AIF-C01 practice question: Governance and compliance (1 of 2)
Security, Compliance, and Governance for AI Solutions A free question from our original AIF-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A healthcare company's governance team is setting up oversight for its AI workloads on AWS.
Match each need to the AWS service that meets it. Each option is used at most once, and one option is not needed.
Match each item to one answer. An answer can be used more than once, and some may not be used.
Items
Show auditors a record of which IAM users and roles called Amazon Bedrock APIs, and when
Download a SOC 2 report to share with a hospital customer's security reviewers
Keep a history of each S3 bucket's configuration and flag any bucket that breaks a rule, such as public access
Record each model's intended use, risk rating and evaluation results in one document for review
Answers
AA. AWS CloudTrail, which records API calls made by users, roles and services for auditing.
BB. AWS Artifact, which provides on-demand AWS compliance reports such as SOC reports.
CC. AWS Config, which records resource configuration history and evaluates it against rules.
DD. Amazon SageMaker AI Model Cards, which document a model's intended uses, risk rating and evaluation results.
EE. Amazon Bedrock Guardrails, which filter harmful content and sensitive information in model inputs and outputs.
Show the answer and explanation
Correct matches
Show auditors a record of which IAM users and roles called Amazon Bedrock APIs, and when: A. AWS CloudTrail, which records API calls made by users, roles and services for auditing.
Download a SOC 2 report to share with a hospital customer's security reviewers: B. AWS Artifact, which provides on-demand AWS compliance reports such as SOC reports.
Keep a history of each S3 bucket's configuration and flag any bucket that breaks a rule, such as public access: C. AWS Config, which records resource configuration history and evaluates it against rules.
Record each model's intended use, risk rating and evaluation results in one document for review: D. Amazon SageMaker AI Model Cards, which document a model's intended uses, risk rating and evaluation results.
About each answer
A. Matches the first need. CloudTrail records which identity made each API call and when, which is the audit trail auditors ask for.
B. Matches the second need. Artifact is where AWS compliance reports are downloaded for sharing with customers and reviewers.
C. Matches the third need. Config records how each resource's settings changed over time and flags resources that break a rule, such as public bucket access.
D. Matches the fourth need. Model cards hold a model's intended uses, risk rating and evaluation results in one record that can be exported.
E. Not needed here. Guardrails enforces safety at runtime, while the four needs are about audit records, compliance reports, configuration history and model documentation.
Explanation
Governance uses different AWS tools for different kinds of evidence. CloudTrail shows who did what, Config shows how resources were set up and changed, Artifact provides compliance reports, and Model Cards document each model. Guardrails enforces safety at runtime, so it is not one of the four needs. This question tests matching each kind of evidence to the right service.
Want more on Governance and compliance? The 5 full-length practice sets have 11 more Governance and compliance questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →