Security, Compliance, and Governance for AI Solutions practice questions

Amazon Macie discovers and protects sensitive data, such as PII, in Amazon S3.

Finding PII in training data is Macie's core purpose. Inspector finds vulnerabilities, KMS handles keys, and PrivateLink handles private connectivity, so none of them locate sensitive data.

1. Identify the goal: find PII inside S3 training data.
2. Match the goal to the sensitive-data discovery service.
3. That service is Amazon Macie.

Exam tip: The trigger phrase find PII or sensitive data in training data points to Amazon Macie.

AWS PrivateLink keeps traffic between your VPC and AWS services off the public internet.

Keeping AI traffic private is exactly what PrivateLink does. Macie finds data, IAM controls access, and KMS handles keys, so none of them provide private connectivity.

1. Identify the goal: keep model traffic off the public internet.
2. Match it to the private-connectivity service.
3. That service is AWS PrivateLink.

Exam tip: Keep traffic to an AI service private and off the internet with AWS PrivateLink.

Least privilege means giving each component only the permissions it needs, ideally through an IAM role with temporary credentials.

A tightly scoped IAM role is the secure pattern. Broad administrator keys, the root user, and hard-coded passwords all grant far more than needed or expose long-lived secrets.

1. Identify the requirement: minimum access to one model and one data store.
2. Prefer a role that hands out temporary credentials over long-lived keys.
3. Scope the role's permissions to only those actions.

Exam tip: Grant AI components access with least-privilege IAM roles, not broad users or root.

Encryption at rest protects stored data such as S3 training datasets, using keys managed in AWS KMS.

Protecting stored files is encryption at rest. TLS covers data in transit, IAM controls access rather than encrypting, and PrivateLink secures the network path, so they address different states.

1. Identify the data state: stored files in S3.
2. Match stored data to encryption at rest.
3. AWS KMS manages the keys for that encryption.

Exam tip: Protect stored AI data with encryption at rest using AWS KMS.

Encryption in transit uses TLS (HTTPS) to protect data as it moves across the network.

A prompt moving to a model is data in transit, protected by TLS. Encryption at rest covers storage, IAM covers permissions, and Macie discovers data, so they cover different concerns.

1. Identify the data state: a prompt moving over the network.
2. Match moving data to encryption in transit.
3. The mechanism is TLS.

Exam tip: Protect AI data moving over the network with TLS, which is encryption in transit.

Prompt injection is an attack that hides malicious instructions in input to make a model behave unintendedly.

The described attack matches prompt injection exactly. Data residency is a location policy, overfitting is a training issue, and encryption in transit is a protection, so none describe this threat.

1. Note the behavior: hidden instructions override the model's intended behavior.
2. Match that behavior to the AI-specific input attack.
3. That attack is prompt injection.

Exam tip: Hidden instructions in input that hijack a model's behavior is prompt injection.