AWS Certified AI Practitioner AIF-C01 Updated Exam

The verified answer is C. Amazon Inspector. The company needs automated vulnerability assessment for Amazon EC2-based infrastructure. AWS documentation states that Amazon Inspector scans EC2 instances for package vulnerabilities and network reachability issues and produces findings. It compares instance metadata against vulnerability intelligence and security advisory rules. This is exactly the service used to assess EC2 infrastructure before deploying sensitive workloads such as generative AI models.

AWS also documents that Amazon Inspector scans EC2 instances for common vulnerabilities and exposures, operating system package vulnerabilities, programming language package vulnerabilities, network exposure issues, and network reachability issues. This confirms that Inspector is the correct service for automated vulnerability assessment of EC2-based ML infrastructure.

AWS CloudFormation is incorrect because it provisions infrastructure as code. It can create EC2 instances, security groups, and related resources, but it does not perform vulnerability assessment. Amazon Comprehend is incorrect because it is a natural language processing service used to extract insights from text. It does not scan infrastructure. AWS Trusted Advisor is incorrect because it provides best-practice recommendations across categories such as cost optimization, security, performance, and service limits, but it is not the dedicated automated vulnerability assessment service for EC2 instances.

The requirement is specific: scan EC2-based ML infrastructure for vulnerabilities before deployment. The AWS-native service that performs this function is Amazon Inspector.

BLEU (Bilingual Evaluation Understudy) is the standard metric for evaluating machine translation quality across multiple languages.

ROUGE is for summarization quality (not translation).

AUC is for classification model performance.

Precision is a general metric but not specific for evaluating translations.

???? Reference:

AWS Documentation – Evaluation Metrics for NLP

The verified answer is B. Data leakage. The model exposes sensitive company information because that information was inadvertently included in training data. AWS guidance warns that using sensitive data to train models can cause unintended disclosure of data from model output, including data leakage during inference. This is exactly the scenario: sensitive information entered the training process and later appeared in model output after deployment.

AWS security reference guidance for generative AI model customization identifies sensitive information disclosure as a threat where a model trained on datasets containing PII leaks sensitive information during inference. Although the question says company information rather than PII specifically, the same security principle applies: protected data included in training or continued pre-training can be memorized or reproduced by the model later.

Jailbreaking is incorrect because jailbreaking refers to attempts to bypass model safety controls through adversarial prompts. The problem here is not that a user bypassed safety controls; the sensitive information was already embedded through training data.

Contextual grounding is incorrect because grounding is a technique for improving answer accuracy by connecting model responses to trusted context, such as RAG sources. It is not a security risk.

Prompt injection is incorrect because prompt injection involves malicious input that attempts to override or manipulate model behavior at inference time. The question does not describe a malicious prompt. It describes accidental exposure from training data.

Therefore, the correct security risk is data leakage.

AWS PrivateLink enables private connectivity between VPCs and AWS services without exposing traffic to the public internet. This feature is critical for meeting regulatory compliance standards that require isolation from public internet traffic.

Option A (Correct): " AWS PrivateLink " : This is the correct answer because it allows secure access to Amazon Bedrock and other AWS services from a VPC without internet access, ensuring compliance with regulatory standards.

Option B: " Amazon Macie " is incorrect because it is a security service for data classification and protection, not for managing private network traffic.

Option C: " Amazon CloudFront " is incorrect because it is a content delivery network service and does not provide private network connectivity.

Option D: " Internet gateway " is incorrect as it enables internet access, which violates the VPC ' s no-internet-traffic policy.

AWS AI Practitioner References:

AWS PrivateLink Documentation: AWS highlights PrivateLink as a solution for connecting VPCs to AWS services privately, which is essential for organizations with strict regulatory requirements.