Securing AI systems: AIF-C01 study notes and practice questions
What to know about Securing AI systems for the AIF-C01 exam, from the Security, Compliance, and Governance for AI Solutions domain (14% of the exam guide), then 5 free questions to test it. Part of the AIF-C01 study guide.
AI security questions mix familiar AWS controls with risks that are new to AI.
Shared responsibility for AI
AWS secures the infrastructure and the managed service, such as the environment Amazon Bedrock models run in.
The customer secures their data, prompts, who can call which model, application code, guardrails and how outputs are used.
In Amazon Bedrock, your prompts and outputs aren’t used to train the base models, and your data stays in the Region you use unless you choose cross-Region inference.
Controls
Control
AWS tools
Who can use which models and data
IAM policies and roles, least privilege
Encryption at rest and in transit
AWS KMS, TLS
Private network access
VPC interface endpoints (AWS PrivateLink), so traffic doesn’t cross the internet
Logging and audit
AWS CloudTrail for API calls; Bedrock model invocation logging to CloudWatch Logs or S3
B. Wrong: A NAT gateway sends outbound traffic to the public internet, and it needs an internet gateway the VPC does not have. A security group limits who can connect but does not change the network path.
C. Wrong: A VPN links the VPC to the office, but Bedrock is still reached through its public endpoint, so the traffic would still cross the internet.
D. Wrong: A public IP exposes the instances to the internet and sends Bedrock calls over the public endpoint. IAM controls who can call the service, but not the network path the calls take.
Explanation
Interface VPC endpoints use AWS PrivateLink to connect a VPC to AWS services privately, without an internet gateway, NAT device, VPN or Direct Connect. Bedrock supports this, so the calls can stay off the public internet. This question tests choosing the private connection method for a service that must not use the public internet.
Calls to Amazon Bedrock go through an interface endpoint in the private subnets, so they never need an internet path.
A data science team is about to use thousands of files in Amazon S3 to fine-tune a model.
The security team first wants to find any files that contain personal data, such as names, addresses or card numbers, without anyone reading each file by hand.
Which AWS service should the team use?
Choose one answer.
AA. Amazon Macie, which discovers and reports sensitive data such as personal information in S3 buckets.
BB. Amazon Inspector, which scans EC2 instances and container images for software vulnerabilities.
CC. Amazon GuardDuty, which detects suspicious activity and threats across AWS accounts and workloads.
DD. AWS Config, which evaluates the configuration of S3 buckets, such as encryption settings, against rules.
B. Wrong: Inspector finds vulnerabilities in software on compute resources and containers. It does not look inside data files for personal information.
C. Wrong: GuardDuty analyzes account activity and logs to detect threats, such as unusual access. It does not search the contents of files for personal data.
D. Wrong: Config checks whether settings such as bucket encryption follow your rules. It does not look inside the files for personal information.
Explanation
Amazon Macie is built to find sensitive data in S3 at scale and report it, which helps a team decide what to protect before using data for fine-tuning. The other services address vulnerabilities, threats and configuration rather than the contents of data files. This question tests matching a data-discovery need to the right security service.
A retailer builds a customer support chatbot on Amazon Bedrock and plans to include customer data in some prompts. Its engineers want to know which security tasks remain with the retailer rather than AWS.
Under the AWS shared responsibility model, which TWO are the retailer's responsibility? (Choose two.)
Choose two answers.
AA. Give application roles only the IAM permissions they need to invoke the specific Bedrock models they use.
BB. Decide which customer personal data may go into prompts, and mask or remove it before the request is sent.
CC. Patch and maintain the physical servers and networking that host the Bedrock model deployment environment.
DD. Secure the data centers where AWS runs Bedrock and control physical access to the buildings and racks.
EE. Keep the foundation model software and its serving stack patched and secure inside the Bedrock service.
B. Right: Correct. What data enters a prompt is the customer's decision, and AWS advises keeping sensitive details such as customer email addresses out of free-text fields.
C. Wrong: This is AWS's responsibility. Securing the infrastructure that runs AWS services is part of the provider's side of the model.
D. Wrong: AWS protects its own data centers, so physical access controls are not the retailer's task. The retailer's controls sit on its content, identities and configuration.
E. Wrong: AWS operates and secures the model deployment environment. The retailer does not patch it, and model providers do not have access to Bedrock logs or customer prompts.
Explanation
Under the shared responsibility model, AWS secures the cloud infrastructure and the managed model environment, while customers control their own content, identities, configuration and data. For a Bedrock chatbot, that means IAM access and what data enters prompts. This question tests dividing security tasks between AWS and the customer.
An e-commerce company's AI agents call refund tools through Amazon Bedrock AgentCore Gateway.
Security requires a fixed rule: a refund tool may run only when the refund is under $200 and the customer is verified, whatever a user or prompt says. The rule must be enforced outside the model's own reasoning.
Which approach meets this?
Choose one answer.
AA. Attach an AgentCore Policy to the Gateway with a Cedar rule for the refund tool that checks the amount and verified status.
BB. Add the rule to the agent's system prompt, then test in evaluation runs that the model refuses refunds above $200.
CC. Enable a Bedrock Guardrails denied topic for refunds, so the model is blocked from discussing refunds at all.
DD. Have a Lambda function ask the model to check each refund against the rule, then call the tool only if it agrees.
B. Wrong: The model still reads the system prompt, so a crafted user message can override it. Passing tests show typical behavior, not a guarantee.
C. Wrong: Guardrails filters content in model inputs and outputs. It does not check the amount or the customer's status before a refund tool is called.
D. Wrong: This keeps the decision inside the model's reasoning, which the requirement rules out. The model could be manipulated, or it could simply be wrong.
Explanation
Policy in Amazon Bedrock AgentCore works outside the agent, so it enforces tool rules on every request regardless of how the model is prompted. Rules are written in Cedar and attached to a Gateway. This question tests choosing deterministic enforcement over approaches that rely on the model's behavior.
A pension provider's RAG assistant answers members' questions from retrieved policy documents. Sometimes it adds details that the retrieved text does not contain.
The provider wants unsupported answers blocked automatically, without a reviewer reading every response.
Which Amazon Bedrock Guardrails feature should it use?
Choose one answer.
AA. Contextual grounding check, which tests whether each response is supported by the source text and relevant to the question.
BB. Sensitive information filter, which detects and masks personal data such as dates of birth in responses.
CC. Denied topics, which block a subject the developers define, such as early pension withdrawals.
DD. Word filters, which block exact words and phrases from a custom list, such as competitor product names.
B. Wrong: Sensitive information filters protect personal data. They do not check whether an answer is supported by the retrieved policy text.
C. Wrong: Denied topics stop a whole subject from being discussed. An invented detail about an allowed pension rule would still pass, because the subject itself is permitted.
D. Wrong: Word filters match exact words. They cannot tell whether a sentence is supported by a source document.
Explanation
In a RAG assistant the main risk is an answer that goes beyond the retrieved documents. A contextual grounding check compares each response with the source and the question, so unsupported content can be blocked. This question tests choosing the guardrail that addresses hallucination rather than content categories.
Want more on Securing AI systems? The 5 full-length practice sets have 22 more Securing AI systems questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →