Skill 4.3.7: Identify and mitigate security risks and vulnerabilities in ML and AI systems
| Question | Answer & Explanation |
|---|---|
| ### Question 1 - Network Isolation for SageMaker Training Jobs An ML team is training a sensitive model using Amazon SageMaker. The training job runs in a private subnet that has no route to the internet. The job fails when it attempts to read the training dataset from an Amazon S3 bucket. The security policy mandates that no traffic traverses the public internet and the solution must minimize operational overhead. Which change resolves the connectivity issue while complying with the constraints? - A) Attach a broader inbound rule to the training job's security group to allow S3 traffic. - B) Add an S3 Gateway Endpoint to the VPC to route S3 traffic over the AWS private network. - C) Encrypt the S3 bucket with a customer-managed key in AWS KMS to ensure secure access. - D) Grant the training job's IAM role s3:GetObject permissions on the bucket. |
Correct Answer: B Correct Answer Analysis: - B is Correct: An S3 Gateway Endpoint routes S3 traffic from the private subnet over the AWS private network backbone without requiring an internet gateway or NAT device. This resolves the network routing failure while maintaining strict isolation and minimizing operational overhead. Distractor Analysis: - A is Incorrect: Security group inbound rules regulate traffic coming to the training instances; they do not resolve outbound routing failures to external AWS service endpoints. - C is Incorrect: AWS KMS encryption protects data at rest within the S3 bucket, but it does not address the underlying network connectivity issue preventing the job from reaching the S3 service. - D is Incorrect: The scenario describes a network-level routing failure ("no internet route" prevents reaching the endpoint), not an IAM authorization denial. Even with correct IAM permissions, the job cannot reach S3 without a network path. > Exam Tip: When a resource in a private subnet without internet access needs to reach AWS services like S3, use a VPC Gateway or Interface Endpoint (AWS PrivateLink) rather than opening up security groups. |
| ### Question 2 - Securing CI/CD Pipelines for ML Applications An enterprise is building a CI/CD pipeline for an ML application using Amazon SageMaker. The pipeline builds a custom Docker container image for model hosting. The security team mandates that the pipeline must automatically block deployments if the custom Python application code contains hardcoded credentials or if the built container image contains known package vulnerabilities. The solution must use AWS native services. Which TWO steps should the engineer implement to fulfill these requirements? (Select TWO) - A) Use Amazon CodeGuru Security to scan the application source code for hardcoded secrets and policy violations. - B) Use Amazon Inspector to scan the built container image in Amazon ECR for known software vulnerabilities. - C) Use AWS Config rules to check for hardcoded credentials in the code repository. - D) Use Amazon GuardDuty to detect hardcoded credentials in the application code. - E) Use Amazon Macie to scan the container image for sensitive data. |
Correct Answers: A and B Correct Answer Analysis: - A is Correct: Amazon CodeGuru Security performs static analysis on application source code to detect security vulnerabilities, including hardcoded secrets and insecure coding patterns. - B is Correct: Amazon Inspector automatically scans container images stored in Amazon ECR for known package vulnerabilities (CVEs) and unintended network exposure, providing the necessary image-level security gating. Distractor Analysis: - C is Incorrect: AWS Config evaluates resource configurations over time against rules; it does not inspect application source code for hardcoded credentials. - D is Incorrect: Amazon GuardDuty is an intelligent threat detection service that monitors for malicious activity and unauthorized behavior, not a static code analysis tool. - E is Incorrect: Amazon Macie is a data security service that automatically discovers and protects sensitive data (like PII) in Amazon S3, not a container image vulnerability scanner. > Exam Tip: Static analysis of code (CodeGuru) and vulnerability scanning of built images (Inspector) answer different security questions; a robust ML CI/CD pipeline requires both. |
| ### Question 3 - Production Credentials for Foundation Models A production web application running on Amazon EC2 needs to invoke a foundation model on Amazon Bedrock. The security policy strictly mandates that no long-term static credentials be stored on the instance or embedded in the application code. The solution must provide the application with the necessary permissions while adhering to the principle of least privilege and minimizing operational overhead. Which credential approach is the MOST appropriate? - A) Attach an IAM role to the EC2 instance profile with a policy granting bedrock:InvokeModel permissions.- B) Generate a long-term API key for the foundation model and store it as an environment variable on the EC2 instance. - C) Use a short-term API key generated by an engineer at the start of each shift and passed into the application. - D) Store a shared API key in the application's Docker image and retrieve it at runtime. |
Correct Answer: A Correct Answer Analysis: - A is Correct: Using an IAM role attached to the EC2 instance profile is the AWS best practice for production workloads. It provides temporary, automatically rotated credentials via AWS STS without requiring static secrets in code or environments, adhering to least privilege. Distractor Analysis: - B is Incorrect: Storing long-term API keys in environment variables violates the mandate against static credentials and creates security risks if the host environment is compromised. - C is Incorrect: Manual credential management by engineers introduces significant operational overhead and human error, and couples automated production systems to human user identities. - D is Incorrect: Baking static secrets into container images creates a critical security risk and makes key rotation extremely difficult, violating core security principles. > Exam Tip: For production workloads invoking models on Bedrock or SageMaker, always use IAM roles with temporary credentials via instance profiles or task roles. |
| ### Question 4 - Mitigating Hallucinations in RAG Applications An AI engineering team built a Retrieval-Augmented Generation (RAG) application using Amazon Bedrock Knowledge Bases. The compliance team requires that the application must not return answers that are hallucinated or unsupported by the retrieved source documents. The solution must intercept and block unsupported responses before they reach the user, with minimal development effort. Which configuration addresses this requirement? - A) Configure a Contextual Grounding check in Amazon Bedrock Guardrails applied to the model response. - B) Configure a Denied Topic filter in Amazon Bedrock Guardrails for the subject area. - C) Configure an S3 Gateway Endpoint to ensure the retrieved passages are kept private. - D) Configure a Sensitive Information filter to mask unsupported text. |
Correct Answer: A Correct Answer Analysis: - A is Correct: Amazon Bedrock Guardrails Contextual Grounding checks evaluate hallucination risks by validating that generated responses are factually grounded in the reference text (retrieved passages). If the response is unsupported, the policy can block it. Distractor Analysis: - B is Incorrect: Denied topic filters block conversations surrounding specific predefined domains (e.g., medical advice), but do not evaluate the factual alignment of a response to a source passage. - C is Incorrect: S3 Gateway Endpoints secure network traffic to S3, but do not inspect the semantic content of the model's generated text. - D is Incorrect: Sensitive information filters detect, mask, or block PII (like SSNs), rather than detecting hallucinations or ungrounded claims. > Exam Tip: Use Contextual Grounding checks in Bedrock Guardrails to prevent RAG applications from returning information not found in the retrieved source documents. |
| ### Question 5 - Real-time PII Masking in Model Responses A customer service chatbot uses Amazon Bedrock to generate responses. The chatbot sometimes inadvertently includes Personally Identifiable Information (PII), such as customer account numbers, in its responses. The security team mandates that these account numbers must be automatically masked in real-time before the user sees the response, without altering the rest of the conversational flow. Which solution meets these requirements? - A) Configure an Amazon Inspector scan to detect PII in the container image hosting the chatbot. - B) Configure a Sensitive Information filter in Amazon Bedrock Guardrails on the model response. - C) Configure AWS CloudTrail data events to log and audit the PII exposure after it happens. - D) Configure AWS PrivateLink to prevent PII from leaving the private network. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Bedrock Guardrails provides Sensitive Information filters that can detect, mask, or block PII (like account numbers or custom regex patterns) in model responses in real-time, satisfying the requirement to mask data before the user sees it. Distractor Analysis: - A is Incorrect: Amazon Inspector scans container images for package vulnerabilities, not for runtime PII exposure in conversational AI outputs. - C is Incorrect: CloudTrail logs API activity for auditing purposes but operates passively after the call completes; it cannot redact or mask text outputs in real-time. - D is Incorrect: AWS PrivateLink secures the network path but does not inspect or redact the text content traveling across it. > Exam Tip: For real-time content filtering, PII masking, or topic denial in LLM applications, apply Amazon Bedrock Guardrails to evaluate prompts and responses. |
| ### Question 6 - Auditing Model Invocation Data An internal audit team is investigating a security incident involving an Amazon SageMaker inference endpoint. They need to review the exact input payloads and output responses of all model invocation calls made over the last 30 days. The existing AWS CloudTrail trail was created with default settings. The solution must capture the required invocation data with minimal operational overhead. What must be changed to fulfill the audit requirement? - A) Enable CloudTrail data events for the SageMaker endpoint to capture InvokeEndpoint calls.- B) Add a configuration rule in AWS Config for the SageMaker endpoint to track payload changes. - C) Move the CloudTrail trail to the same Region as the SageMaker endpoint to capture local events. - D) Enable AWS KMS encryption on the S3 bucket storing the CloudTrail logs to secure the payloads. |
Correct Answer: A Correct Answer Analysis: - A is Correct: By default, CloudTrail only records management events (e.g., CreateEndpoint). Model invocation calls (InvokeEndpoint) are data events. Data events must be explicitly enabled on the trail to capture the input payloads and output responses for the audit.Distractor Analysis: - B is Incorrect: AWS Config rules evaluate resource configuration and drift over time; they do not record individual runtime API invocation payloads. - C is Incorrect: A standard multi-Region CloudTrail trail records events across all Regions automatically without needing to be moved. - D is Incorrect: Enabling KMS encryption secures the log files at rest but has no effect on which event types (management vs. data) CloudTrail captures. > Exam Tip: Model invocations (like InvokeEndpoint or Bedrock InvokeModel) are high-volume data-plane operations. You must explicitly enable Data Events in CloudTrail to capture them. |
| ### Question 7 - Network Security for SageMaker Endpoints An ML team is deploying a SageMaker real-time inference endpoint. The endpoint must be accessible only from a specific internal application running on Amazon EC2 instances within the same VPC. The team needs to configure the network security to ensure the endpoint is completely unreachable from the public internet while allowing the EC2 instances to communicate with it. Which architecture fulfills these requirements? - A) Deploy the endpoint in a private subnet and configure the security group to allow inbound traffic only from the EC2 instances' security group. - B) Deploy the endpoint in a public subnet and rely on IAM policies to restrict access to the EC2 instances' IAM roles. - C) Deploy the endpoint in a private subnet and configure a NAT Gateway to mask the EC2 instances' private IP addresses. - D) Deploy the endpoint in a public subnet and use AWS WAF to block all traffic except from the EC2 instances' public IPs. |
Correct Answer: A Correct Answer Analysis: - A is Correct: Deploying the SageMaker endpoint in a private subnet ensures it has no public IP address and is unreachable from the internet. Configuring the security group to only accept inbound traffic from the EC2 instances' security group enforces strict network-level access control. Distractor Analysis: - B is Incorrect: Deploying in a public subnet exposes the endpoint to the internet. Relying solely on IAM policies violates the requirement to be "completely unreachable" from the public internet, as network-level access is still possible. - C is Incorrect: A NAT Gateway is used to allow instances in a private subnet to initiate outbound traffic to the internet; it is not used for inbound routing or masking IPs for internal VPC communication. - D is Incorrect: Deploying in a public subnet exposes the endpoint, and AWS WAF is typically used for web application layer filtering (API Gateway/ALB), not for securing internal SageMaker network traffic. > Exam Tip: For private ML endpoints, use private subnets and reference security groups in inbound rules to restrict access to specific internal workloads. |
| ### Question 8 - Implementing Least Privilege for ML Roles During a security review of an ML pipeline, an engineer notices that a SageMaker processing job has an IAM role with s3:* permissions on all buckets in the account. The job only needs to read from a specific input bucket and write to a specific output bucket. The engineer wants to identify exactly which permissions are required by the job to create a least-privilege policy without trial-and-error updates.Which AWS service or feature will help the engineer achieve this? - A) Use IAM Access Analyzer to generate IAM policies based on CloudTrail access data for the processing job's role. - B) Temporarily grant the role AdministratorAccess and monitor CloudTrail to see which APIs are called.- C) Create a broad inbound rule on the security group and inspect VPC Flow Logs to determine S3 access patterns. - D) Use Amazon CodeGuru Security to scan the processing script and automatically generate IAM policies for S3. |
Correct Answer: A Correct Answer Analysis: - A is Correct: IAM Access Analyzer policy generation reviews AWS CloudTrail events to identify the exact AWS services and operations used by a role over a specified period. It generates a fine-grained, least-privilege IAM policy based on actual usage, eliminating guesswork. Distractor Analysis: - B is Incorrect: Granting AdministratorAccess is a severe security violation and completely contradicts the goal of implementing least privilege.- C is Incorrect: VPC Flow Logs capture network IP traffic; they do not capture the specific AWS API operations (like s3:GetObject) needed to construct an IAM policy.- D is Incorrect: Amazon CodeGuru Security scans code for security vulnerabilities and hardcoded secrets; it does not analyze runtime API access patterns to generate IAM policies. > Exam Tip: To right-size IAM roles and enforce least privilege without guesswork, use IAM Access Analyzer to generate policies based on CloudTrail history. |
| ### Question 9 - Troubleshooting KMS Access Denied for ML Jobs A SageMaker training job fails with an AccessDenied error when attempting to write model artifacts to an Amazon S3 bucket. The training job's IAM role currently has a policy that explicitly grants s3:PutObject on the target bucket's prefix. Upon investigation, the engineer discovers the S3 bucket is encrypted using a customer-managed KMS key. The security policy mandates that least privilege must be maintained.Which action resolves the error without over-granting permissions? - A) Add kms:Encrypt and kms:GenerateDataKey permissions for the KMS key to the training job's IAM role.- B) Grant the IAM role s3:* permissions on the bucket to clear the S3 layer error.- C) Disable encryption on the S3 bucket to allow the training job to write artifacts without KMS permissions. - D) Attach the AmazonS3FullAccess managed policy to the training job's IAM role. |
Correct Answer: A Correct Answer Analysis: - A is Correct: When writing to an S3 bucket encrypted with a customer-managed KMS key, the calling role needs permission to use the KMS key to generate the data key for encryption. Adding kms:Encrypt and kms:GenerateDataKey (and often kms:Decrypt for subsequent reads) to the role resolves the error while adhering to least privilege.Distractor Analysis: - B is Incorrect: The error is a KMS access denial, not an S3 API layer denial. Granting s3:* does not grant KMS permissions and violates least privilege.- C is Incorrect: Disabling bucket encryption violates the security requirement of protecting data at rest with customer-managed keys. - D is Incorrect: Attaching AmazonS3FullAccess is a severe violation of least privilege and still does not grant the required KMS permissions.> Exam Tip: When accessing KMS-encrypted S3 buckets, the ML job's IAM role needs both S3 object permissions and KMS key usage permissions ( kms:GenerateDataKey, kms:Decrypt). |
| ### Question 10 - Auditable Encryption for Model Artifacts A financial institution is training ML models using Amazon SageMaker. Compliance regulations require that all model artifacts and training data must be encrypted at rest using a customer-managed key (CMK). The institution also needs to maintain an auditable record of exactly who used the encryption key and when. The solution must use AWS native services. Which TWO actions should the ML engineer take to meet these requirements? (Select TWO) - A) Specify a customer-managed KMS key in the SageMaker training job configuration for encrypting the model artifacts. - B) Use SSE-S3 default encryption on the S3 bucket where artifacts are stored instead of a CMK. - C) Use AWS CloudTrail to log KMS API calls, including Encrypt and Decrypt operations.- D) Store the customer-managed KMS key ARN in an environment variable on the SageMaker notebook instance. - E) Use AWS Config to evaluate the security group settings of the SageMaker training instances. |
Correct Answers: A and C Correct Answer Analysis: - A is Correct: SageMaker allows you to specify a customer-managed KMS key to encrypt the EBS volumes attached to the training instances and the model artifacts in S3, fulfilling the encryption requirement. - C is Correct: AWS CloudTrail logs API calls made to AWS KMS, including Encrypt, Decrypt, and GenerateDataKey. This provides the required auditable record of who used the key and when.Distractor Analysis: - B is Incorrect: SSE-S3 uses AWS managed keys, not customer-managed keys (CMK). It does not allow the institution to control key access policies or audit key usage specific to their compliance requirements. - D is Incorrect: Storing the KMS key ARN in an environment variable does not grant the SageMaker job permission to use the key, nor does it encrypt the artifacts. Permissions must be granted via IAM roles. - E is Incorrect: AWS Config evaluating security groups monitors network traffic rules, not KMS key usage or encryption-at-rest configurations. > Exam Tip: For strict compliance requiring auditable encryption, use customer-managed KMS keys (CMKs) and rely on CloudTrail to log KMS API usage. |