ExamPark
Course menuAIF-C01

Exams / AIF-C01 / Securing AI systems / Question 1

AIF-C01 practice question: Securing AI systems (1 of 5)

Security, Compliance, and Governance for AI Solutions A free question from our original AIF-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A pharmaceutical company runs its applications in private subnets of a VPC that has no internet gateway and no NAT gateway.

Security requires that calls to Amazon Bedrock never travel over the public internet.

Which approach meets this requirement?

Choose one answer.

  1. A. Create an interface VPC endpoint for Amazon Bedrock, powered by PrivateLink, in the private subnets.
  2. B. Route the private subnets through a NAT gateway and restrict outbound traffic with a security group.
  3. C. Connect the VPC to the office network over a site-to-site VPN and send all Bedrock calls through the tunnel.
  4. D. Give each application instance a public IP address and restrict access to Bedrock with IAM policies.
Show the answer and explanation

Answer: A

  • A. Right: Correct. An interface endpoint gives the subnets a private path to Bedrock, with no internet gateway, NAT device, VPN or Direct Connect needed. Learn more: Use interface VPC endpoints (AWS PrivateLink) with Amazon Bedrock (opens in a new tab)
  • B. Wrong: A NAT gateway sends outbound traffic to the public internet, and it needs an internet gateway the VPC does not have. A security group limits who can connect but does not change the network path.
  • C. Wrong: A VPN links the VPC to the office, but Bedrock is still reached through its public endpoint, so the traffic would still cross the internet.
  • D. Wrong: A public IP exposes the instances to the internet and sends Bedrock calls over the public endpoint. IAM controls who can call the service, but not the network path the calls take.

Explanation

Interface VPC endpoints use AWS PrivateLink to connect a VPC to AWS services privately, without an internet gateway, NAT device, VPN or Direct Connect. Bedrock supports this, so the calls can stay off the public internet. This question tests choosing the private connection method for a service that must not use the public internet.

An interface VPC endpoint giving private subnets a path to an AWS service In private subnets with no NAT gateway, an application calls an AWS service by its normal name. Private DNS resolves the name to an interface endpoint in the subnets, which has an endpoint policy, and the traffic reaches the AWS service over the AWS network through PrivateLink. Private subnets, no NAT Application calls the normal service name Interface endpoint private DNS, endpoint policy AWS service PrivateLink
Calls to Amazon Bedrock go through an interface endpoint in the private subnets, so they never need an internet path.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free AIF-C01 practice examPractice Securing AI systemsAll Securing AI systems questions

Want more on Securing AI systems? The 5 full-length practice sets have 22 more Securing AI systems questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets