Skip to content

Skill 1.1.1: Extract data from data sources

Question 1 - CI/CD Pipeline Security Scanning

A financial services company is deploying a machine learning model for fraud detection using Amazon SageMaker. Their CI/CD pipeline builds a custom Python inference container, packages it as a Docker image, and deploys it to a SageMaker endpoint.

Compliance requires that the pipeline blocks deployment if either the application source code contains hardcoded credentials or the built container image includes packages with known CVEs. The security team wants minimal additional operational overhead.

Which TWO services should the company integrate into their pipeline? (Select TWO)

A) Use Amazon CodeGuru Security to perform static code analysis on the application source code before building the container image. B) Use AWS Config to scan the container image for software vulnerabilities before deployment. C) Use Amazon Inspector to scan the Docker image stored in Amazon Elastic Container Registry (ECR) for vulnerabilities. D) Use Amazon Bedrock Guardrails to inspect the container image for hardcoded credentials. E) Use Amazon CloudWatch Logs Insights to detect known CVEs in the application dependencies.

Click to reveal Answer & Explanation

Correct Answers: A and C

Correct Options Analysis

  • A is Correct: Amazon CodeGuru Security is a static application security testing (SAST) tool that scans source code for security policy violations, including hardcoded credentials, SQL injection, and other code-level vulnerabilities. It is designed for CI/CD pipeline integration as a gate.
  • C is Correct: Amazon Inspector continuously scans container images stored in Amazon ECR for software vulnerabilities (CVEs) by comparing the packaged OS and language dependencies against vulnerability databases. It handles image-level scanning without additional infrastructure.

Distractor Analysis

  • B is Incorrect: AWS Config records resource configurations and evaluates them against compliance rules; it does not perform software vulnerability scanning of container images or detect CVEs.
  • D is Incorrect: Amazon Bedrock Guardrails is a runtime content filtering and safeguarding service for prompts and AI outputs—it has no capability to inspect container images or detect hardcoded credentials in code.
  • E is Incorrect: Amazon CloudWatch Logs Insights is a log query tool for analyzing operational log data, not a vulnerability scanner for application dependencies.

Key Takeaway: Static code analysis (CodeGuru) catches credentials in what was written; image scanning (Inspector) catches vulnerabilities in what was assembled—both are required for a secure ML delivery pipeline.

Question 2 - Least Privilege for ML Pipeline Security

An ML engineering team at a healthcare company is building a training pipeline that reads data from Amazon S3, trains models using Amazon SageMaker, and writes model artifacts back to a versioned S3 bucket.

The compliance team requires strict least-privilege access. The SageMaker training job currently fails with an AccessDenied error when trying to upload the trained model artifact, but the training job can read the training data successfully.

What is the MOST SECURE and correct fix?

A) Modify the SageMaker training job's IAM role to include s3:PutObject permission scoped only to the model artifact output S3 bucket. B) Attach the AmazonSageMakerFullAccess managed policy to the training job's IAM role to resolve all permission issues. C) Add s3:* wildcard permission to the training role across all S3 buckets to accommodate future requirements. D) Generate a static IAM user AccessKey and embed it in the training script for artifact uploads.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

  • A is Correct: The error is a specific authorization failure. Adding s3:PutObject permission scoped to the exact destination bucket resolves the issue while maintaining least privilege. The error message identifies the exact denied operation and resource, which should guide the fix.

Distractor Analysis

  • B is Incorrect: The AmazonSageMakerFullAccess managed policy grants broad permissions across all SageMaker resources, violating the principle of least privilege and exposing the environment to unnecessary risk.
  • C is Incorrect: Using s3:* wildcard across all buckets grants excessive permissions far beyond what is required, which would be flagged in a security audit and violates the least-privilege mandate.
  • D is Incorrect: Embedding static IAM user credentials in code is a critical security risk—credentials can leak through version control, are difficult to rotate, and should never be used for production workloads. A training job role is the correct workload identity.

Key Takeaway: Read the exact AccessDenied error—it identifies the operation and resource that was refused—then grant only that specific permission rather than widening the policy broadly.

Question 3 - Network Isolation for Private Inference

A retail company is hosting a product recommendation model on Amazon SageMaker for call-center employees. The SageMaker endpoint must be accessible only from within the corporate VPC, with no inbound access from the public internet. The endpoint also needs to call an external vendor API for real-time inventory data.

Which architecture BEST satisfies the network isolation requirements?

A) Deploy the endpoint in a public subnet with a security group that allows inbound traffic from the corporate VPC CIDR block, and attach a NAT Gateway for outbound traffic to the vendor API. B) Deploy the endpoint in a private subnet with a security group that allows inbound traffic from the corporate VPC CIDR block, and route the vendor API call through AWS PrivateLink or the corporate network egress. C) Deploy the endpoint in a public subnet with an open security group for simplicity, and rely on IAM policies to limit access to the endpoint. D) Deploy the endpoint in a private subnet and disable all outbound security group rules, including access to the vendor API, to ensure complete isolation.

Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

  • B is Correct: A private subnet keeps the endpoint off the public internet by default. A well-scoped security group restricting inbound access to the corporate VPC ensures only internal callers can reach it. Outbound traffic is carefully managed to allow the vendor API call through corporate egress—preserving full isolation while maintaining necessary external connectivity.

Distractor Analysis

  • A is Incorrect: Deploying in a public subnet exposes the endpoint to both the internet and the AWS public network, even if security group restrictions are applied. Any compromise of the host would expose the endpoint. For strict isolation, a private subnet is required.
  • C is Incorrect: An open security group combined with a public subnet creates a direct path from the internet to the endpoint. IAM policies control permissions, not network reachability—these are separate, complementary controls.
  • D is Incorrect: Disabling all outbound traffic blindly would break the required vendor API integration. Security isolation must satisfy both no public inbound and necessary outbound connectivity.

Key Takeaway: IAM and network isolation are separate controls: private subnets and security groups restrict network reachability; IAM policies restrict who may invoke the endpoint.

Question 4 - Model Invocation Logging for Compliance

An insurance company runs a claims-processing AI assistant that invokes Amazon Bedrock foundation models. The compliance team requires a complete audit trail of every model invocation, including the prompt text and generated response for up to 7 years for incident investigations.

The existing CloudTrail trail was configured with default settings. What configuration change is MOST appropriate to satisfy this requirement?

A) Enable CloudTrail Data Events for Bedrock APIs (InvokeModel, Converse) on the existing trail, and store the resulting logs in an S3 bucket with a 7-year lifecycle policy. B) Enable AWS Config recording for the Bedrock model resource to capture all model prompts and completions. C) Rely on Amazon Inspector to capture model invocation traffic and write it to CloudWatch Logs for at-rest storage. D) Configure Amazon Bedrock Guardrails to automatically log all model conversations.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

  • A is Correct: CloudTrail records API activity, but model invocation calls (InvokeModel, Converse) are classified as data events, which must be explicitly configured. Once enabled, the trail captures the API request (including the prompt) and response details, which can be stored in an S3 bucket with lifecycle rules for long-term retention.

Distractor Analysis

  • B is Incorrect: AWS Config evaluates resource configurations over time (for example, endpoint encryption settings or access policies); it does not record individual model invocation requests or response payloads.
  • C is Incorrect: Amazon Inspector scans resources including EC2 instances, container images, and Lambda functions for vulnerabilities; it has no mechanism for capturing runtime model invocation traffic or conversation logs.
  • D is Incorrect: Amazon Bedrock Guardrails applies content filters and safety policies to block or mask prompts and responses—it does not provide an audit logging mechanism for compliance or incident investigations.

Key Takeaway: CloudTrail data events are the only mechanism for recording model invocation traffic at the API level; they must be explicitly configured on the trail.

Question 5 - Image Vulnerability Scanning in MLOps Pipeline

A startup is using AWS CodePipeline with Amazon SageMaker to automate the build and deployment of a custom ML inference container. The pipeline stages include source code checkout, Docker image build, image push to Amazon ECR, and deployment to a SageMaker endpoint.

The security team wants to ensure that no image with known CVEs in either the base OS packages or the Python dependency packages can be deployed. Which approach ensures this with the least operational effort?

A) Enable Amazon Inspector scanning for the ECR repository where the Docker image is pushed, and add a pipeline gate that fails if any critical or high severity finding is present. B) Manually run vulnerability scanning scripts using trivy or anchore in a CodeBuild step every time the pipeline runs. C) Use Amazon CodeGuru Security to scan the built Docker image binary for vulnerabilities. D) Disable deployment and rely on the security team to perform periodic manual reviews of the ECR repository.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

  • A is Correct: Amazon Inspector provides automated, continuous vulnerability scanning of container images stored in Amazon ECR with no infrastructure to manage. It detects CVEs in both OS packages and application dependencies. A pipeline gate can use the Inspector findings API to block deployment of images with critical/High severity findings.

Distractor Analysis

  • B is Incorrect: While trivy/anchore are legitimate open-source tools, manually configuring and maintaining them in the pipeline introduces significant operational overhead and requires ongoing updates. Amazon Inspector provides the same capability as a fully managed service.
  • C is Incorrect: Amazon CodeGuru Security is a static analysis tool that scans application source code (or JARs) for hardcoded credentials and security anti-patterns—it does not scan container images or compiled binaries for known CVE-based package vulnerabilities.
  • D is Incorrect: Manual periodic reviews are insufficient for continuous security. An automated pipeline gate is required to block deployment automatically; relying on human reviews creates gaps and delays.

Key Takeaway: Amazon Inspector is the AWS-native, zero-overhead service for continuous vulnerability scanning of ECR container images—use a pipeline gate to enforce action on findings.

Question 6 - Credential Management for Foundation Model Access

A development team is testing a new generative AI feature that calls foundation models through Amazon Bedrock in a development account. An engineer creates a long-term API key through the Bedrock Console and stores it in a configuration file that is committed to the Git repository for convenience.

A security audit flags this as a violation. What is the BEST remediation for both development and long-term production use?

A) Use the engineer's IAM user permissions directly to invoke Bedrock, eliminating the need for any API key. B) Store the API key in AWS Secrets Manager, retrieve it at runtime using the application's IAM role, and rotate it regularly. C) Remove the key from Git, but keep it in the configuration file on each developer's local machine. D) Grant the Bedrock model full public access so that no authentication is required.

Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

  • B is Correct: AWS Secrets Manager securely stores and rotates secrets, allowing the application to retrieve the credential at runtime using its IAM role. This eliminates hardcoded keys from code and version control while reducing manual rotation overhead.

Distractor Analysis

  • A is Incorrect: Using IAM user permissions directly for application calls violates the principle of separation between human and workload identities. Production workloads should use IAM roles with temporary credentials, not permanent IAM user keys.
  • C is Incorrect: Keeping credentials locally does not address the underlying security issue—the key still exists in plaintext on disk and can be leaked through backups, device loss, or if another developer accidentally commits it.
  • D is Incorrect: Public access without authentication would make the model accessible to anyone on the internet, creating severe security and cost risks (unauthorized access and invocation fees).

Key Takeaway: Production access to foundation models should use IAM roles with temporary credentials; where a static secret is unavoidable, use Secrets Manager with automatic rotation.

Question 7 - Network Isolation for SageMaker Training

A manufacturing company runs a networked machine learning training pipeline that trains a defect-detection model on sensitive production data. The training job must run in complete isolation, with no internet access, but still needs to read training data from Amazon S3.

The training job fails immediately with a network error when trying to read from S3. The network configuration includes a private subnet with no route to the internet. Which solution resolves the issue while maintaining complete isolation?

A) Add a NAT Gateway to the subnet's route table so the training job can access S3 over the public internet. B) Create a Gateway VPC Endpoint for Amazon S3 so the training job can reach the storage service over the private AWS network. C) Add an Interface VPC Endpoint for Amazon S3 and update the security group's outbound rules to allow traffic to the endpoint. D) Move the training data to the local filesystem of the training instance rather than reading from S3.

Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

  • B is Correct: A Gateway VPC Endpoint allows resources in a private subnet to access Amazon S3 without an internet gateway or NAT Gateway. Traffic flows entirely over the AWS private network, preserving complete isolation while resolving the connectivity failure.

Distractor Analysis

  • A is Incorrect: A NAT Gateway provides outbound internet access, which violates the no-internet isolation requirement. The security architecture specified absolute isolation from the public internet.
  • C is Incorrect: While an Interface VPC Endpoint (PrivateLink) also provides private access to S3, it requires DNS configuration and uses Elastic Network Interfaces. The Gateway Endpoint is the simpler and more cost-effective option for S3 specifically.
  • D is Incorrect: Moving training data from S3 to local instance storage replicates data unnecessarily, is not scalable, and does not solve the underlying network connectivity problem for other required AWS service APIs.

Key Takeaway: Use Gateway VPC Endpoints for S3 access from private subnets without internet access—traffic stays entirely on the AWS private network.

Question 8 - Safeguards for Sensitive Data in AI Output

A bank is deploying an AI-powered customer service assistant that uses Amazon Bedrock to help customers check account balances and recent transactions. Compliance requires that the assistant must never display the customer's full account number or government ID in responses, and these values must be masked in logs as well.

Which configuration BEST satisfies this requirement?

A) Configure a sensitive information filter in Amazon Bedrock Guardrails that masks the identified PII fields in both prompts and outputs, and ensure the logging mechanism also applies masking. B) Set up Amazon CloudWatch Alarms to notify the security team whenever sensitive data appears in logs, and manually redact it after the fact. C) Use Amazon Inspector to scan model outputs for personally identifiable information and block any matching responses. D) Use a private VPC connection so that model responses cannot contain sensitive information.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

  • A is Correct: Amazon Bedrock Guardrails sensitive information filters are specifically designed to detect and mask or block PII (such as account numbers, government IDs, phone numbers) in both user inputs and model outputs. Applying the guardrail ensures these values never reach the user unmasked. For logs, a consistent masking policy should be applied to prevent any unmasked values from being stored.

Distractor Analysis

  • B is Incorrect: Alarm-based notification with manual redaction is a reactive approach. Sensitive information could be exposed to the user before the team intervenes, and manual redaction is labor-intensive and prone to errors.
  • C is Incorrect: Amazon Inspector scans code, container images, and infrastructure for software vulnerabilities—it has no capability to inspect or filter model output content or detect PII in AI responses.
  • D is Incorrect: A VPC private network connection addresses network isolation but has no effect on the content of model responses. Network security and content safety are separate controls.

Key Takeaway: For sensitive data protection in AI outputs, use Amazon Bedrock Guardrails sensitive information filters to block or mask PII before it reaches the user; ensure downstream logging applies the same masking policy.

Question 9 - CI/CD Pipeline Security Best Practices

An MLOps team is designing a CI/CD pipeline for a new SageMaker inference endpoint. The pipeline will build a custom container from Python source code, push it to Amazon ECR, and deploy to an endpoint in a private VPC.

The security architect is reviewing the pipeline and wants to ensure defense in depth across the entire delivery chain. Which combination of security controls should be applied? (Select THREE)

A) Run Amazon CodeGuru Security static analysis on the Python source code before image build. B) Enable Amazon Inspector scanning on the ECR repository holding the built images. C) Use AWS KMS to encrypt the model artifacts in S3 and the ECR image layers at rest. D) Configure an Amazon Bedrock Guardrail to evaluate the Dockerfile for insecure build instructions. E) Store training data in a public S3 bucket to simplify access by the pipeline.

Click to reveal Answer & Explanation

Correct Answers: A, B, and C

Correct Options Analysis

  • A is Correct: Amazon CodeGuru Security scans source code for vulnerabilities, hardcoded secrets, and security anti-patterns. This is the first layer of defense—catching issues before the image is even built.
  • B is Correct: Amazon Inspector continuously scans the ECR repository for CVEs in OS packages and Python dependencies. This is the second layer—catching vulnerabilities in the assembled image.
  • C is Correct: KMS encryption ensures the model artifacts and image layers are protected at rest, adding the third layer of defense in depth across the pipeline.

Distractor Analysis

  • D is Incorrect: Amazon Bedrock Guardrails is a runtime content filtering service for foundation model prompts and outputs—it has no capability to inspect Dockerfiles or evaluate build instructions.
  • E is Incorrect: Storing training data in a public S3 bucket is a severe security risk. Training data should be in private buckets with encryption enabled and access restricted to the pipeline's IAM role only.

Key Takeaway: Defense in depth for ML pipelines includes code scanning (CodeGuru), image scanning (Inspector), and data encryption (KMS)—each layer catches a different class of risk.

Question 10 - Access Control for Model Artifacts

A company maintains a repository of pre-trained model artifacts in Amazon S3 for use across multiple teams. The data science team should be able to read the model artifacts, but only the MLOps team should be able to update or delete them. A new data scientist reports receiving a 403 error when trying to download a model file.

What is the MOST SECURE way to resolve this?

A) Grant the data scientist's IAM role s3:GetObject permission scoped to the specific prefix containing the model artifacts they need to work with. B) Grant the data scientist s3:* permissions on the bucket to ensure they can read and download all necessary files. C) Share the MLOps team's IAM credentials with the data scientist so they can use the existing role. D) Move the model artifacts to a public S3 bucket and share the URL with the data scientist.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

  • A is Correct: The least-privilege fix is to grant the specific s3:GetObject permission on the exact object prefix the data scientist needs. This resolves the access-denied error while ensuring the data scientist cannot modify, delete, or access unrelated files.

Distractor Analysis

  • B is Incorrect: Granting s3:* on the entire bucket violates least privilege. The data scientist would gain the ability to modify, delete, and overwrite model artifacts, which is the responsibility of the MLOps team only.
  • C is Incorrect: Sharing the MLOps team's credentials is a severe security risk. It breaks attribution, bypasses the principle of least privilege, and makes auditing impossible. The data scientist should use their own IAM role with scoped permissions.
  • D is Incorrect: Making model artifacts public exposes proprietary ML models to the internet, which is a critical security and intellectual property risk.

Key Takeaway: Scope S3 permissions to specific prefixes and operations based on the role's actual responsibilities—avoid broad wildcard permissions that violate least privilege.