Skip to content

Skill 1.1.1: Extract data from data sources

Question 1 - CloudTrail Logging for Model Invocation

A financial services company has deployed a fraud detection model using Amazon SageMaker with a real-time inference endpoint. During a security audit, auditors request evidence showing which IAM principal invoked the model endpoint, the timestamp of each invocation, and the source IP address of the caller.

The security team has already created a multi-Region CloudTrail trail but the audit team reports that no model invocation events appear in the logs. The existing trail was created with default settings.

Which action will resolve this issue and provide the required audit evidence?

A) Configure CloudTrail data events for the SageMaker endpoint resource type to capture InvokeEndpoint API calls.

B) Enable AWS Config rules for the SageMaker endpoint to record configuration changes and invocation timestamps.

C) Create an Amazon EventBridge rule that listens for SageMaker InvokeEndpoint events and forwards them to CloudTrail.

D) Assign an IAM policy to the SageMaker endpoint that grants cloudtrail:PutEventSelectors permissions.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Option Analysis

  • A is Correct: Amazon SageMaker InvokeEndpoint is a data-plane operation. CloudTrail trails record management events by default, but data events must be explicitly configured via the trail's event selectors. Configuring data events for the SageMaker endpoint resource type captures InvokeEndpoint calls with principal, timestamp, and source IP.

Distractor Analysis

  • B is Incorrect: AWS Config records resource configuration states and changes over time (e.g., endpoint instance type changes), not individual API invocation requests or caller identity for runtime inference calls.
  • C is Incorrect: EventBridge rules respond to events and can trigger actions, but they do not bypass CloudTrail's requirement to enable data events. CloudTrail is the authoritative source for API activity recording.
  • D is Incorrect: cloudtrail:PutEventSelectors is an IAM permission for modifying trail configurations, not something assigned to a SageMaker endpoint. The issue is that data events were never enabled on the trail itself.

Key Takeaway: CloudTrail data events (data-plane operations like SageMaker InvokeEndpoint) are not logged by default and must be explicitly configured on the trail.

Question 2 - Bedrock Access Credential Selection

A healthcare technology startup has built a patient triage assistant using Amazon Bedrock and a foundation model. The team currently uses a long-term API key stored in a configuration file that is committed to their GitHub repository for local development.

The team is now preparing the application for production. The Chief Information Security Officer (CISO) mandates that production workloads use temporary credentials with automatic rotation and that no long-lived credentials exist anywhere in the codebase, container images, or environment files.

Which approach should the team implement to meet the CISO's requirements?

A) Develop the application to assume an IAM role via web identity federation, obtaining temporary AWS STS credentials to invoke the foundation model through Amazon Bedrock.

B) Migrate the long-term API key from the configuration file to AWS Secrets Manager and retrieve it at runtime using the AWS SDK.

C) Generate a short-term API key using the AWS Management Console each day and store it in an environment variable on the EC2 instances.

D) Configure an API Gateway endpoint with an API key that proxies requests to Amazon Bedrock, storing the secret in the API Gateway console.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Option Analysis

  • A is Correct: Production applications on AWS should use IAM roles and temporary credentials from AWS STS. With web identity federation (e.g., Cognito, OIDC) or EC2 instance profiles/ECS task roles, the application assumes a role and receives short-lived credentials that rotate automatically. This eliminates long-lived credential storage entirely.

Distractor Analysis

  • B is Incorrect: While AWS Secrets Manager is better than embedding credentials in code, it still stores a long-lived API key. The CISO explicitly requires temporary credentials with automatic rotation, which Secrets Manager static secrets do not entirely satisfy without an IAM role being involved.
  • C is Incorrect: Generating daily short-term keys manually introduces operational overhead and human error. It also still relies on a human identity and does not follow production best practices for workload identity management.
  • D is Incorrect: API Gateway API keys are static credentials stored in the service and do not represent IAM role-based temporary credentials. This adds an unnecessary service layer without solving the credential rotation problem.

Key Takeaway: Production AI workloads on AWS should always assume IAM roles with temporary AWS STS credentials, never use long-term API keys or manually generated keys.

Question 3 - VPC Interface Endpoint for Bedrock

A company is building an enterprise AI assistant using Amazon Bedrock in a VPC with private subnets. The security policy requires that all traffic to AWS services from within the VPC stay on the AWS private network, and the private subnets have no internet gateway or NAT gateway attached.

The application deployed in an Amazon ECS cluster attempts to call the Bedrock API but the request fails with a network error. The IAM role attached to the ECS task has the correct bedrock:InvokeModel permissions, and the security group's inbound rules are correctly locked down.

Which change will resolve the connectivity issue while maintaining compliance with the security policy?

A) Add an AWS PrivateLink interface VPC endpoint for Amazon Bedrock in the private subnet and update the application to use that endpoint.

B) Attach a NAT gateway to the private subnet so outbound traffic can reach the Bedrock public API endpoint.

C) Enable internet access in the ECS task's security group by adding an outbound rule allowing all traffic.

D) Create an Amazon CloudFront distribution in front of the Bedrock API endpoint to route traffic through the AWS edge network.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Option Analysis

  • A is Correct: AWS PrivateLink interface VPC endpoints create a private network path from a VPC to AWS services like Amazon Bedrock. The traffic stays entirely on the AWS network backbone, complying with the "no internet" security policy, and resolves the connectivity failure.

Distractor Analysis

  • B is Incorrect: A NAT gateway routes traffic through the public internet, which directly violates the security policy requiring all traffic to stay on the private AWS network.
  • C is Incorrect: Security group rules control traffic filtering, not routing. The private subnet itself has no route to the internet regardless of security group rules. This option also violates the principle of least privilege by allowing all traffic.
  • D is Incorrect: CloudFront distributions are designed for content delivery and do not provide private network connectivity to AWS APIs from a VPC. Bedrock does not support CloudFront in this manner.

Key Takeaway: Use VPC interface endpoints (AWS PrivateLink) for private network access to AWS AI/ML services from VPCs without internet access.

Question 4 - AWS Config for Compliance Monitoring

An organization that operates in a regulated industry must demonstrate compliance with internal security policies for their Amazon SageMaker environment. The compliance team requires continuous monitoring of SageMaker endpoint configurations to detect if any endpoint's data capture settings, encryption configuration, or network isolation settings deviate from approved baselines.

Which AWS service should the team use to set up automated evaluation with immediate alerts when a SageMaker endpoint configuration drifts from the approved standards?

A) AWS Config with managed and custom rules to continuously evaluate SageMaker endpoint configurations, paired with Amazon SNS for alerting.

B) AWS CloudTrail with data events enabled to monitor API calls that modify endpoint configurations, paired with an EventBridge rule.

C) Amazon Inspector to scan SageMaker endpoints for configuration vulnerabilities and report findings to Security Hub.

D) Amazon Bedrock Guardrails with automated reasoning checks to validate endpoint configuration compliance.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Option Analysis

  • A is Correct: AWS Config is purpose-built for continuous configuration monitoring and compliance evaluation. It records resource configuration states and supports both AWS-managed and custom rules to detect drift from defined baselines. Integration with SNS enables real-time alerts when non-compliant configurations are detected.

Distractor Analysis

  • B is Incorrect: CloudTrail records API activity (who did what and when) but does not evaluate configurations against compliance baselines. It tells you when a change occurred, not whether the resulting configuration is compliant.
  • C is Incorrect: Amazon Inspector scans for software vulnerabilities (CVEs) in EC2 instances, container images, and Lambda functions. It does not evaluate service configuration compliance like endpoint encryption settings or network isolation.
  • D is Incorrect: Amazon Bedrock Guardrails safety policies filter prompts and responses for content and sensitive information in foundation model conversations. It has no function for monitoring infrastructure configuration compliance.

Key Takeaway: AWS Config is the service for continuous resource configuration monitoring and compliance evaluation, while CloudTrail records activity and Inspector scans for vulnerabilities.

Question 5 - CodeGuru Security for CI/CD Pipeline

A machine learning engineering team operates a CI/CD pipeline that builds and deploys a custom Python inference application to Amazon SageMaker endpoints. The pipeline currently includes unit tests and container image scanning with Amazon Inspector.

During a recent security review, an engineer discovered that a hardcoded AWS access key had been committed to the application's source code repository and deployed to production. The security team wants to prevent this from happening again by adding a security check to the pipeline that scans source code for hardcoded credentials and insecure patterns before deployment.

Which AWS service should be integrated into the CI/CD pipeline to satisfy this requirement?

A) Amazon CodeGuru Security as a pre-build stage in the pipeline to perform static analysis of the application code for hardcoded credentials and security vulnerabilities.

B) AWS Config rules that evaluate SageMaker endpoint configurations for hardcoded credentials.

C) Amazon Inspector runtime scanning to detect hardcoded credentials in the deployed ECS task.

D) AWS Secrets Manager automatic rotation to detect and rotate hardcoded credentials in the source code.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Option Analysis

  • A is Correct: Amazon CodeGuru Security is a static analysis tool that scans application source code for security vulnerabilities, including hardcoded credentials, insecure patterns, and policy violations. Integrating it early in the CI/CD pipeline (pre-build or build stage) prevents vulnerable code from progressing to deployment.

Distractor Analysis

  • B is Incorrect: AWS Config evaluates deployed resource configurations (e.g., endpoint encryption, network isolation) and cannot detect hardcoded credentials in application source code sitting in a repository.
  • C is Incorrect: Amazon Inspector scans for software package vulnerabilities (CVEs) and unintended network exposure in deployed workloads. It does not perform source code static analysis for secrets.
  • D is Incorrect: AWS Secrets Manager stores and rotates secrets that were properly registered with it. It cannot detect hardcoded credentials in source code repositories or extract them automatically.

Key Takeaway: Use Amazon CodeGuru Security for source-level static analysis to catch hardcoded credentials and insecure patterns before code reaches production.

Question 6 - Bedrock Guardrails Sensitive Information

A retail company built a customer support chatbot using Amazon Bedrock and a large language model. The application processes customer messages containing order confirmation numbers, credit card numbers, and email addresses.

A data protection policy requires that personally identifiable information (PII) in model responses must be masked or blocked. The company also wants to log the sanitized responses for quality assurance (QA) purposes.

Which solution should the team implement to protect sensitive data in both the live responses and the QA logs?

A) Configure Amazon Bedrock Guardrails with a sensitive information filter that masks PII in model responses, and ensure the QA logging pipeline records the masked responses.

B) Enable client-side encryption on the S3 bucket storing the QA logs and disable CloudTrail data events for the Bedrock endpoint.

C) Use an IAM policy that denies the bedrock:InvokeModelWithResponseStream permission to the QA team accessing the logs.

D) Implement an AWS Lambda function that strips PII from the QA logs after they are written to Amazon CloudWatch Logs.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Option Analysis

  • A is Correct: Amazon Bedrock Guardrails sensitive information filters detect, mask, or block PII (like credit card numbers, email addresses, order numbers) in both prompts and responses. By masking at the guardrail level before the response reaches the application, subsequent QA logs capture only the sanitized output.

Distractor Analysis

  • B is Incorrect: Client-side encryption of S3 logs protects the logs at rest but does not prevent PII from being written in cleartext within the log files themselves. The data remains sensitive in those logs.
  • C is Incorrect: IAM permissions control who can access the logs but cannot sanitize the content. The PII would still be present in the logs; the QA team simply wouldn't be able to access them.
  • D is Incorrect: Stripping PII after it has been written to logs means the sensitive data existed in the logging system for some period, creating a compliance gap. A better approach is to mask at the source (guardrails) rather than post-process logs.

Key Takeaway: Apply sensitive information filters at the model interaction boundary (Bedrock Guardrails) so that all downstream consumers, including QA logs, receive sanitized data.

Question 7 - Security Group Configuration for SageMaker Endpoint

An MLOps engineer is deploying a recommendation model to an Amazon SageMaker real-time endpoint in a VPC. The endpoint should only be accessible from an Amazon EC2-based web application that calls the endpoint from within the same VPC, and no other traffic should be permitted.

During penetration testing, a security auditor finds that the SageMaker endpoint responds to API calls from an external IP address outside the VPC, and the endpoint has an attached security group with an inbound rule that allows traffic from 0.0.0.0/0 on port 443.

Which configuration should the MLOps engineer apply to ensure only the web application can call the SageMaker endpoint, with least-privilege network access?

A) Modify the security group's inbound rule to allow traffic only from the web application's security group or private IP range on the inference port.

B) Disable the SageMaker endpoint's public access option and enable VPC private endpoints for the endpoint.

C) Create a new IAM policy that denies sagemaker:InvokeEndpoint for any principal whose source IP is not the web application's IP.

D) Encrypt the endpoint's traffic with an AWS KMS customer managed key to prevent unauthorized IPs from accessing it.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Option Analysis

  • A is Correct: Security groups act as virtual firewalls. Limiting the inbound rule to the web application's security group (recommended) or private IP address (CIDR) restricts endpoint access to only that source, implementing least-privilege network access.

Distractor Analysis

  • B is Incorrect: SageMaker real-time endpoints do not have a separate "public access" toggle in the manner described. The VPC and security group configuration controls access. VPC interface endpoints are already implied in a VPC setup for the endpoint; the issue is the misconfigured security group rule.
  • C is Incorrect: IAM policies authorize actions based on identity, not network source IP. Network-level restrictions belong in security groups or network ACLs, not IAM. IAM cannot filter by source IP in a standard IAM policy.
  • D is Incorrect: KMS encryption protects data at rest and does not control network traffic. Encryption does not authenticate callers or block requests from unauthorized sources.

Key Takeaway: Security groups control network-level access to SageMaker endpoints. Use security group-to-security group references for least-privilege inbound rules.

Question 8 - Troubleshooting Access Denied

A data scientist is training an XGBoost model using Amazon SageMaker and needs to read training data from an Amazon S3 bucket. The S3 bucket has the following bucket policy that explicitly denies all traffic unless the request comes from a VPC endpoint:

{
  "Effect": "Deny",
  "Principal": "*",
  "Action": "s3:GetObject",
  "Resource": "arn:aws:s3:::ml-training-data/*",
  "Condition": {
    "StringNotEquals": {
      "aws:sourceVpce": "vpce-12345abcde"
    }
  }
}

The SageMaker training job's IAM role has the necessary s3:GetObject permissions, but the training job fails with an AccessDenied error when trying to read data.

What is MOST LIKELY the cause, and which troubleshooting step will correctly diagnose the issue?

A) The SageMaker training job is not running in the VPC associated with vpce-12345abcde, so the bucket policy's aws:sourceVpce condition evaluation fails. Check the training job's VPC configuration using the SageMaker console or DescribeTrainingJob.

B) The IAM role attached to the training job lacks the s3:ListBucket permission, which is required before s3:GetObject can succeed. Review the role's IAM policy.

C) The bucket policy's Principal element is set to "*" and does not include the SageMaker service principal. Update it to include sagemaker.amazonaws.com.

D) The S3 bucket has versioning enabled, and the training job is trying to access a deleted version of the training data. Check the bucket's versioning configuration.

Click to reveal Answer & Explanation

Correct Answer: A

Correct Option Analysis

  • A is Correct: The bucket policy denies s3:GetObject unless the request originates from the VPC endpoint vpce-12345abcde. If the SageMaker training job does not have a VPC configuration pointing to that specific VPC, the condition aws:sourceVpce does not match, triggering the deny. Checking the training job's VPC configuration validates this.

Distractor Analysis

  • B is Incorrect: s3:ListBucket is not a prerequisite for s3:GetObject when the exact object key is known. SageMaker training jobs read data directly; the error is AccessDenied, and the scenario instructs that the IAM role already has s3:GetObject.
  • C is Incorrect: The Principal: "*" in the deny policy means it applies to all principals, which is correct for an explicit deny rule. Adding the SageMaker service principal would not override the deny condition.
  • D is Incorrect: Versioning affects which version of an object is returned but does not cause AccessDenied errors on valid object keys. SageMaker training jobs access the current version by default.

Key Takeaway: AccessDenied errors from bucket policy conditions often relate to network context (source VPC endpoint, source IP) rather than IAM permissions. Verify the VPC configuration in such cases.

Question 9 - Amazon Inspector for Container Security

An AWS machine learning team is building a custom training container for a PyTorch model. The container image is pushed to an Amazon ECR repository from their CI/CD pipeline. The pipeline's security gate currently fails the build if CodeGuru Security detects vulnerabilities in the application code.

The team recently discovered that a training job was deployed with an outdated version of libcurl that contained a known CVE vulnerability, even though CodeGuru Security reported no findings. The team wants continuous scanning of the container image for vulnerable OS and Python packages after each push to ECR.

Which TWO actions should the team implement? (Select TWO)

A) Enable Amazon Inspector for ECR scanning on the repository with continuous scanning mode to automatically detect CVEs in the container image packages.

B) Enable the built-in Amazon ECR basic image scanning feature to scan for CVEs whenever a new image is pushed.

C) Add Amazon CodeGuru Security as the sole scanner in the pipeline since it already covers all types of vulnerabilities.

D) Route Amazon Inspector findings to AWS Security Hub for centralized security alerting and remediation workflows.

E) Encrypt the container images at rest in the ECR repository using AES-256.

Click to reveal Answer & Explanation

Correct Answer: A and D

Correct Options Analysis

  • A is Correct: Amazon Inspector integrated with ECR provides continuous scanning of container images for known software package vulnerabilities (CVEs) in the OS layers and dependencies. It automatically re-scans when packages are updated or new vulnerabilities are discovered.
  • D is Correct: Integrating Inspector findings with AWS Security Hub centralizes security alerts and enables automated remediation workflows, aligning with security best practices for a comprehensive security posture.

Distractor Analysis

  • B is Incorrect: ECR basic scanning only performs a one-time scan on image push, not continuous scanning. The team requires continuous evaluation after pushes, making Amazon Inspector the appropriate choice.
  • C is Incorrect: CodeGuru Security performs static source code analysis, not container image package scanning. The two tools answer different questions (code vulnerabilities vs. assembled image package vulnerabilities).
  • E is Incorrect: Encryption at rest protects image confidentiality but does not address vulnerability scanning requirements for package CVEs.

Key Takeaway: Amazon Inspector provides continuous container image scanning for CVEs in ECR, while CodeGuru Security performs source code static analysis. Both are needed in a secure CI/CD pipeline.

Question 10 - CloudTrail Investigation for Security Incident

A security operations team is investigating a potential security incident involving an Amazon Bedrock application that may have been accessed by an unauthorized party. The team needs to answer the following questions:

  1. Which IAM principal invoked the InvokeModel API?
  2. When did the invocation occur?
  3. From which source IP address did the request originate?
  4. What was the content of the model input and output?

The team has an existing CloudTrail trail with management events enabled. They also have Amazon CloudWatch Logs configured for the application's Lambda function that invokes Bedrock.

Which TWO configurations will provide the complete forensic evidence required? (Select TWO)

A) Enable CloudTrail data events for Amazon Bedrock InvokeModel to capture invocation metadata including principal ARN, timestamp, and source IP.

B) Enable Amazon Bedrock model invocation logging with request/response data capture to an S3 bucket or CloudWatch Logs for input/output content.

C) Configure AWS Config to record Bedrock invocation events including the full request payload.

D) Enable Amazon Inspector to monitor Bedrock API calls and capture invocation content.

E) Configure an EventBridge rule to intercept Bedrock API calls before they reach the endpoint, logging the payload.

Click to reveal Answer & Explanation

Correct Answer: A and B

Correct Options Analysis

  • A is Correct: CloudTrail data events for Bedrock InvokeModel capture the API invocation metadata: which principal made the call, the timestamp, and the source IP address. Data events must be enabled explicitly for the Bedrock service.
  • B is Correct: Amazon Bedrock supports model invocation logging, which captures request/response data (input prompts and generated outputs) to an S3 bucket or CloudWatch Logs. This provides the content-level forensic evidence required.

Distractor Analysis

  • C is Incorrect: AWS Config records resource configuration state and changes, not API invocation activity or request payloads.
  • D is Incorrect: Amazon Inspector scans workloads for software vulnerabilities and network exposure. It does not capture API call metadata or content payloads.
  • E is Incorrect: EventBridge responds to events but cannot intercept in-flight API calls to Bedrock. It also cannot capture the raw request/response payload in the manner described.

Key Takeaway: For comprehensive security forensics on AI workloads, combine CloudTrail data events (metadata: who, when, where) with Bedrock invocation logging (content: what was said) to get complete evidence.