Exams / AIF-C01 / Securing AI systems / Question 1
AIF-C01 practice question: Securing AI systems (1 of 5)
Security, Compliance, and Governance for AI Solutions A free question from our original AIF-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A pharmaceutical company's applications run in private subnets of a VPC with no internet access. Security requires that calls to Amazon Bedrock never travel over the public internet. What should the company use?
Choose one answer.
- AA. A public NAT gateway in front of the private subnets
- BB. Amazon Macie scanning each request for sensitive data
- CC. An interface VPC endpoint (AWS PrivateLink) for Bedrock
- DD. An AWS Artifact agreement accepted for the Bedrock service
Show the answer and explanation
Answer: C
- A. Wrong: A NAT gateway sends traffic out to the internet, which is what the security team wants to avoid.
- B. Wrong: Macie discovers sensitive data in Amazon S3. It does not provide private network connectivity.
- C. Right: Correct. An interface endpoint gives a private connection from the VPC to Bedrock without using the internet.
- D. Wrong: Artifact provides compliance reports and agreements. It does not change network routing.
Explanation
AWS PrivateLink interface VPC endpoints let resources in a VPC reach supported AWS services, including Amazon Bedrock, privately. Combined with IAM, encryption in transit and at rest, and logging, it is a common control for sensitive generative AI workloads.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.