Amazon AWS Certified AI Practitioner AIF-C01 Practice Test 70

Question 690

A team plans to enable an unfamiliar agent tool with broad external write capability. What should the team choose?

Add documented review and contestability to the governance plan.
Conduct a tool access and impact risk assessment before activation.
Define ongoing quality, drift and safety monitoring obligations.
Assess vendor data handling, licensing and contractual requirements.

Explanation

Correct Answer

New action integrations can expand the agent's privilege and risk boundary, supporting controlled onboarding of agent tools.

Incorrect Answers

Governance needs meaningful oversight for high-impact outcomes. That is useful for reviewable consequential decisions, not controlled onboarding of agent tools.

Postdeployment control monitoring catches risks that emerge over time. It solves continuous model governance after launch, not controlled onboarding of agent tools.

Model procurement must consider privacy and usage obligations. That addresses compliant model vendor selection, not controlled onboarding of agent tools.

Question 691

A model governance review needs to compare detected bias issues across quarterly releases. Which approach is MOST suitable?

Maintain a risk register with accountable exception owners and due dates.
Track role-based training completion against policy.
Monitor data-access alerts and documented incident response outcomes.
Track subgroup metrics and remediation history by model version.

Explanation

Correct Answer

Versioned fairness measures support longitudinal risk review, supporting fairness governance trend analysis.

Incorrect Answers

Tracked deviations permit prioritized resolution and review. It would support accountable remediation of open AI risks, not fairness governance trend analysis.

Completion evidence helps verify governance awareness activities. That is useful for measurable workforce policy adoption, not fairness governance trend analysis.

Control effectiveness must be observable through events and follow-up. Its primary purpose is privacy control monitoring, not fairness governance trend analysis.

Question 692

A team needs to know who called an AWS API to change an AI application's deployment settings. Which option best matches the requested outcome?

Retrieve applicable reports through AWS Artifact.
Use AWS Config evaluations for supported resources.
Evaluate AWS Audit Manager for structured evidence collection.
Query applicable AWS CloudTrail event history.

Explanation

Correct Answer

CloudTrail records supported account activity and management API calls, supporting attribution of AWS administrative actions.

Incorrect Answers

Artifact provides access to AWS compliance and assurance documents. That addresses cloud provider assurance reports, not attribution of AWS administrative actions.

Config records configuration states and evaluates conformity to rules. It would support ongoing resource configuration compliance, not attribution of AWS administrative actions.

Audit Manager assists evidence gathering and audit-oriented assessments. That is useful for audit evidence organized by controls, not attribution of AWS administrative actions.

Question 693

An auditor needs to know which configured S3 bucket settings violated a defined rule last month. What should the team choose?

Inspect recorded AWS Config compliance and configuration history.
Review AWS Trusted Advisor checks where available.
Review Amazon Inspector vulnerability findings.
Use AWS Security Hub for consolidated findings.

Explanation

Correct Answer

Config tracks resource state changes and rule evaluation outcomes, supporting historical configuration compliance.

Incorrect Answers

Trusted Advisor surfaces selected AWS best-practice recommendations. That addresses cloud account advisory checks, not historical configuration compliance.

Inspector scans supported workloads for vulnerabilities and exposure. It would support software vulnerability assessment, not historical configuration compliance.

Security Hub aggregates and prioritizes compatible cloud security findings. That is useful for integrated cloud threat and posture view, not historical configuration compliance.

Question 694

An audit requires preserving certain AI logs during an open investigation despite ordinary deletion schedules. Which approach is MOST suitable?

Apply approved deletion and verify cleanup of dependent training copies.
Apply a scoped legal or governance hold where required.
Select permitted region and retention configurations for all relevant services.
Configure and enforce suitable retention and deletion rules.

Explanation

Correct Answer

Preservation obligations can supersede ordinary lifecycle deletion, supporting protected evidence during an investigation.

Incorrect Answers

Lifecycle compliance includes secondary datasets, not only the original file. Its primary purpose is deletion of expired model data, not protected evidence during an investigation.

Residency applies to processing, logs and supporting data flows. That addresses authorized location of AI data, not protected evidence during an investigation.

Data lifecycle policy must govern how long records persist. It would support time-bounded interaction storage, not protected evidence during an investigation.

Question 695

A critical model incident occurs but escalation responsibilities are undefined. Which solution directly addresses this scenario?

Maintain incident escalation and governance decision procedures.
Assign clear accountable AI system owners and approval roles.
Establish periodic review cadence and documented reassessment criteria.
Provide role-appropriate AI security and data-handling training.

Explanation

Correct Answer

Defined response ownership reduces delays when AI failures occur, supporting clear AI incident response authority.

Incorrect Answers

Governance starts with responsibility for controls and incidents. Its primary purpose is accountable AI oversight, not clear AI incident response authority.

Governance is an ongoing process as risks and systems change. It solves scheduled AI control reevaluation, not clear AI incident response authority.

Policy effectiveness depends partly on user awareness and conduct. That addresses workforce understanding of AI obligations, not clear AI incident response authority.

Question 696

A compliance architect wants a standard way to compare different AWS GenAI deployment patterns and control obligations. Which option best matches the requested outcome?

Use the AWS Generative AI Security Scoping Matrix as governance context.
Scope shared responsibilities based on its managed-model consumption pattern.
Reassess data and model customization responsibilities.
Include infrastructure, training and serving in its governance assessment.

Explanation

Correct Answer

The matrix helps categorize deployment approaches and associated responsibilities, supporting structured AI security scoping.

Incorrect Answers

GenAI control ownership depends on how much of the solution the customer operates. That is useful for governance boundary for hosted-model use, not structured AI security scoping.

Fine-tuning introduces additional training-data and artifact risks. Its primary purpose is model-customization control scope, not structured AI security scoping.

Self-managed AI expands customer operational responsibilities. It solves full-stack AI control ownership, not structured AI security scoping.

Question 697

A control owner needs proof that reviewer approvals occurred before a production model change. What should the team choose?

Preserve approval decisions and change records in an audit trail.
Maintain model and dataset lineage in governed records.
Require citations that resolve to approved evidence.
Record model version, prompt version and relevant request identifiers.

Explanation

Correct Answer

Documented approvals demonstrate the change process actually operated, supporting evidence of authorized AI release.

Incorrect Answers

Provenance connects deployed artifacts to original training inputs. It would support traceability of model training data, not evidence of authorized AI release.

Source attribution supports external review and contradiction detection. That is useful for validated response provenance, not evidence of authorized AI release.

Versioned evidence supports incident reconstruction. Its primary purpose is reproducible AI interaction history, not evidence of authorized AI release.

Question 698

A customer requests deletion of personal AI interaction records under an applicable policy. Which approach is MOST suitable?

Require lawful sourcing and data-use authorization before ingestion.
Minimize and protect personal data in the training corpus.
Establish version ownership and source-of-truth controls.
Follow data subject and retention deletion workflows with evidence.

Explanation

Correct Answer

Privacy governance includes compliant handling of deletion obligations, supporting lawful removal of personal interaction data.

Incorrect Answers

Data provenance and consent are governance requirements. It solves approved dataset collection rights, not lawful removal of personal interaction data.

Privacy controls reduce unneeded sensitive-data exposure. That addresses minimum personal data used for AI, not lawful removal of personal interaction data.

Governed data quality avoids inconsistent model grounding. It would support trustworthy approved knowledge versions, not lawful removal of personal interaction data.

Question 699

A company has no way to detect degradation after an AI model changes. Which solution directly addresses this scenario?

Define ongoing quality, drift and safety monitoring obligations.
Assess vendor data handling, licensing and contractual requirements.
Add documented review and contestability to the governance plan.
Conduct a tool access and impact risk assessment before activation.

Explanation

Correct Answer

Postdeployment control monitoring catches risks that emerge over time, supporting continuous model governance after launch.

Incorrect Answers

Model procurement must consider privacy and usage obligations. It solves compliant model vendor selection, not continuous model governance after launch.

Governance needs meaningful oversight for high-impact outcomes. That addresses reviewable consequential decisions, not continuous model governance after launch.

New action integrations can expand the agent's privilege and risk boundary. It would support controlled onboarding of agent tools, not continuous model governance after launch.

Question 700

An AI project has compliance policies but no documented owners for open exceptions. Which option best matches the requested outcome?

Track role-based training completion against policy.
Monitor data-access alerts and documented incident response outcomes.
Track subgroup metrics and remediation history by model version.
Maintain a risk register with accountable exception owners and due dates.

Explanation

Correct Answer

Tracked deviations permit prioritized resolution and review, supporting accountable remediation of open AI risks.

Incorrect Answers

Completion evidence helps verify governance awareness activities. That is useful for measurable workforce policy adoption, not accountable remediation of open AI risks.

Control effectiveness must be observable through events and follow-up. Its primary purpose is privacy control monitoring, not accountable remediation of open AI risks.

Versioned fairness measures support longitudinal risk review. It solves fairness governance trend analysis, not accountable remediation of open AI risks.