Security, Compliance, and Governance for AI Solutions practice questions

Worked examples for Security, Compliance, and Governance for AI Solutions

1. Question 1

   A regulated financial services firm fine-tunes a foundation model and stores the training datasets and resulting model artifacts in Amazon S3. Its compliance policy states that the organization itself must define which principals may use the encryption key protecting this data, must be able to disable or revoke that key independently of the storage service, and must retain an auditable record of every use of the key. Which approach best satisfies these requirements?

   1. A. Rely on the storage service's default encryption with an AWS-owned key, because under the AWS Shared Responsibility Model AWS is responsible for protecting customer data.

      Misreads the shared responsibility model: AWS secures the infrastructure of the cloud, while the customer configures security in the cloud, including encryption and key policy. An AWS-owned key also gives the customer no key policy, no ability to disable it, and no per-request key usage log.

   2. B. Enforce TLS for all connections to the storage service and to the training job so the data is encrypted, which satisfies the key control and auditing requirements.

      Confuses encryption in transit with encryption at rest. TLS protects data moving over the network and involves no customer-controlled data key policy or key usage audit trail for stored objects.

   3. C. Configure Amazon Macie to encrypt the training datasets and model artifacts and to log which principals decrypt them.

      Misassigns Macie's role. Macie discovers and classifies sensitive data such as PII in Amazon S3 and reports findings; it is a data discovery service and does not encrypt objects or manage encryption keys.

   4. D. Encrypt the datasets and model artifacts with an AWS KMS customer managed key, control access through the key policy and IAM, and review AWS CloudTrail records of key usage.Correct answer

      A customer managed key is created and controlled by the customer, so the organization sets the key policy that decides which principals may use it, can disable or schedule deletion of the key independently of the storage service, and gets key usage recorded in CloudTrail for audit.

   Explanation

   Choosing and configuring encryption for data placed in AWS is a customer responsibility in the cloud under the AWS Shared Responsibility Model, and a customer managed AWS KMS key is the control that delivers customer-defined key policies, independent disable or deletion, and CloudTrail-audited key usage. Depending on a service-default AWS-owned key hands key governance to AWS and provides none of those controls; TLS addresses data in transit rather than key ownership or auditing of data at rest; and sensitive-data discovery tooling classifies and reports on data but performs no encryption or key management.

2. Question 2

   An AI team currently calls a fully managed AWS generative AI service for inference. To gain more control over the runtime, the team is considering moving to self-hosting an open-weights model on Amazon EC2 instances that it launches and operates itself. The security lead asks how this change affects the division of duties under the AWS Shared Responsibility Model. Which statement is correct?

   1. A. With self-hosting on Amazon EC2 the customer takes on more security tasks, such as patching the guest operating system and the model-serving software and configuring network and access controls, while AWS remains responsible for security of the underlying infrastructure, including the physical facilities and the virtualization layer.Correct answer

      Correct. AWS is always responsible for security 'of the cloud' — hardware, facilities, and the virtualization layer — while the customer is responsible for security 'in the cloud'. For an infrastructure service such as EC2, that customer share expands to include guest OS and application patching, network configuration, and access management.

   2. B. The division of duties is fixed and identical for every AWS service, so moving the workload to Amazon EC2 changes nothing about who secures what.

      Misconception that the responsibility line is the same for all services. AWS states that the customer's share of responsibility varies with the service selected — managed services shift more operational security to AWS, while infrastructure services such as EC2 leave more with the customer.

   3. C. Because the EC2 instances run on AWS-managed hardware, AWS patches the guest operating system and the model-serving stack on those instances as part of its infrastructure responsibility.

      Confuses AWS's responsibility for the host infrastructure and hypervisor with the guest environment. For EC2, patching and hardening the guest OS and any software the customer installs on it are explicitly the customer's responsibility.

   4. D. Self-hosting the model transfers responsibility for the model's outputs and for the customer's data classification to AWS, since the model now runs on AWS compute.

      Misconception that running on AWS infrastructure offloads content and data responsibilities. Customer data, its classification, and how the application uses model output stay with the customer under every AWS service model.

   Explanation

   The AWS Shared Responsibility Model splits security into 'security of the cloud' (AWS: hardware, facilities, and the virtualization layer) and 'security in the cloud' (customer: data, access management, and configuration). Where the line falls depends on the service chosen: an abstracted managed service lets AWS handle more of the operational stack, whereas an infrastructure service such as EC2 leaves the guest operating system, installed software, network controls, and IAM configuration to the customer. Responsibility is therefore not identical across services, AWS does not patch the guest OS on customer-launched instances, and neither the customer's data classification nor the application's use of model output ever transfers to AWS.

3. Question 3

   An enterprise risk committee reviewing a new generative AI workload states: "Our AWS environment falls under third-party compliance programs such as SOC and ISO, so we should not need to invest further in securing this AI application." How should an AI practitioner characterize the relationship between compliance and security when responding?

   1. A. Because AWS compliance programs cover the underlying infrastructure, any workload deployed on AWS automatically inherits full end-to-end security for its data and application layer

      Represents the misconception that infrastructure certification transfers completely to the customer's workload. Customers inherit assurance about AWS-managed controls, but application logic, data handling, and access configuration remain customer responsibilities regardless of AWS's certifications.

   2. B. Third-party attestations and certifications demonstrate that audited controls met a defined standard, but the customer remains responsible for securing its own AI application, data, and access configuration under the shared responsibility modelCorrect answer

      Correct. AWS compliance programs provide independent assurance about AWS's controls and give customers inheritable evidence, but compliance is an attestation against a defined standard at a point in time — it does not discharge the customer's own responsibility for application, data, and identity security under the shared responsibility model.

   3. C. Compliance and security are interchangeable terms, so passing a compliance audit is by definition equivalent to having no residual security risk in the AI workload

      Represents the classic compliance-equals-security misconception. Compliance measures conformance to an external standard's control set, while security is the ongoing technical and operational protection of systems and data; passing an audit does not eliminate residual risk such as misconfigured permissions or unvalidated model inputs.

   4. D. Compliance programs apply only to traditional workloads, so an AI or machine learning workload must be governed entirely outside of any compliance framework

      Represents the misconception that AI workloads sit outside established compliance frameworks. AWS compliance programs cover services in scope regardless of whether the workload is AI-based, and AI workloads are governed by the same standards, augmented by AI-specific governance practices — not exempted from them.

   Explanation

   Compliance and security are related but distinct: compliance is conformance to an external standard's defined control set, validated by an independent auditor, whereas security is the continuous technical and operational protection of systems and data. AWS compliance programs give customers independent assurance and inheritable evidence about AWS-managed controls, yet under the shared responsibility model the customer still owns the security of its AI application, its training and inference data, and its identity and access configuration. Treating certification as automatic end-to-end coverage, as proof of zero residual risk, or as inapplicable to AI workloads all misread what an attestation actually asserts — scope, point in time, and control boundary. See AWS — Compliance Programs (https://aws.amazon.com/compliance/programs/).

4. Question 4

   A company is deploying a generative AI application on AWS. The governance team has two separate requirements: 1. Auditors need a record of *who* invoked model APIs and *when*, so the team can reconstruct the sequence of API calls made against the AI service. 2. A separate internal control requires proof that the AI workload's storage resources have remained continuously configured with encryption enabled, and an alert if any resource drifts out of that desired configuration. Which pair of AWS services most directly addresses requirement 1 and requirement 2, respectively?

   1. A. AWS CloudTrail for requirement 1, and AWS Config for requirement 2Correct answer

      Correct pairing of purpose to service. CloudTrail records account API activity — the identity, time, and source of each call — which is the audit trail for model API invocations. Config records resource configurations, evaluates them against desired-state rules, and flags configuration drift such as encryption being disabled.

   2. B. AWS Config for requirement 1, and AWS CloudTrail for requirement 2

      Swaps the two services' governance jobs. Config evaluates resource configuration state against rules over time; it is not the API-activity record. CloudTrail logs API calls; it does not continuously evaluate resource configuration compliance.

   3. C. AWS Artifact for requirement 1, and Amazon Inspector for requirement 2

      Assigns the wrong governance job to both services. Artifact is a self-service portal for downloading AWS compliance reports and agreements (such as SOC and ISO artifacts); it records nothing about your API calls. Inspector performs automated vulnerability scanning of workloads, not configuration-drift evaluation.

   4. D. AWS Audit Manager for requirement 1, and AWS Trusted Advisor for requirement 2

      Confuses evidence collection and advisory checks with the underlying record-keeping services. Audit Manager automates collecting evidence and mapping it to a framework, but it consumes underlying data rather than being the API activity record itself. Trusted Advisor gives best-practice recommendations across cost, performance, security, and limits; it is not a continuous desired-state configuration evaluator.

   Explanation

   AWS separates governance responsibilities by service purpose: activity auditing versus configuration compliance. The service that records account API activity — who called what, when, and from where — is the correct source for reconstructing model API invocations, while the service that records and continuously evaluates resource configurations against desired-state rules is the correct source for proving encryption stayed enabled and for detecting drift. Compliance-report portals only supply AWS's own audit artifacts, vulnerability scanners look for software and network exposure rather than configuration drift, evidence-automation services aggregate data collected by other services rather than being the primary activity log, and best-practice advisory checks are point-in-time recommendations rather than continuous desired-state evaluation. See AWS — Cloud Security (https://aws.amazon.com/security/) for how these governance and audit capabilities are positioned.

5. Question 5

   A data science team needs to run inference against one specific foundation model in Amazon Bedrock. Company policy states the team must NOT be able to delete Bedrock resources, and must be able to read only its own prefix in the shared Amazon S3 training-data bucket. Which approach best applies the principle of least privilege?

   1. A. Attach a policy granting full administrative access to Amazon Bedrock and Amazon S3, then configure Amazon Bedrock Guardrails to block the actions the team should not perform.

      Confuses content safety with access control. Guardrails evaluate model inputs and outputs for harmful content, denied topics, and PII — they never decide which AWS API calls an identity is permitted to make. Broad admin permissions would remain fully in force.

   2. B. Issue each team member a long-lived IAM user access key with a policy allowing all actions on all resources, and review AWS CloudTrail logs afterwards to detect misuse.

      Substitutes a detective control for a preventive one. CloudTrail records what happened after the fact; it cannot stop an over-permissioned identity from deleting resources, and long-lived static keys increase credential-exposure risk instead of reducing it.

   3. C. Define an IAM role the team assumes that allows only the model-invocation actions, scoped to that model's resource ARN, plus read-only S3 actions scoped to the team's own object prefix.Correct answer

      This is least privilege as AWS defines it: grant only the actions required, on only the specific resources required, and deliver them through an assumable role with temporary credentials rather than long-lived keys. Deletion and other teams' data are excluded because they were never granted.

   4. D. Grant no IAM permissions and rely on the AWS shared responsibility model, because AWS assigns the appropriate permissions automatically for fully managed AI services.

      Misreads the shared responsibility model. AWS secures the infrastructure of the cloud; identity and access management for a customer's workloads is squarely the customer's responsibility in the cloud, and a managed service does not auto-provision entitlements.

   Explanation

   Least privilege means granting only the actions needed, narrowed to the specific resource ARNs they apply to, and delivering them through assumable roles that issue temporary credentials — an IAM design decision that belongs to the customer under the shared responsibility model. Content-safety filtering operates on model prompts and completions and cannot authorize or deny AWS API calls, so it is not an access-control mechanism. Audit logging is valuable but detective: it reports overly broad access rather than preventing it, and static long-lived keys make exposure worse. Nor does using a managed AI service shift permission configuration to AWS; customers still define who may call what.

6. Question 6

   A financial services company is preparing to onboard a generative AI application built on AWS. During vendor due diligence, the customer's external auditors ask the company to produce AWS's own third-party audit artifacts — specifically the SOC 2 report and the ISO 27001 certificate covering the underlying AWS services — so the auditors can evaluate AWS's controls as part of the shared responsibility model. Which AWS service is designed to provide these AWS compliance reports and certifications on demand?

   1. A. AWS Audit Manager

      Confuses evidence collection about the customer's own workloads with obtaining AWS's third-party attestations. Audit Manager continuously collects evidence from a customer's AWS usage and maps it to control frameworks to help the customer prepare for their own audit; it does not issue AWS's SOC or ISO documents.

   2. B. AWS Config

      Assigns the wrong governance job to Config. Config records and evaluates the configuration state of a customer's resources against rules over time; it reports on the customer's resources, not on AWS's own audited controls.

   3. C. AWS ArtifactCorrect answer

      Correct. AWS Artifact is the self-service portal for on-demand access to AWS's security and compliance documentation, including SOC reports and ISO certifications produced by independent third-party auditors under the AWS compliance programs.

   4. D. Amazon Inspector

      Confuses vulnerability assessment with compliance attestation. Inspector continually scans customer workloads such as EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure; it does not deliver AWS audit reports.

   Explanation

   Under the shared responsibility model, AWS's side of the controls is validated by independent third-party auditors under the AWS compliance programs, which cover attestations and certifications such as SOC and ISO 27001. The self-service portal for downloading those AWS-issued reports and certificates on demand is AWS Artifact. Evidence-collection tooling that maps a customer's own AWS usage to a control framework, configuration-state recording and rule evaluation for customer resources, and automated vulnerability scanning of customer workloads all address the customer's side of the model — none of them produces AWS's third-party audit documentation.

7. Question 7

   A company is assembling a training and retrieval corpus for a generative AI assistant by consolidating years of documents into Amazon S3. Before the corpus is used, the data governance team must answer one specific question: **which of these S3 objects contain sensitive data such as personally identifiable information, so that the team can classify them and decide what must be redacted or excluded?** The team is not looking for software vulnerabilities, a record of who called which API, or a history of how the buckets were configured. Which AWS service is purpose-built for this data classification need?

   1. A. Amazon Macie, because it discovers and classifies sensitive data such as PII stored in Amazon S3Correct answer

      Correct. Macie is the AWS data security service that uses machine learning and pattern matching to discover and classify sensitive data — including personally identifiable information — in Amazon S3, which is exactly the classification step this data governance program needs before the corpus is used.

   2. B. Amazon Inspector, because it continuously scans workloads and reports what it finds

      Misconception: treating Inspector as a general-purpose data scanner. Inspector performs automated vulnerability management — it scans compute resources such as EC2 instances, container images, and Lambda functions for known software vulnerabilities and unintended network exposure. It does not classify the contents of stored data as sensitive.

   3. C. AWS CloudTrail, because it records the contents of the objects that were uploaded to the corpus

      Misconception: confusing an API audit trail with data content inspection. CloudTrail records API activity — who made a call, when, from where, and against which resource — which supports accountability and forensics, but it does not read object contents or tell the team which files hold PII.

   4. D. AWS Config, because it evaluates the S3 buckets and reports any that hold sensitive data

      Misconception: assigning data-content classification to a configuration-tracking service. Config records and evaluates the configuration state of AWS resources over time (for example, whether a bucket has encryption or public access blocked) and flags configuration drift — it never inspects the data inside the objects.

   Explanation

   Data governance for an AI corpus starts with knowing what the data actually contains, and AWS positions Amazon Macie as the data security service that discovers and classifies sensitive data such as PII in Amazon S3 (AWS — Cloud Security, https://aws.amazon.com/security/). The other services in the AWS governance toolkit each answer a different question: vulnerability management scans compute resources for known software flaws rather than reading stored content; the API audit trail records who called which API and when, not what is inside an object; and configuration tracking records resource settings and drift over time, which is about how a bucket is configured rather than what it stores. Matching the governance need to the service whose actual job is data classification is the discriminating skill here.

8. Question 8

   An insurance company runs a generative AI claims assistant built on Amazon Bedrock. Its data governance policy for logging and monitoring has two separate requirements: (1) reviewers must be able to read the **actual prompt text submitted and the model's generated response** for a sampled set of interactions, so they can audit output quality and policy violations; and (2) auditors must be able to see **which IAM identity called the Bedrock API, when, and from what source IP address**. Which approach correctly satisfies both requirements?

   1. A. Enable Amazon Bedrock model invocation logging to deliver prompt and response data to Amazon S3 or Amazon CloudWatch Logs for the content review, and use AWS CloudTrail for the record of who called the API, when, and from where.Correct answer

      Correct separation of the two logging layers. Model invocation logging is the Bedrock feature that captures the invocation payloads (prompt and completion) to a customer-owned S3 bucket or CloudWatch Logs, while CloudTrail supplies the identity, timestamp, and source IP of the API activity — together covering content auditing and API accountability.

   2. B. Rely on AWS CloudTrail alone, because CloudTrail event records include the full request and response payloads of every API call, which for inference calls means the prompt and the completion.

      Misconception that CloudTrail captures payload content. CloudTrail records API activity metadata — the identity, time, source IP, service, and action — and deliberately omits large or sensitive request/response bodies, so prompts and completions are not available from it.

   3. C. Rely on AWS Config alone, because Config records the content of every request made to a monitored resource and retains a searchable history of those requests.

      Assigns the wrong governance job to AWS Config. Config tracks resource *configuration* state and its change history, and evaluates resources against compliance rules; it does not capture application-level request content such as prompts or model responses.

   4. D. Enable AWS Audit Manager, because it automatically collects prompts and model responses as audit evidence and also produces the API caller identity records.

      Confuses Audit Manager's role. Audit Manager automates the *collection and organization of evidence* from other sources (such as CloudTrail, Config, and Security Hub) and maps it to control frameworks; it is not itself a capture mechanism for application payloads like prompts and completions.

   Explanation

   Logging for an AI workload operates at two distinct layers, and a governance program generally needs both. Application-level invocation logging is what preserves the prompt and generated response so humans can review content, and on Amazon Bedrock that is provided by model invocation logging, which delivers those payloads to an S3 bucket or CloudWatch Logs the customer controls. API-level auditing is what answers accountability questions — which principal made the call, at what time, and from which IP — and that is the purpose of AWS CloudTrail, which records API activity metadata rather than payload bodies. Treating CloudTrail as a source of prompt text, expecting AWS Config (a resource-configuration and compliance-rule service) to record request content, or expecting AWS Audit Manager (an evidence-collection and control-framework mapping service) to capture inference payloads all misassign the service's actual governance role.