ExamPark
Course menuMLA-C02

Exams / MLA-C02 / IAM and least privilege for ML / Question 2

MLA-C02 practice question: IAM and least privilege for ML (2 of 2)

Operating, Monitoring, and Securing ML and AI Solutions A free question from our original MLA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A pet insurer has an application that calls Amazon Bedrock to summarize claim notes. The security team approved one foundation model in one Region for this use. The application's IAM role currently allows model invocation for every model in every Region, and an audit found it could call a model the team never approved.

The team wants the role to invoke only the approved model, and it wants the change limited to the role's policy without changing the application code.

Which change best meets these requirements?

Choose one answer.

  1. A. Keep the broad policy, and add a deny statement for the one model in the role's trust policy, since trust policies control what actions the role can take.
  2. B. Replace the wildcard resource in the invoke permission with the ARN of the approved model in its Region, so the role can invoke only that model.
  3. C. Create a new IAM user for the application with the same wildcard policy, and rotate its access keys every week.
  4. D. Add a network rule that blocks outbound traffic from the application to Bedrock endpoints in all other Regions.
Show the answer and explanation

Answer: B

  • A. Wrong: A trust policy controls who can assume the role, not which actions it can perform. The deny belongs in the permissions policy and is in the wrong place here.
  • B. Right: Correct. The InvokeModel permission can name specific model ARNs as its resource, so replacing the wildcard with the approved model's ARN in the approved Region limits the role to that model. The application code does not change. Learn more: Identity-based policy examples for Amazon Bedrock (opens in a new tab)
  • C. Wrong: Rotating keys does not limit which models the identity can invoke, so the audit finding remains. The option does not address the permission scope.
  • D. Wrong: A network rule could limit Regions, but it does not restrict the model, and the stem asks for a change to the role's policy. It also does not match the audit finding about which model was called.

Explanation

Bedrock invoke permissions accept model resource ARNs, so the role's wildcard can be replaced with the approved model in the approved Region. Trust policies control who assumes the role, and key rotation or network rules do not restrict which model the role can call.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free MLA-C02 practice examPractice IAM and least privilege for MLAll IAM and least privilege for ML questions

Want more on IAM and least privilege for ML? The 5 full-length practice sets have 10 more IAM and least privilege for ML questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets