not replace:

  • IAM permissions
  • Encryption
  • Data loss prevention policies
  • Application-level redaction
  • Secure deletion or retention controls

AWS PrivateLink provides private connectivity to supported AWS services, SaaS products, and services in other VPCs through interface VPC endpoints.

Traffic can remain on the AWS network instead of traversing the public internet.

AI use cases

  • Privately accessing an AI service from a VPC
  • Connecting applications to supported Amazon Bedrock endpoints
  • Providing private access to model-serving or data services
  • Restricting access using security groups and endpoint policies
  • Reducing exposure of sensitive prompts and responses
Option Typical use
AWS PrivateLink interface endpoint Private access to a supported service or endpoint
NAT gateway Allows private subnet resources to initiate outbound internet access
Internet gateway Provides internet connectivity for public subnets
VPC peering Private connectivity between VPCs
AWS Transit Gateway Centralized connectivity among multiple VPCs and networks
Gateway endpoint Private access to services such as Amazon S3 and DynamoDB, where supported

Exam tips and traps

  • PrivateLink improves network privacy but does not automatically authorize the request.
  • IAM, endpoint policies, security groups, and service-specific controls still apply.
  • A NAT gateway is not the same as PrivateLink. NAT provides outbound internet access; PrivateLink provides private service connectivity.
  • Private networking does not automatically encrypt data at the application level. Use TLS where required.

6. Amazon Bedrock Guardrails

Amazon Bedrock Guardrails helps apply safety and policy controls to model inputs and outputs.

Guardrails can help with:

  • Blocking or detecting harmful content
  • Managing denied topics
  • Filtering undesirable content
  • Detecting or masking sensitive information
  • Applying contextual grounding checks
  • Reducing unsafe or inappropriate model responses
  • Preventing certain prompts or outputs from reaching users

Guardrails can be used with supported Amazon Bedrock model interactions and applications. The exact supported features and integration behavior depend on the selected model and API configuration.

Guardrails are not a complete security solution

Guardrails do not replace:

  • IAM
  • Encryption
  • Network isolation
  • Data classification
  • Secure application design
  • Vulnerability management
  • Human review for high-impact decisions
  • Output validation for business rules

Guardrails comparison

Control Main purpose
Amazon Bedrock Guardrails Apply content, topic, sensitive-information, and grounding-related controls
IAM Authorize AWS resources and API actions
Amazon Macie Discover sensitive data in S3
AWS WAF Help protect web applications from common web exploits
Application validation Enforce business rules and expected output formats
Human review Handle high-risk or ambiguous decisions

Exam tip

If the question asks how to block harmful topics or filter sensitive information in model inputs and outputs, consider Amazon Bedrock Guardrails.

Do not assume that Guardrails automatically prevents every form of prompt injection, hallucination, or data leakage.

7. Amazon Bedrock AgentCore Identity and Policy

Amazon Bedrock AgentCore provides capabilities for building and operating AI agents. Two relevant security concepts are identity and policy.

AgentCore Identity

AgentCore Identity helps agents and agent applications authenticate and securely access external tools, APIs, and resources.

Important goals include:

  • Managing identities for agents and users
  • Obtaining or using credentials securely
  • Avoiding hard-coded secrets
  • Supporting controlled access to external services
  • Separating user identity from agent identity when appropriate
  • Applying least privilege to tool use

An agent should not automatically receive unrestricted access to every tool or data source.

AgentCore Policy

AgentCore Policy provides policy-based controls for agent actions and interactions, such as:

  • Which tools an agent may use
  • Which resources or APIs the agent may access
  • Which actions require approval
  • Which operations are allowed or denied
  • Restrictions based on context, identity, or request attributes

Policy controls are especially important because agents can plan and invoke tools dynamically.

AgentCore comparison

Capability Focus
AgentCore Identity Who the agent or user is and how credentials are obtained
AgentCore Policy What actions and tool calls are permitted
IAM AWS identity and permissions
Bedrock Guardrails Safety and content controls for model interactions
Application authorization Business-specific access decisions

Exam tips and traps

  • Authentication answers who the caller is.
  • Authorization answers what the caller can do.
  • An agent’s ability to call a tool should be restricted independently of the model’s ability to generate text.
  • Agent identity and user identity are not necessarily the same.
  • Do not give an agent broad administrator permissions merely because it needs to call one tool.

8. Source Citation, Data Origins, and Lineage

AI systems should document where data and generated information came from.

Source citation

Source citation identifies the sources used to support an answer or decision.

For a RAG system, citations may include:

  • Document name
  • Source URI
  • Database record
  • Document version
  • Page, section, or paragraph
  • Retrieval timestamp
  • Access classification

Citations improve:

  • Trust
  • Reviewability
  • Debugging
  • Compliance evidence
  • User verification
  • Investigation of incorrect responses

A citation does not guarantee that the answer is correct. The application should verify that the cited source actually supports the generated claim.

Data lineage

Data lineage describes the history and movement of data.

It can document:

  • Original source
  • Data owner
  • Collection method
  • Transformations
  • Cleaning and filtering steps
  • Joins and enrichment
  • Training or indexing use
  • Model or application version
  • Retention and deletion events

Data lineage is important for identifying the origin of sensitive information and reproducing or investigating model behavior.

Data cataloging

A data catalog organizes information about datasets, such as:

  • Business meaning
  • Owner
  • Schema
  • Sensitivity classification
  • Quality status
  • Approved uses
  • Retention period
  • Lineage
  • Access restrictions

AWS services that may support data discovery and governance include AWS Glue Data Catalog and AWS Lake Formation. Amazon Macie can help discover sensitive data in S3.

Amazon SageMaker Model Cards

SageMaker Model Cards document important information about a model, such as:

  • Intended use
  • Risk information
  • Limitations
  • Evaluation results
  • Training data information
  • Performance across relevant conditions
  • Ethical considerations
  • Approval and review information

Model cards support governance and transparency. They do not replace model monitoring, access controls, or technical security controls.

Exam tip

  • Data lineage answers: “Where did this data come from, and how was it transformed?”
  • Data cataloging answers: “What data exists, what does it mean, and how is it governed?”
  • Model cards answer: “How was this model developed, evaluated, intended to be used, and limited?”

9. Secure Data Engineering for AI

Assess data quality

Before using data for training, fine-tuning, retrieval, or evaluation, assess:

  • Completeness
  • Accuracy
  • Consistency
  • Timeliness
  • Duplicates
  • Missing values
  • Outliers
  • Label quality
  • Bias and representativeness
  • Data drift
  • Schema correctness

Poor-quality data can cause inaccurate, biased, or unsafe outputs.

Implement data access control

Use layered controls:

  • IAM roles with least privilege
  • S3 bucket policies and access points
  • Lake Formation permissions for governed data lakes
  • VPC controls and private endpoints
  • Encryption and KMS key policies
  • Row- and column-level access where supported
  • Data classification
  • Separation of development, test, and production data
  • Restricted access to raw sensitive data

Avoid copying sensitive datasets into less-secure locations for convenience.

Privacy-enhancing technologies and practices

Privacy controls can include:

  • Removing unnecessary personal data
  • Masking or tokenizing identifiers
  • Anonymization or pseudonymization
  • Aggregating data
  • Redacting secrets and PII
  • Using synthetic data when suitable
  • Limiting retention
  • Applying purpose limitation
  • Restricting access to de-identified and re-identification data separately
  • Applying privacy-preserving training or analytics techniques when appropriate

At the AIF-C01 level, the key principle is to minimize exposure of personal and confidential information.

Data integrity

Protect data from unauthorized or accidental modification.

Methods include:

  • Versioning
  • Checksums and hashes
  • Object integrity validation
  • Immutable or protected storage
  • Approval workflows
  • Audit logs
  • Separation of duties
  • Monitoring unexpected changes
  • Validating data schemas and file formats
  • Tracking dataset versions used by models

Exam tip

Data quality and data security are different:

  • Data quality asks whether data is accurate, complete, and suitable.
  • Data security asks whether data is protected from unauthorized access or alteration.

A dataset can be high quality but insecure, or secure but inaccurate.

10. Security and Privacy Considerations for AI Systems

Application security

AI applications should use secure development practices:

  • Validate and sanitize user inputs
  • Avoid exposing system prompts, credentials, or internal instructions
  • Use secure API authentication
  • Enforce authorization before tool or data access
  • Protect secrets with AWS Secrets Manager or another approved secret-management solution
  • Use dependency scanning and secure coding practices
  • Apply rate limiting and quotas
  • Prevent excessive and unintended agent actions

Prompt injection

Prompt injection occurs when untrusted instructions influence the model to ignore intended instructions or perform unauthorized behavior.

Examples include:

  • A user instructing a model to reveal hidden system instructions
  • A retrieved document containing malicious instructions
  • An email asking an agent to send confidential data
  • A web page directing an agent to invoke a dangerous tool

Possible mitigations include:

  • Treat retrieved content as untrusted data
  • Separate instructions from data
  • Restrict tools and permissions
  • Require approval for sensitive actions
  • Use AgentCore Policy or application authorization
  • Validate tool parameters
  • Use allowlists for destinations and operations
  • Avoid putting secrets in prompts
  • Apply output filtering and post-processing
  • Log prompts, retrieved sources, tool calls, and outputs
  • Use Bedrock Guardrails where appropriate

No single control completely eliminates prompt injection.

Threat detection

Use appropriate monitoring and detection services:

  • Amazon GuardDuty for threat detection
  • AWS CloudTrail for API activity
  • Amazon CloudWatch for logs, metrics, and alarms
  • AWS Security Hub for centralized security findings
  • Amazon Detective for investigation
  • Amazon Macie for sensitive data discovery
  • Amazon Inspector for vulnerability assessment

Vulnerability management

AI solutions include more than models. Assess:

  • Application dependencies
  • Container images
  • Operating systems
  • Notebook environments
  • APIs
  • Agent tools
  • Infrastructure as code
  • Open-source packages
  • Model-serving components

Amazon Inspector is primarily used to identify vulnerabilities in supported workloads such as EC2 instances, container images, and Lambda functions.

Infrastructure protection

Use:

  • VPCs and private subnets
  • Security groups and network ACLs
  • PrivateLink and VPC endpoints
  • Network segmentation
  • AWS WAF for web-facing applications
  • DDoS protections where applicable
  • Secure baseline configurations
  • Patch management
  • Backup and recovery controls
  • Service quotas and resource policies

Data leakage prevention

Potential leakage sources include:

  • Prompts containing PII or secrets
  • Responses exposing confidential training data
  • Logs containing full prompts and outputs
  • Overly broad retrieval permissions
  • Agent tool calls to unauthorized systems
  • Public S3 buckets
  • Debug output and error messages
  • Cross-tenant or cross-user context contamination

Mitigations include:

  • Data classification before use
  • Redaction and masking
  • Least privilege
  • Tenant isolation
  • Guardrails
  • Output filtering
  • Sensitive-data detection
  • Private connectivity
  • Careful logging and retention
  • Human review for high-risk use cases

Output filtering and validation

Do not assume model output is safe or correct.

Validate:

  • Schema and format
  • Data types
  • Allowed values
  • Required fields
  • Business rules
  • Authorization implications
  • Toxicity and inappropriate content
  • PII and secrets
  • Links and tool parameters
  • Citations and source support

For example, an application should validate that a model-generated SQL statement is read-only before executing it.

Audit trails and logging

Log enough information to support security, compliance, troubleshooting, and incident response.

Potential audit information includes:

  • Identity of the requester
  • Timestamp
  • Application and model version
  • Prompt metadata
  • Retrieved documents or source identifiers
  • Tool calls and parameters
  • Model response metadata
  • Guardrail actions
  • Approval decisions
  • Errors and blocked requests
  • Configuration changes

Avoid logging sensitive information unnecessarily. Apply:

  • Redaction
  • Encryption
  • Access control
  • Retention policies
  • Log integrity protection
  • Monitoring and alerting

AWS CloudTrail records AWS API activity. It does not automatically provide a complete record of every application-level prompt and response. The application may need to create additional audit logs.

Toxicity

Toxicity refers to harmful, abusive, hateful, threatening, or otherwise inappropriate content.

Controls include:

  • Input and output moderation
  • Amazon Bedrock Guardrails
  • Classification models
  • Blocklists and allowlists
  • Human review
  • Context-specific policies
  • Monitoring for repeated abusive use

Toxicity controls should be tested for false positives and false negatives.

11. Hallucination Detection and Grounding

A hallucination is an output that is unsupported, fabricated, or inconsistent with known information.

Retrieval Augmented Generation grounding

RAG grounds generation by retrieving relevant information from approved sources and including it in the model context.

A typical RAG flow is:

  1. Ingest approved documents.
  2. Clean, classify, and chunk the documents.
  3. Create embeddings.
  4. Store embeddings in a vector store.
  5. Retrieve relevant content for a user query.
  6. Provide the retrieved context to the model.
  7. Generate an answer based on that context.
  8. Return citations and apply validation.

RAG can reduce hallucinations but does not eliminate them. Problems can still occur if:

  • The retrieval results are irrelevant
  • The source documents are outdated
  • The context is incomplete
  • The model misinterprets the context
  • The model ignores the retrieved information
  • A malicious document contains prompt injection
  • Access controls allow retrieval of unauthorized documents

Other grounding techniques

  • Use authoritative and current sources.
  • Restrict retrieval to approved repositories.
  • Apply document-level access controls.
  • Require citations.
  • Instruct the model to say it does not know when evidence is insufficient.
  • Use structured output.
  • Use deterministic business logic for calculations and decisions.
  • Validate claims against source documents.
  • Use human review for high-impact results.
  • Keep model and knowledge-base versions.

Output validation

Validation methods include:

  • Checking whether claims are supported by retrieved passages
  • Verifying entities, dates, and numbers against source data
  • Checking required fields and schemas
  • Comparing outputs with business rules
  • Running generated code in a restricted environment
  • Rejecting unsupported answers
  • Asking the model to provide evidence
  • Using a separate evaluator or classifier

Confidence scoring

Confidence scores estimate how likely an answer is to be reliable. Signals may include:

  • Retrieval similarity
  • Number and quality of supporting sources
  • Agreement between multiple checks
  • Classification probability
  • Model-provided confidence
  • Rule-based validation results

A model-generated confidence statement should not be treated as proof. Confidence should be calibrated against known evaluation data.

Grounding comparison

Method Benefit Limitation
RAG Uses current, approved external information Depends on retrieval quality and source quality
Fine-tuning Teaches patterns, style, or domain behavior Does not reliably provide current facts or citations
Output validation Blocks malformed or unsupported results Requires validation rules or another evaluator
Confidence scoring Helps route uncertain outputs Scores can be poorly calibrated
Human review Handles ambiguity and high-risk cases Adds cost and latency

Exam tips and traps

  • RAG is usually the better answer when the requirement is to answer using current enterprise documents.
  • Fine-tuning is not automatically a grounding technique.
  • RAG reduces hallucinations but does not guarantee factual accuracy.
  • Citations should be checked against the actual answer.
  • A high confidence score does not prove correctness.
  • Use deterministic code or databases for precise calculations instead of relying only on a language model.

12. Common Service Selection Guide

Requirement Likely AWS service or control
Give a SageMaker job permission to read S3 data IAM role and least-privilege policy
Encrypt model artifacts or training data AWS KMS with service encryption
Discover PII in S3 Amazon Macie
Detect suspicious AWS activity Amazon GuardDuty
Find vulnerabilities in supported workloads Amazon Inspector
Record AWS API activity AWS CloudTrail
Monitor logs and metrics Amazon CloudWatch
Privately connect to a supported service AWS PrivateLink
Govern data lake access AWS Lake Formation
Apply model safety and topic controls Amazon Bedrock Guardrails
Secure agent identity and credentials Amazon Bedrock AgentCore Identity
Restrict agent tool use and actions AgentCore Policy and least privilege
Document model use, limitations, and evaluation SageMaker Model Cards
Ground responses in enterprise documents RAG
Enforce application-specific output rules Application validation
Practice Questions and Answers ### Question 1 A company stores training data and prompt logs in Amazon S3. The security team wants to identify objects containing PII before the data is used for model training. Which AWS service should the company use? A. Amazon GuardDuty B. Amazon Macie C. Amazon Inspector D. AWS WAF **Answer: B. Amazon Macie** **Explanation:** Amazon Macie discovers and classifies sensitive data, including PII, in Amazon S3. GuardDuty detects threats, Inspector identifies vulnerabilities, and WAF protects web applications. --- ### Question 2 A Lambda function invokes an Amazon Bedrock model. The company wants to avoid storing long-term AWS access keys in the function code. What is the best solution? A. Store access keys in the Lambda environment variables B. Use an IAM role assumed by the Lambda function C. Make the model publicly accessible D. Store credentials in the application source code repository **Answer: B. Use an IAM role assumed by the Lambda function** **Explanation:** IAM roles provide temporary credentials and avoid hard-coded long-term secrets. The role should use a least-privilege policy. --- ### Question 3 A company wants to prevent users from submitting prompts containing sensitive information and prevent model responses from containing certain harmful topics. Which service is most appropriate? A. Amazon Bedrock Guardrails B. Amazon Inspector C. AWS CloudTrail D. Amazon VPC **Answer: A. Amazon Bedrock Guardrails** **Explanation:** Bedrock Guardrails can apply controls to model inputs and outputs, including sensitive information, harmful content, and denied topics. --- ### Question 4 An agent can invoke a payment API. The company wants to ensure that the agent can only perform approved operations and that high-risk operations require approval. Which approach is most appropriate? A. Give the agent administrator permissions B. Use AgentCore Policy and least-privilege tool permissions C. Use encryption at rest only D. Increase the model temperature **Answer: B. Use AgentCore Policy and least-privilege tool permissions** **Explanation:** AgentCore Policy can restrict agent actions and tool calls. High-risk operations should also use application authorization and approval workflows. --- ### Question 5 A company wants to access an AI service from private subnets without sending traffic over the public internet. Which solution should it consider? A. An interface VPC endpoint using AWS PrivateLink B. A public subnet with an internet gateway C. A NAT gateway only D. An S3 bucket ACL **Answer: A. An interface VPC endpoint using AWS PrivateLink** **Explanation:** PrivateLink provides private connectivity to supported services through interface VPC endpoints. IAM and endpoint policies are still required. --- ### Question 6 A company needs to explain how customer data was collected, cleaned, transformed, and used to build a model. Which concept addresses this requirement? A. Data lineage B. Temperature C. Tokenization D. Load balancing **Answer: A. Data lineage** **Explanation:** Data lineage records the origin, movement, and transformations of data throughout its lifecycle. --- ### Question 7 A RAG application retrieves documents from an internal knowledge base. A malicious document contains instructions telling the agent to send confidential information to an external email address. What is this an example of? A. Data compression B. Prompt injection C. Encryption at rest D. Model quantization **Answer: B. Prompt injection** **Explanation:** Untrusted content is attempting to influence the model or agent to disregard intended behavior and perform an unauthorized action. Mitigations include least-privilege tool access, policy controls, input treatment as untrusted data, output validation, and approval for sensitive actions. --- ### Question 8 A company wants a model to answer questions using the latest approved internal policies and provide references to the source documents. Which approach is most appropriate? A. Fine-tune the model once and never update it B. Use RAG with an approved document repository and citations C. Increase the model temperature D. Remove all access controls from the knowledge base **Answer: B. Use RAG with an approved document repository and citations** **Explanation:** RAG retrieves current information from approved sources and can provide citations. Access controls and source validation are still required. --- ### Question 9 A model produces a confident answer, but the answer is not supported by any retrieved document. What should the application do? A. Accept the answer because the confidence is high B. Validate the answer against retrieved sources and reject or escalate unsupported claims C. Disable encryption D. Give the model more permissions **Answer: B. Validate the answer against retrieved sources and reject or escalate unsupported claims** **Explanation:** Confidence scores are not proof of correctness. Output validation and source support checks help detect hallucinations. --- ### Question 10 Which statement correctly describes AWS CloudTrail in an AI application? A. CloudTrail automatically validates every model response B. CloudTrail records AWS API activity, but application-level prompt and response logging may require additional implementation C. CloudTrail discovers PII in S3 D. CloudTrail replaces IAM policies **Answer: B. CloudTrail records AWS API activity, but application-level prompt and response logging may require additional implementation** **Explanation:** CloudTrail provides an audit trail for AWS API calls. AI applications may need separate, carefully controlled logs for prompts, responses, retrieval events, and tool calls.

Final Exam Takeaways

  • Use IAM roles and least privilege; avoid long-term credentials in code.
  • Use KMS for controlled encryption at rest and TLS for encryption in transit.
  • Use Macie to discover sensitive data in S3.
  • Use PrivateLink for private connectivity to supported services.
  • Apply the shared responsibility model to determine what AWS and the customer must secure.
  • Use AgentCore Identity for agent authentication and credential access.
  • Use AgentCore Policy to restrict agent actions and tool calls.
  • Use Bedrock Guardrails for model input and output safety controls.
  • Maintain data lineage, catalogs, citations, and model documentation.
  • Protect data through classification, access control, minimization, integrity checks, and privacy-enhancing practices.
  • Treat retrieved documents, user prompts, and tool results as potentially untrusted.
  • Use RAG, citations, output validation, and confidence evaluation to reduce hallucinations.
  • Remember that no single service provides complete AI security. Layer IAM, network controls, encryption, monitoring, application validation, and governance.