Skip to content

Skill 4.3.7: Identify and mitigate security risks and vulnerabilities in ML and AI systems

Question 1 - Securing SageMaker Training Jobs in Private Subnets

A financial services company is deploying an Amazon SageMaker training job that processes sensitive customer transaction data stored in Amazon S3. The security team mandates that the training job must not have any internet access, and all communication with AWS services must remain on the private AWS network.

The machine learning engineer launches the training job in a VPC with private subnets that have no NAT gateway or internet gateway. After launching, the training job fails with a network timeout when attempting to download the training dataset from S3.

Which solution resolves the failure while maintaining the strictest network isolation? (Select ONE)

  • A) Add an S3 Gateway Endpoint to the VPC and update the private subnet route tables to route S3 traffic through the endpoint.
  • B) Attach a NAT Gateway to the private subnet and add a route to 0.0.0.0/0 through the NAT Gateway.
  • C) Modify the security group attached to the training job to allow outbound traffic on port 443 to the S3 public endpoint.
  • D) Create an internet gateway in the VPC and attach it to the private subnet to allow temporary S3 access.
Click to reveal Answer & Explanation

Correct Answer: A

Correct Answer Analysis

A is Correct: An S3 Gateway Endpoint (also called a gateway VPC endpoint) provides private connectivity between a VPC and Amazon S3 without requiring internet access. It uses a route table entry rather than an elastic network interface, and all traffic stays on the AWS network backbone. This is the correct pattern for accessing S3 from private subnets without internet exposure.

Distractor Analysis

  • B is Incorrect: A NAT Gateway provides outbound internet access for private subnets, which directly violates the security mandate that the training job must not have any internet access. It also introduces additional operational cost and management overhead.
  • C is Incorrect: Security group rules control which traffic is allowed, but they do not provide the routing infrastructure needed to reach a public service endpoint from a subnet without internet connectivity. The underlying routing failure remains unchanged.
  • D is Incorrect: An internet gateway attaches to a VPC to provide internet connectivity, which explicitly violates the security constraint requiring no internet access for the training environment.

Key Takeaway: When isolating ML workloads in private subnets, use VPC endpoints (Gateway for S3, Interface for most other AWS services including SageMaker runtime and API) to maintain private connectivity without internet routes.

Question 2 - IAM Least Privilege for Model Inference

A startup is deploying a real-time inference endpoint using Amazon SageMaker. The application team consists of two groups: data scientists who need to update model artifacts and ML engineers who need to deploy endpoints. The security team requires strict least-privilege access following AWS best practices.

A junior engineer creates a single IAM role named sagemaker-full-role with the managed policy AmazonSageMakerFullAccess and assigns it to both groups. The security audit flags this as a violation.

Which combination of actions should replace the current configuration to satisfy least-privilege requirements? (Select TWO)

  • A) Create two separate IAM roles: data-scientist-role with permissions to call CreateModel and UpdateEndpoint, and ml-engineer-role with permissions only to call CreateEndpoint and InvokeEndpoint.
  • B) Create two separate IAM roles: data-scientist-role with permissions scoped to specific model and training actions on specific resources, and ml-engineer-role with permissions scoped to specific endpoint and deployment actions.
  • C) Continue using the single role but attach a permissions boundary to limit the actions each group can perform.
  • D) Create two separate IAM roles with resource-level restrictions so each group can only act on the specific S3 buckets, model names, and endpoint names relevant to their work.
  • E) Remove the managed policy and attach AdministratorAccess to both teams with a tagging policy for cost tracking.
Click to reveal Answer & Explanation

Correct Answers: B and D

Correct Options Analysis

  • B is Correct: Separate IAM roles with action-level scoping is the foundation of least privilege. Data scientists requiring model update permissions and ML engineers requiring endpoint deployment permissions should each have roles containing only the specific API actions their job requires.
  • D is Correct: Resource-level restrictions (specifying exact ARNs for S3 buckets, SageMaker models, endpoints, etc.) are a core best practice. The combination of separate roles with scoped actions AND scoped resources ensures each team can only affect their designated artifacts.

Distractor Analysis

  • A is Incorrect: While creating separate roles is correct, this option misrepresents the typical role division. It incorrectly assigns CreateModel and UpdateEndpoint to data scientists and CreateEndpoint to ML engineers without precise alignment to job functions. The specific mapping of which group gets which action must match organizational responsibility more carefully.
  • C is Incorrect: A permissions boundary would still require separate roles or policies to be meaningful. Continuing with a single shared role violates least-privilege because both groups retain access to all full-access permissions (even if boundary limits some actions, both groups have identical broad access).
  • E is Incorrect: AdministratorAccess grants unrestricted permissions across the entire AWS account, which is the opposite of least-privilege and a severe security violation.

Key Takeaway: Least privilege requires both action-level scoping (specific API operations) AND resource-level scoping (specific ARNs), with separate roles for different job functions.

Question 3 - Securing Code Pipelines with Vulnerability Scanning

A large enterprise maintains a CI/CD pipeline for their machine learning platform that builds custom Python training scripts and packages them into Docker containers deployed on Amazon SageMaker endpoints. The platform team currently runs unit tests and linting but does not perform security scanning.

A penetration test reveals that the production endpoint container contains a vulnerable version of cryptography (a Python package with a known CVE) and that a hardcoded database password exists in a Python utility file.

Which combination of AWS services should the team add to the CI/CD pipeline to prevent recurrence? (Select TWO)

  • A) Use Amazon CodeGuru Security to scan the Python source code for hardcoded credentials and security policy violations before the build stage.
  • B) Use AWS Config to add a managed rule that checks whether any deployed endpoint has a vulnerable Python package installed.
  • C) Use Amazon Inspector to continuously scan the built container images stored in Amazon ECR for software vulnerabilities in package dependencies.
  • D) Use AWS CloudTrail data events to detect when a container with a known vulnerability is deployed to a SageMaker endpoint.
  • E) Use AWS Secrets Manager to store the database password and add a build-time step that retrieves the secret so it is never embedded in the source code repository.
Click to reveal Answer & Explanation

Correct Answers: A, C, and E

Correct Options Analysis

  • A is Correct: Amazon CodeGuru Security is designed specifically for static code analysis that detects hardcoded credentials, security policy violations, and insecure coding patterns in custom application code.
  • C is Correct: Amazon Inspector continuously scans container images in Amazon ECR for software vulnerabilities and CVEs in the assembled image layers, which solves the known vulnerable package issue.
  • E is Correct: AWS Secrets Manager securely stores secrets with rotation, and retrieving at runtime eliminates hardcoded credentials in the code repository and applies AWS best practices.

Note: The question asks for TWO, but THREE options are technically correct. In the actual exam, ensure to read carefully. The best TWO that address the specific findings are A and C, with E being an additional best practice. If restricted to TWO, choose A and C as they address the CI/CD pipeline scanning gap directly.

Distractor Analysis

  • B is Incorrect: AWS Config evaluates resource configurations and compliance over time—it does not have "managed rules" that inspect package versions inside a container. Package vulnerabilities require active scanning of the artifact itself.
  • D is Incorrect: AWS CloudTrail data events record API activity but cannot detect or analyze software vulnerabilities within deployed containers. Vulnerability detection belongs to Amazon Inspector.

Key Takeaway: Static code analysis (CodeGuru) and image vulnerability scanning (Amazon Inspector) answer different security questions and both are required in a secure ML delivery pipeline.

Question 4 - CloudTrail Data Events for Model Invocation Auditing

A healthcare technology company runs a HIPAA-compliant Amazon Bedrock application that processes patient records through an LLM. During a regulatory audit, the auditor asks for the complete history of every model invocation—including the prompt inputs and the generated outputs—with attribution of which principal made each call.

The platform team already has a multi-Region AWS CloudTrail trail enabled, but the audit team reports that model invocation calls are not appearing in the trail logs.

What is the MOST LIKELY reason for the missing invocation data? (Select ONE)

  • A) CloudTrail trails do not record Amazon Bedrock API calls; the team must use Amazon Bedrock invocation logging instead.
  • B) The trail records management events by default, so InvokeModel and Converse data events must be explicitly configured on the trail.
  • C) The trail is configured in the wrong AWS Region and must be recreated in the Region where the Bedrock model is deployed.
  • D) AWS KMS encryption needs to be enabled on the trail's CloudWatch Logs group before invocation events can be captured.
Click to reveal Answer & Explanation

Correct Answer: B

Correct Answer Analysis

B is Correct: Amazon Bedrock InvokeModel and Converse API calls are classified as data events (data-plane operations), not management events. CloudTrail trails only record management events by default (such as CreateModel, PutModelInvocationLoggingConfiguration). To capture model invocation calls, data events must be explicitly enabled on the trail. High-volume data events like model invocations are never included by default.

Distractor Analysis

  • A is Incorrect: CloudTrail DOES record Amazon Bedrock API calls, but the trail must be configured to include data events for the specific resource types (e.g., bedrock resource type). The statement that CloudTrail "does not record" is false—the configuration is missing.
  • C is Incorrect: A multi-Region CloudTrail trail (which the company already has) records events across all AWS Regions automatically. There is no need to replicate the trail in each Region.
  • D is Incorrect: AWS KMS encryption protects the integrity and confidentiality of CloudTrail log files but has no relationship to which event types the trail captures.

Key Takeaway: Management events are automatic; data events (including Bedrock model invocations and S3 object reads) must be explicitly configured on the trail.

A government agency deploys a real-time inference endpoint using Amazon SageMaker for fraud detection. The endpoint must not be accessible from the public internet, and all inference traffic must originate from within the agency's VPC. The agency also requires that the SageMaker API calls from internal applications (e.g., InvokeEndpoint) remain on the AWS private network.

The ML engineer configures the SageMaker endpoint to run within the VPC by specifying subnets and security groups. Which additional step ensures that client applications outside the VPC cannot invoke the endpoint and that all API calls stay private? (Select ONE)

  • A) Create an interface endpoint (AWS PrivateLink) for the SageMaker runtime API and update the security groups to only allow traffic from the VPC.
  • B) Enable S3 Block Public Access on the model artifact bucket to restrict endpoint access.
  • C) Create an S3 Gateway Endpoint in the VPC and route all endpoint traffic through it.
  • D) Attach an IAM policy to the SageMaker execution role that denies sagemaker:InvokeEndpoint from public IP addresses.
Click to reveal Answer & Explanation

Correct Answer: A

Correct Answer Analysis

A is Correct: An AWS PrivateLink interface endpoint for the SageMaker runtime API (sagemaker.runtime) provides private connectivity from applications within a VPC to the SageMaker endpoint service. Combined with VPC-bound endpoint configuration and restrictive security groups, this ensures the endpoint is not addressable from the public internet and API calls remain on the private AWS network.

Distractor Analysis

  • B is Incorrect: S3 Block Public Access controls public access to data stored in S3 buckets; it has no bearing on who can invoke a SageMaker endpoint.
  • C is Incorrect: S3 Gateway Endpoints provide private connectivity to Amazon S3 only, not to SageMaker runtime APIs. SageMaker runtime requires an interface endpoint, not a gateway endpoint.
  • D is Incorrect: IAM policies with condition keys can restrict based on IP address (aws:SourceIp), but this would not prevent the endpoint from being technically reachable from the internet. Network-level isolation (VPC endpoint + security groups) is the correct defense-in-depth approach.

Key Takeaway: SageMaker endpoints configured to run in a VPC are only accessible from within that VPC; clients in the VPC can reach the runtime API via an interface endpoint (PrivateLink) without internet traversal.

Question 6 - Bedrock Guardrails for PII Redaction

A customer service application uses Amazon Bedrock to generate responses to customer inquiries. During a security review, the compliance team discovers that model outputs occasionally contain customer email addresses, phone numbers, and account numbers that were present in the training data used for fine-tuning.

The compliance team requires that all personally identifiable information (PII) in model responses must be masked before being returned to the end user, and the application must remain fully operational (no blocking).

Which configuration satisfies this requirement? (Select ONE)

  • A) Configure a sensitive information filter in Amazon Bedrock Guardrails with the masking action (anonymize/redact) applied to model output.
  • B) Configure a sensitive information filter in Amazon Bedrock Guardrails with the blocking action applied to model output.
  • C) Use AWS Lambda to preprocess all model responses with Amazon Comprehend DetectPIIEntities and replace PII values before returning to the user.
  • D) Remove the PII from the training data and retrain the fine-tuned model from scratch.
Click to reveal Answer & Explanation

Correct Answer: A

Correct Answer Analysis

A is Correct: Amazon Bedrock Guardrails sensitive information filters support both blocking and masking (anonymize/redact) actions on PII in model inputs and outputs. Selecting the masking action detects PII entities (such as email addresses, phone numbers, and account numbers) and replaces them with placeholders or redacted values instead of blocking the response, keeping the application operational.

Distractor Analysis

  • B is Incorrect: While sensitive information filters with blocking would prevent PII from reaching users, the compliance team requires the application to remain fully operational (no blocking). Blocking would cause denial of service for valid customer inquiries.
  • C is Incorrect: Using Amazon Comprehend DetectPIIEntities in a Lambda function is a manual implementation that introduces operational complexity and requires custom code maintenance. Bedrock Guardrails provides native PII detection and masking without custom pipeline work.
  • D is Incorrect: While removing PII from training data is a legitimate data quality practice, it does not address the immediate requirement for real-time masking of PII in production responses. Retraining is time-consuming and does not account for PII that may be introduced through user inputs.

Key Takeaway: Bedrock Guardrails sensitive information filters support both block and mask actions, and the mask/anonymize action is appropriate when the application must continue serving responses while protecting sensitive data.

Question 7 - Choosing Credentials for Foundation Model Access in Production

An enterprise application running on Amazon ECS containers needs to invoke a foundation model via Amazon Bedrock in production. The application currently uses a long-term API key that was generated manually by a developer and stored as an environment variable in the container image.

During a security audit, the long-term API key is flagged as a critical risk. The security team mandates that production workloads must use temporary credentials with automatic rotation and the principle of least privilege.

Which approach should replace the current configuration? (Select ONE)

  • A) Store the long-term API key in AWS Secrets Manager and have the ECS task retrieve it at runtime.
  • B) Generate a new long-term API key and store it in the ECS task definition environment variables with AWS KMS encryption.
  • C) Create an IAM role for the ECS task (ecsTaskRole) with permissions to call bedrock:InvokeModel, and assign the role to the task definition so the container receives temporary credentials via the metadata endpoint.
  • D) Generate a short-term API key each time the application starts by using the sts:AssumeRole API call implemented in the container startup script.
Click to reveal Answer & Explanation

Correct Answer: C

Correct Answer Analysis

C is Correct: ECS task roles (also called ecsTaskRole) provide temporary credentials to containers through the ECS credential injection mechanism using AWS STS. These credentials are automatically rotated and inherit the IAM role's permissions. The application can transparently call Amazon Bedrock APIs using the SDK without managing any static API keys. This is the standard AWS production pattern.

Distractor Analysis

  • A is Incorrect: Storing the long-term API key in Secrets Manager is better than hardcoding it, but the security team explicitly requires temporary credentials with automatic rotation. Long-term API keys, even when stored securely, do not auto-rotate and remain long-lived credentials.
  • B is Incorrect: This approach maintains the fundamental problem of long-term credentials embedded in the container configuration. KMS encryption protects the environment variable while stored in the task definition, but the key itself remains static and long-lived.
  • D is Incorrect: Implementing manual STS calls in a startup script is unnecessarily complex and error-prone. ECS provides built-in credential injection for roles attached to the task, which simplifies the application and follows AWS best practices without custom code.

Key Takeaway: Production workloads on AWS compute services (ECS, EC2, Lambda) should always use IAM roles with temporary credentials (STS) rather than API keys, including for Amazon Bedrock model invocation.

Question 8 - Detecting Configuration Drift in ML Infrastructure

A compliance-focused ML platform team uses extensive AWS infrastructure including Amazon SageMaker endpoints, S3 data buckets, and IAM roles. The security policy mandates that:

  • SageMaker endpoints must be configured to run in VPC mode
  • S3 buckets storing training data must have server-side encryption enabled
  • IAM roles granted to SageMaker execution must not contain wildcard permissions

The security team currently relies on periodic manual reviews. They need to automatically detect when any resource deviates from these policies and receive alerts for investigation.

Which AWS service provides automatic detection of configuration drift against these defined policies? (Select ONE)

  • A) AWS CloudTrail
  • B) Amazon Inspector
  • C) AWS Config
  • D) AWS Security Hub
Click to reveal Answer & Explanation

Correct Answer: C

Correct Answer Analysis

C is Correct: AWS Config continuously evaluates resource configurations against managed or custom rules (such as sagemaker-endpoints-in-vpc, s3-bucket-server-side-encryption-enabled, iam-policy-no-wildcard-actions). When a resource is evaluated and found non-compliant with a rule, AWS Config flags it, and these findings can be delivered to Amazon EventBridge for alerting or remediation.

Distractor Analysis

  • A is Incorrect: AWS CloudTrail records API activity and events for auditing, but it does not evaluate whether resource configurations comply with policies. CloudTrail would show WHO changed a setting, but not whether the resulting configuration violates a policy.
  • B is Incorrect: Amazon Inspector scans EC2 instances, ECR container images, and Lambda functions for software vulnerabilities and network exposure, not AWS resource configuration compliance.
  • D is Incorrect: AWS Security Hub aggregates security findings from multiple services (including Inspector, GuardDuty, IAM Access Analyzer) but does not itself evaluate resource configurations. It can integrate AWS Config findings, but the configuration evaluation is performed by AWS Config.

Key Takeaway: AWS Config is the primary service for tracking resource configuration changes and evaluating compliance against defined rules over time.

Question 9 - Securing Model Artifacts in S3

A company trains machine learning models using Amazon SageMaker and stores the resulting model artifacts (.tar.gz files containing trained model parameters) in an S3 bucket. The security team has identified that the S3 bucket currently has permissive bucket policies that allow read access to any authenticated AWS user (Principal: {"AWS": "*"}).

The security policy requires:

  • Model artifacts must only be accessible to the specific SageMaker execution role used during training
  • The must be encrypted at rest using a customer-managed key (CMK)
  • Access must follow least privilege at all times

The correct answer involves applying TWO controls to the S3 bucket and IAM role. (Select TWO)

  • A) Remove the permissive bucket policy statement and replace it with an IAM policy on the SageMaker execution role that grants s3:GetObject and s3:PutObject only on the specific model artifact prefix.
  • B) Enable server-side encryption with S3-managed keys (SSE-S3) on the bucket.
  • C) Enable server-side encryption with a customer-managed KMS key (SSE-KMS/CMK) on the bucket and ensure the SageMaker execution role has kms:Decrypt permissions on that key.
  • D) Add a bucket policy that allows access from the VPC endpoint only.
  • E) Enable Amazon Macie on the bucket to detect sensitive data in the model artifacts.
Click to reveal Answer & Explanation

Correct Answers: A and C

Correct Options Analysis

  • A is Correct: The bucket policy with Principal: {"AWS": "*"} allows any AWS identity to read model artifacts, violating least privilege. The fix requires removing this policy and scoping access through the SageMaker execution role via an IAM policy with specific resource-level restrictions.
  • C is Correct: The requirement specifies customer-managed keys (CMK) for encryption at rest, not S3-managed keys. SSE-KMS with a CMK ensures the encryption key is managed by the customer, and the SageMaker execution role must have appropriate kms:Decrypt permissions to access the artifacts.

Distractor Analysis

  • B is Incorrect: SSE-S3 uses S3-managed keys, which does not meet the customer-managed key (CMK) requirement. Customer-managed keys require SSE-KMS with a CMK ARN.
  • D is Incorrect: Restricting access by VPC endpoint does not resolve the underlying issue of overly permissive bucket policies (any authenticated AWS principal from any VPC with an endpoint could still access the artifacts). Least privilege is about identity-based scope, not just network path.
  • E is Incorrect: Amazon Macie is for discovering and alerting on sensitive data like PII in S3 buckets; it does not enforce encryption or restrict access. Macie is a detection tool, not an access control.

Key Takeaway: Model artifacts are sensitive intellectual property—secure them with least privilege IAM policies (specific roles/actions/resources) and customer-managed KMS encryption at rest.

Question 10 - Detecting External Model Artifacts and Supply Chain Risks

A startup has started open-sourcing some components of their ML platform and wants to adopt community-contributed model architectures. Their ML engineers frequently download pre-trained model weights from public repositories (e.g., Hugging Face) and import them as custom containers into Amazon SageMaker endpoints.

During a security review, the following concerns are raised:

  1. The downloaded model weights could contain embedded malicious payloads
  2. The containers built from these models may include vulnerable dependencies
  3. There is no visibility into what third-party code is being deployed into production

Which TWO AWS services/features should the team implement to mitigate these supply chain risks? (Select TWO)

  • A) Use Amazon Inspector to scan the container images in Amazon ECR for known software vulnerabilities and unintended network exposure before deployment.
  • B) Use Amazon Bedrock Guardrails to block malicious outputs from models deployed on SageMaker.
  • C) Implement a mandatory code review process and pin model artifacts from trusted sources only using S3's Object Lock with Governance mode.
  • D) Use AWS Shield Advanced to protect the SageMaker endpoint from DDoS attacks originating from malicious model weights.
  • E) Use Amazon CodeGuru Security to perform static code analysis of custom inference scripts included in the container before deployment.
Click to reveal Answer & Explanation

Correct Answers: A and E (or A and C as mitigation strategies)

Correct Options Analysis

  • A is Correct: Amazon Inspector scans container images in ECR for CVEs in underlying operating system packages and Python/system dependencies. This directly addresses concern #2 (vulnerable dependencies).
  • E is Correct: Amazon CodeGuru Security performs static analysis of custom inference scripts and application code, detecting hardcoded credentials, exposed secrets, and security policy violations. This directly addresses concern #1 regarding potentially malicious code embedded in custom scripts.
  • C is also relevant: Pinning model artifacts from trusted sources and using S3 Object Lock with Governance mode prevents accidental modification and requires review before model updates. This addresses concern #3 by enforcing supply chain discipline.

Distractor Analysis

  • B is Incorrect: Amazon Bedrock Guardrails is designed for Amazon Bedrock models and processes them for content filtering. It cannot be applied to custom models deployed on SageMaker endpoints. It also does not mitigate container supply chain risks.
  • D is Incorrect: AWS Shield Advanced provides DDoS protection for public-facing applications; it does not mitigate risks from malicious model weights or container vulnerabilities. DDoS concerns are separate from supply chain security.

Key Takeaway: Model supply chain security requires scanning both the container image (Amazon Inspector) and any custom code in the inference stack (CodeGuru Security), plus strict artifact provenance management (S3 Object Lock).