Pass AIF-C01 Exam Guide

AWS Artifact provides compliance reports and certifications (ISO, SOC, GDPR-related documentation) to prove regulatory adherence.

To manage the flow of data from Amazon S3 to SageMaker Studio notebooks securely, using a VPC with an S3 endpoint is the best solution.

Amazon SageMaker and S3 Integration:

Configuring SageMaker to use a Virtual Private Cloud (VPC) with an S3 endpoint allows the data flow between Amazon S3 and SageMaker Studio notebooks to occur over a private network.

This setup ensures that traffic between SageMaker and S3 does not traverse the public internet, enhancing security and performance.

Why Option C is Correct:

Secure Data Transfer: Ensures secure, private connectivity between SageMaker and S3, reducing exposure to potential security risks.

Direct Access to S3: Using an S3 endpoint in a VPC allows direct access to data in S3 without leaving the AWS network.

Why Other Options are Incorrect:

A. Amazon Inspector: Focuses on identifying security vulnerabilities, not managing data flow.

B. Amazon Macie: Monitors for sensitive data but does not manage data flow between S3 and SageMaker.

D. S3 Glacier Deep Archive: Is a storage class for archiving data, not for managing active data flow.

To comply with the company ' s security policy, which restricts each team to access data for only their own customers, creating an Amazon Bedrock custom service role for each team is the correct solution.

Custom Service Role Per Team:

A custom service role for each team ensures that the access control is granular, allowing only specific teams to access their own customer data in Amazon S3.

This setup aligns with the principle of least privilege, ensuring teams can only interact with data they are authorized to access.

Why Option A is Correct:

Access Control: Allows precise access permissions for each team ' s data.

Security Compliance: Directly meets the company ' s security policy requirements by ensuring data segregation.

Why Other Options are Incorrect:

B. Custom service role with customer name specification: This approach is impractical as it relies on manual input, which is prone to errors and does not inherently enforce data access controls.

C. Redacting personal data and updating S3 bucket policy: Redaction does not solve the requirement for team-specific access, and updating bucket policies is less granular than creating roles.

D. One Bedrock role with full S3 access and IAM roles for teams: This setup does not meet the least privilege principle, as having a single role with full access is contrary to the company ' s security policy.

Thus, A is the correct answer to meet the company ' s security requirements.

The correct answer is D because autoencoders are an unsupervised machine learning method commonly used for anomaly detection when labeled data is not available.

From AWS documentation:

" Autoencoders learn to compress and reconstruct input data. During anomaly detection, they learn normal patterns in data. Data points that the model cannot accurately reconstruct are flagged as anomalies. "

This approach is ideal when there is no labeled data and when patterns must be learned based on normal behavior alone — a common situation in IoT sensor data environments.

Explanation of other options:

A. Linear regression requires labeled data and is used for predicting continuous values.

B. Classification requires labeled data to assign inputs into categories.

C. Decision trees are supervised learning models and also require labeled datasets.

Referenced AWS AI/ML Documents and Study Guides:

AWS Machine Learning Specialty Guide – Unsupervised Learning Techniques

Amazon SageMaker Examples – Anomaly Detection Using Autoencoders