AIF-C01 Question 212
Select 2You are designing an AI system to process sensitive financial data. To ensure the security and privacy of this system, which of the following measures should you implement? (Select TWO)
- A
Encrypt data both at rest and in transit using AWS Key Management Service (KMS).
- B
Use an open-source library for encryption without verifying its security standards.
- C
Implement IAM policies to restrict access to the AI system based on user roles.
- D
Disable logging to prevent sensitive data from being recorded in CloudWatch.
- E
Enable Amazon Macie to detect and protect sensitive data stored in S3 buckets.
Show answer and explanation
Correct answers: A, C
Explanation
To ensure the security and privacy of an AI system handling sensitive financial data, implementing encryption for data at rest and in transit (using AWS KMS) and enforcing access control through IAM policies are critical measures. These practices safeguard data from unauthorized access and maintain compliance with security standards. While tools like Amazon Macie are helpful, they are additional layers of protection, not core requirements for data security.
- A. Correct.
Encrypting data at rest and in transit ensures that sensitive information is protected from unauthorized access during storage and transmission. AWS KMS provides a secure mechanism for encryption management.
- B. Incorrect.
Using open-source libraries without verifying their security standards can introduce vulnerabilities into the system and compromise sensitive data.
- C. Correct.
Implementing IAM (Identity and Access Management) policies allows fine-grained control over access to the AI system, ensuring that only authorized users or services can interact with it.
- D. Incorrect.
Disabling logging is not a recommended practice. Instead, sensitive data should be redacted or encrypted in logs to maintain observability while protecting privacy.
- E. Incorrect.
Amazon Macie is a useful tool for detecting sensitive data, but it complements, rather than replaces, encryption and IAM policies. While valuable, it is not sufficient as a standalone measure for securing an AI system.