An application sends sensitive data to an AI service.
Reduce exposure to the public internet.
Choose two appropriate network practices.
Use private connectivity where supported and restrict subnets, security groups, routes, and network logs; network controls complement IAM and encryption.
Detailed explanation
The service can be reached privately where supported.
The service can be reached privately where supported.
Unnecessary routes can be reduced and audited.
Unnecessary routes can be reduced and audited.
Exposure and route control risk increase.
Exposure and route control risk increase.
It is only one defense layer.
It is only one defense layer.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式VPCエンドポイント・PrivateLink・IAMとAIF-C01 Domain 5.1を確認する。Expected result
プライベート経路と、ネットワークだけでは十分でない防御層を説明できる。Key points
- Private connectivity
- Route control
- Defense in depth
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.