AIF-C01 Question 198
Select 3Your company is deploying a machine learning model on AWS to classify sensitive customer data. To meet compliance and security requirements, which combination of methods should you implement to secure the AI system?
- A
Encrypt data at rest using AWS Key Management Service (KMS).
- B
Use AWS Identity and Access Management (IAM) roles to restrict access to the model and data.
- C
Host the model on an Amazon EC2 instance without enabling security groups to avoid unnecessary overhead.
- D
Implement Amazon SageMaker endpoint encryption for data in transit.
- E
Expose the model endpoint publicly to simplify accessibility for all users.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure an AI system on AWS, it is crucial to follow best practices such as encrypting data at rest and in transit, restricting access through IAM roles, and ensuring endpoints are not publicly exposed. These measures collectively protect sensitive data and the overall integrity of the system.
- A. Correct.
Encrypting data at rest using AWS KMS ensures that sensitive customer data stored in services like S3, SageMaker, or RDS remains secure and compliant with data protection regulations.
- B. Correct.
Using AWS IAM roles to restrict access prevents unauthorized users from accessing the model, training data, or sensitive customer information, thereby enhancing security.
- C. Incorrect.
Hosting the model on an EC2 instance without enabling security groups would leave it exposed to potential attacks, which violates best practices for securing AWS resources.
- D. Correct.
Amazon SageMaker endpoint encryption ensures that data transmitted to and from the model endpoint is encrypted, protecting it from interception during transit.
- E. Incorrect.
Exposing the model endpoint publicly would make it vulnerable to unauthorized access and attacks, undermining the security of the AI system.