Skill 4.3.4: Configure comprehensive monitoring, auditing, compliance, and logging for ML and AI systems

Question	Answer & Explanation
### Question 1 - Auditing SageMaker Endpoint Invocations An AI engineering team has deployed a machine learning inference endpoint using Amazon SageMaker. The compliance team requires a complete audit trail of every prediction request made to the endpoint, including the identity of the caller and the timestamp. The team has an existing AWS CloudTrail trail configured for the account, but it only captures management events. Constraint: Must enable the specific logging feature required without increasing operational overhead. Which action should the engineer take to fulfill the compliance requirement? (Select ONE) A) Modify the existing CloudTrail trail to enable data event logging for SageMaker. B) Enable AWS Config to record data-plane API calls for the SageMaker endpoint. C) Attach an AWS Lambda function to the SageMaker endpoint to log invocations to Amazon S3. D) Use Amazon CloudWatch Container Insights to capture endpoint invocation metadata.
### Question 2 - Monitoring SageMaker Notebook Internet Access A financial services company operates an ML pipeline on Amazon SageMaker. Security policies mandate that all SageMaker notebook instances must have network traffic restricted to a specific VPC and must not have direct internet access. The engineering team needs to continuously monitor these configurations and receive alerts if a notebook instance is launched or modified with internet access enabled. Constraint: Automated continuous monitoring using AWS native services with the least operational overhead. Which solution meets these requirements? (Select ONE) A) Create an AWS Config rule to evaluate SageMaker notebook instances for `DirectInternetAccess` settings and trigger an Amazon SNS notification. B) Use AWS CloudTrail to monitor the `CreateNotebookInstance` API call and trigger an AWS Lambda function to evaluate the parameters. C) Use Amazon Inspector to scan the notebook instances for unintended network exposure. D) Enable VPC Flow Logs for the VPC and use Amazon Athena to query for internet-bound traffic originating from notebook instances.
### Question 3 - Auditing Amazon Bedrock Model Invocations An enterprise is developing a generative AI application using Amazon Bedrock. The security team needs to maintain an audit log of all API calls made to the Bedrock service to track which foundation models are being invoked by different applications. They currently have a multi-region AWS CloudTrail trail enabled with default settings, but no Bedrock invocations are appearing in the logs. Constraint: Must capture Bedrock model invocation activity without modifying the application code. What should the team do to ensure these calls are logged? (Select ONE) A) Enable data event logging for Amazon Bedrock in the CloudTrail trail configuration. B) Enable management event logging for Amazon Bedrock in the CloudTrail trail configuration. C) Configure AWS Config to record Bedrock model invocations. D) Attach an IAM policy to the application roles that requires logging to Amazon CloudWatch Logs.
### Question 4 - Auditing S3 Object Access for ML Datasets A retail company stores its proprietary ML training datasets in an Amazon S3 bucket. Data scientists access this bucket using various IAM roles from their SageMaker Studio environments. The compliance officer requires an audit trail showing exactly which IAM role accessed which specific object in the S3 bucket, and at what time, for a forensic investigation. Constraint: Must capture object-level read/write operations with the caller's IAM identity. Which configuration is required to meet this compliance need? (Select ONE) A) Enable S3 Object-Level logging (data events) in AWS CloudTrail for the specific S3 bucket. B) Enable S3 Server Access Logging on the S3 bucket. C) Create an AWS Config rule to monitor S3 object access patterns. D) Enable AWS CloudTrail management events for S3.
### Question 5 - Centralized Logging for ML Workloads A global enterprise manages its machine learning workloads across multiple AWS accounts using AWS Organizations. The security team needs to establish a centralized, immutable audit trail of all management and data events related to SageMaker and S3 across all member accounts. Constraint: Must minimize operational overhead and ensure centralized logging. Which architecture meets these requirements? (Select ONE) A) Create an organization trail in the management account that logs events for all member accounts into a centralized S3 bucket. B) Deploy an individual CloudTrail trail in each member account, pointing to a central S3 bucket. C) Use AWS Config aggregators to collect SageMaker API activity from all accounts. D) Configure Amazon CloudWatch cross-account observability to stream CloudTrail events to a central account.
### Question 6 - Auditing Bedrock Guardrail Modifications A company is deploying an AI assistant using Amazon Bedrock with Guardrails configured to block sensitive information. The security team requires an audit log showing which IAM user or role created or modified the Bedrock Guardrails configurations. The team currently relies on AWS CloudTrail management events for their audit logs. Constraint: Must capture the specific configuration events without additional complex configuration. Will the current CloudTrail configuration capture these events, and why? (Select ONE) A) Yes, because creating or modifying Bedrock Guardrails are control-plane (management) events, which are logged by default. B) No, because Bedrock Guardrail configurations are data-plane events and require enabling data event logging in CloudTrail. C) Yes, because AWS CloudTrail automatically logs all AWS service configurations via AWS Config, not CloudTrail. D) No, because Bedrock Guardrails do not support AWS CloudTrail logging for configuration changes.
### Question 7 - Automated Remediation for Public S3 Buckets An ML engineering team stores highly sensitive model artifacts in an Amazon S3 bucket. The security policy mandates that this S3 bucket must never be made public. The team needs an automated mechanism to detect if the bucket policy is changed to allow public access and to automatically revert the change without human intervention. Constraint: Must provide automated remediation with the least operational overhead. Which AWS service configuration fulfills this requirement? (Select ONE) A) Enable an AWS Config rule for public S3 buckets and configure automatic remediation using AWS Systems Manager (SSM) Automation. B) Configure an Amazon EventBridge rule to listen for `PutBucketPolicy` events in AWS CloudTrail and trigger an AWS Lambda function to revert the policy. C) Use AWS Trusted Advisor to detect the public S3 bucket and send an email alert to the security team for manual remediation. D) Enable Amazon Macie to scan the S3 bucket for public access and automatically block the bucket.
### Question 8 - Tracking IAM Role Configuration Changes in ML Pipelines An ML platform team uses AWS Step Functions to orchestrate a complex training pipeline that includes AWS Glue jobs and Amazon SageMaker processing jobs. The team must ensure that any changes to the IAM execution roles attached to these Step Functions state machines are audited, and any over-permissive inline policies are flagged immediately. Constraint: Continuous configuration evaluation with automated alerting. Which AWS service should be used to monitor and evaluate the IAM roles for this pipeline? (Select ONE) A) AWS Config B) AWS CloudTrail C) Amazon Inspector D) AWS CloudWatch Logs
### Question 9 - Ensuring Immutability of CloudTrail Logs An ML engineering team must secure their AWS CloudTrail logs to meet strict regulatory compliance. The logs are stored in an Amazon S3 bucket. The compliance mandate requires that no one, including the root user, can delete or modify the log files once they are written, for a retention period of 7 years. Constraint: Must ensure immutability of the audit logs with minimal operational overhead. Which feature should the team implement on the S3 bucket to meet this requirement? (Select ONE) A) Enable S3 Object Lock in Compliance Mode on the CloudTrail S3 bucket. B) Enable S3 Versioning and MFA Delete on the CloudTrail S3 bucket. C) Configure a bucket policy that denies `s3:DeleteObject` to all principals. D) Use AWS CloudTrail log file integrity validation and store the logs in AWS Config.
### Question 10 - Continuous Monitoring of SageMaker VPC Configuration An enterprise has strict compliance requirements for its SageMaker training jobs. They must ensure that all training jobs are launched within a private VPC subnet, and if a training job is ever configured to run outside the VPC, the security team must be alerted immediately. The team wants an automated, serverless way to monitor this configuration state continuously. Constraint: Must trigger on configuration state changes without writing custom polling logic. How can the team achieve this? (Select ONE) A) Create an AWS Config rule that evaluates SageMaker training job VPC configurations and sends notifications via Amazon SNS. B) Configure an AWS CloudTrail trail to log the `CreateTrainingJob` API call and use Amazon EventBridge to trigger an alert. C) Use Amazon GuardDuty to detect SageMaker training jobs running outside a VPC. D) Use VPC Flow Logs to monitor network traffic from SageMaker training containers.