AIF-C01 Question 202
Select 3Your company is deploying a machine learning (ML) model on Amazon SageMaker, and you are tasked with ensuring the system is secure. The model processes sensitive customer data, and compliance requirements mandate data encryption at rest, controlled network access, and proper IAM permissions. Which of the following AWS services and features should you use to secure the AI system?
- A
Use AWS Key Management Service (AWS KMS) to encrypt data at rest.
- B
Set up an Amazon Macie job to find and classify sensitive data in Amazon S3.
- C
Use AWS PrivateLink to restrict network traffic between SageMaker and other services.
- D
Grant Amazon SageMaker full administrator access to simplify permissions management.
- E
Create an IAM role with least privilege access for SageMaker to access only required resources.
Show answer and explanation
Correct answers: A, C, E
Explanation
To secure an AI system in AWS, it is important to implement encryption (using AWS KMS), control network access (using AWS PrivateLink), and follow IAM best practices like least privilege access. These measures collectively reduce the risk of unauthorized access and ensure compliance with security and regulatory requirements. While Amazon Macie can help identify sensitive data, it does not directly secure the AI system, and granting full administrator access is not aligned with security best practices.
- A. Correct.
Correct. AWS KMS allows you to encrypt sensitive data at rest, which is a critical security measure for compliance and data protection.
- B. Incorrect.
Partially correct but not sufficient for this scenario. Amazon Macie is useful for discovering and classifying sensitive data, but it does not directly secure the SageMaker deployment.
- C. Correct.
Correct. AWS PrivateLink helps secure communications by restricting network traffic to private endpoints, reducing exposure to the public internet.
- D. Incorrect.
Incorrect. Granting full administrator access violates the principle of least privilege and increases the risk of accidental or malicious misuse.
- E. Correct.
Correct. Creating an IAM role with least privilege ensures SageMaker has access to only the resources it needs, which is a best practice for securing AI systems.