An employee wants to send customer data to a public generative service.
Allow any exception only with controlled risk.
Choose two governance practices.
Define permitted data, services, purposes, and retention, and require an approver, expiry, compensating controls, and audit record for exceptions.
Detailed explanation
Threats, laws, and capabilities change.
Audit and incident response are impaired.
Users can determine what is allowed.
An exception does not become an untracked permanent bypass.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 5.2のガバナンス、コンプライアンス、ポリシー管理を確認する。
Official references
What to confirm
ポリシーと例外を期限・責任・監査付きで管理する理由を説明できる。
Key points
- Policy
- Approval
- Expiry
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
AI use policy
Rules defining permitted purposes, data, services, users, controls, and prohibited use.
Policy exception
An approved departure from a rule for a stated scope, reason, duration, and risk.