AIF-C01 Question 211
Select 2A financial services company is deploying an AI-based recommendation system on AWS to provide personalized investment suggestions to its customers. Due to the sensitive nature of the data, the company is concerned about securing customer data and preventing unauthorized access or malicious activity. Which of the following actions should the company take to address these security and privacy concerns? (Select TWO.)
- A
Use Amazon S3 with default bucket settings to store customer data.
- B
Enable encryption both at rest and in transit for all customer data.
- C
Implement AWS Identity and Access Management (IAM) roles to control access to the AI system.
- D
Disable logging to reduce the risk of exposing sensitive operational details.
- E
Use AWS Key Management Service (KMS) to manage encryption keys securely.
Show answer and explanation
Correct answers: B, E
Explanation
To secure sensitive data for an AI-based system, encryption (at rest and in transit) and secure key management are critical. AWS KMS ensures encryption keys are handled securely, while enabling encryption protects data from unauthorized access. IAM roles and logging are also important but are not specifically related to encryption or key management in this scenario.
- A. Incorrect.
Default bucket settings in Amazon S3 may not enforce encryption or access controls, which could lead to unauthorized access. It is important to customize these settings for security.
- B. Correct.
Encrypting data both at rest and in transit ensures that customer data remains protected from unauthorized access, even if intercepted or accessed maliciously.
- C. Incorrect.
While IAM roles are essential for access control, they alone do not address encryption or secure key management, which are critical for sensitive data protection.
- D. Incorrect.
Disabling logging is not a security best practice. Logging is essential for threat detection, auditing, and identifying suspicious activity.
- E. Correct.
AWS KMS provides a secure and managed way to handle encryption keys, ensuring that sensitive data encryption and decryption processes are protected.