Home / AWS Certified AI Practitioner (AIF-C01) / 5 Practice / AWS-AIF-087
An application in a VPC accesses an AI service and sensitive S3 data.
Avoid unnecessary Internet paths and use least privilege.
Choose two appropriate controls.
Hint 1: Focus on the requirement Combine a private network path with identity, resource, and transport controls; no single boundary replaces the others.
Hint 2: Key terms Review the AWS network and authorization boundaries used to protect AI data.
VPC endpointA private entry point from a VPC to a supported AWS service or endpoint service.
AWS PrivateLinkA technology for privately connecting to endpoint services without exposing traffic through the public internet.
Security groupA stateful virtual firewall that controls allowed traffic for associated network interfaces.
Resource policyA policy attached to a resource that controls which principals may access it.
Defense in depthUsing independent network, identity, resource, encryption, and audit controls together. × Incorrect Consider private service connectivity and layer network controls with IAM and resource policies.
Detailed explanation A Incorrect Allow every source to read S3
This is broader than the requirement.
B Correct Use an appropriate VPC endpoint or private path
Private connectivity reduces dependence on public paths.
C Correct Combine security groups, IAM, and bucket policies
Network and API/resource controls protect different layers.
D Incorrect Assume authorization is unnecessary after using a private path
Network isolation and authorization are separate controls.
Check official documentation Compare the following points with the official documentation.
AWS公式VPCエンドポイント、Amazon S3ポリシー、AIサービス接続の説明を確認する。
Official references Official documentation 1 Official documentation 2 What to confirm ネットワーク隔離と認可を別レイヤーとして設計できる。
Key points VPC endpoint Defense in depth Authorization Notes Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認 Compare the definition with the AIF-C01 objective and the service documentation before applying it. Keep the concept separate from a particular answer choice or implementation step. Foundation review Network versus identity A private route limits reachability but does not itself decide which principal may access data.
Resource scope Bucket or service policies can restrict actions and resources beyond the network boundary.
Path & Pass is an independent learning site and is not affiliated with any certification body. Questions are original practice content based on published objectives.
