5.1Standard
A VPC application connects privately to S3 and inference.
Avoid the public Internet and limit allowed operations.
Choose two designs.
× Incorrect
Combine endpoint, route, security-group, IAM, resource-policy, and endpoint-policy controls with audit logging.
Detailed explanation
IncorrectAllow every bucket because the endpoint is private
The scope is still too broad.
IncorrectSkip monitoring policy changes on an internal network
Misconfiguration and compromise may go undetected.
CorrectUse IAM, resource policies, and audit logs to verify principal, resource, and action
Private routing does not remove authorization and audit needs.
CorrectCombine VPC endpoint, routes, security groups, and endpoint policy
Both path and permitted operations are controlled.
Check official documentation
Compare the following points with the official documentation.
AWS公式VPCエンドポイント、IAM、PrivateLinkとAIF-C01 Domain 5.1を確認する。
Official references
What to confirm
ネットワーク分離と認可・監査を別の防御層として設計できる。
Key points
- VPC endpoint
- Endpoint policy
- Defense in depth
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
VPC endpoint
A private connection point from a VPC to a supported AWS service.
Endpoint policy
A resource policy that limits which requests may pass through an endpoint.
Question IDAWS-AIF-222
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue