AIAI Agent Dev Labaiagentdev-lab.com
Sign in to save progressSign in
Menu

AIF-C01 · LESSON 5

Security, Compliance, and Governance for AI Solutions14% · 2 topics

Learn how to secure AI systems and about governance and compliance for AI systems.

5.1Securing AI systems

5.1 Explain methods to secure AI systems.

Concept

AI systems are protected with least privilege through IAM, encryption (KMS at rest, TLS in transit), network isolation (private connections to Bedrock via VPC endpoints/PrivateLink), data protection (detecting sensitive data with Macie, managing training data lineage) and logging (CloudTrail, model invocation logs). Threats specific to generative AI include prompt injection, data poisoning and model theft.

How it works / steps

  1. Minimize access to Bedrock and models with IAM
  2. Call Bedrock without traversing the internet via VPC interface endpoints
  3. Encrypt training data and prompt data with KMS
  4. Check S3 training data for personal information with Macie
  5. Detect and prevent prompt attacks with guardrails and logging

Workplace example

Call Bedrock from an internal app via a VPC endpoint, save invocation logs to S3, and audit for abnormal usage.

Common confusions and exam tips

Mini quiz

Q1. Regarding the shared responsibility model for generative AI apps, which is not the customer's responsibility?

  1. Applying security updates to the OS of Bedrock's underlying servers
  2. Deciding how to classify and protect the data the app handles
  3. Configuring safety measures such as guardrails for the app's inputs and outputs
  4. Managing the IAM permissions that can invoke models
Show answer and explanation

Answer: A Applying security updates to the OS of Bedrock's underlying servers

AWS manages Bedrock's underlying infrastructure. Customers are responsible for permissions, data and app configuration.

Q2. Amazon Macie found files containing customer names and phone numbers in an S3 bucket you planned to use for training. What is the most appropriate next step?

  1. Do not record the finding and start training on the data as-is as planned
  2. Remove or mask the relevant data, and use it for training only after confirming the purpose of use and permissions
  3. Disable Macie's settings so its findings stop appearing
  4. Make the bucket publicly readable so many people can check the content
Show answer and explanation

Answer: B Remove or mask the relevant data, and use it for training only after confirming the purpose of use and permissions

When sensitive data is found, remove or mask it before training, and confirm the purpose of use, consent and permissions.

Reference links

5.2Governance and compliance for AI systems

5.2 Recognize governance and compliance regulations for AI systems.

Concept

AI governance includes creating policies, managing the data lifecycle (retention, deletion, lineage), monitoring and auditing, and responding to regulations (standards such as ISO/IEC 42001 and national regulations). AWS tools are AWS Artifact (compliance reports), AWS Audit Manager (collecting audit evidence), AWS Config (evaluating configurations), CloudTrail (recording actions) and Trusted Advisor. The Generative AI Security Scoping Matrix organizes the scope of responsibility by usage pattern (consumer apps to your own models).

How it works / steps

  1. Define AI usage policies (permitted data, uses, approvals)
  2. Set rules for data lineage, retention and deletion
  3. Automatically collect audit evidence with Audit Manager
  4. Record configurations and actions with Config and CloudTrail
  5. Review periodically and update in line with regulatory changes

Workplace example

To prepare for audits, automatically collect evidence for controls on generative AI use with Audit Manager, and obtain AWS's certification reports from Artifact.

Common confusions and exam tips

Mini quiz

Q1. Which is the most appropriate purpose of using the Generative AI Security Scoping Matrix?

  1. As a GPU allocation plan for shortening model training time
  2. As an application form to AWS for automatic discounts on generative AI model pricing according to usage pattern
  3. As a benchmark for ranking by score which foundation model's answers are most accurate
  4. To organize the security measures needed according to usage pattern (just using an app, adjusting a model, etc.)
Show answer and explanation

Answer: D To organize the security measures needed according to usage pattern (just using an app, adjusting a model, etc.)

The scoping matrix is a framework that classifies the scope of generative AI use and organizes governance, legal, risk management, controls and resilience considerations for each scope.

Q2. When you enable Amazon Bedrock model invocation logging, which can be configured as log destinations?

  1. Amazon CloudWatch Logs and Amazon S3
  2. Amazon Polly audio files
  3. AWS Artifact reports
  4. Amazon Translate custom terminology
Show answer and explanation

Answer: A Amazon CloudWatch Logs and Amazon S3

Model invocation logs can be sent to CloudWatch Logs or S3. Control access and also decide the retention period.

Reference links

Lessons are written by this site based on public information and do not guarantee exam content. Product specifications change, so check the latest information at the reference links.

Notes (unofficial, original questions, no pass guarantee)