An application sends sensitive data to an AI service.
Reduce exposure to the public internet.
Choose two appropriate network practices.
Use private connectivity where supported and restrict subnets, security groups, routes, and network logs; network controls complement IAM and encryption.
Detailed explanation
Exposure and route control risk increase.
The service can be reached privately where supported.
Unnecessary routes can be reduced and audited.
It is only one defense layer.
Check official documentation
Compare the following points with the official documentation.
AWS公式VPCエンドポイント・PrivateLink・IAMとAIF-C01 Domain 5.1を確認する。
Official references
What to confirm
プライベート経路と、ネットワークだけでは十分でない防御層を説明できる。
Key points
- Private connectivity
- Route control
- Defense in depth
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
VPC endpoint
A private entry point from a VPC to supported services without requiring internet routing.
AWS PrivateLink
A technology for private service connectivity that keeps traffic on the AWS network.