Rotating secrets | AWS Certified AI Practitioner (AIF-C01) original practice question

5.1Standard

An AI application uses an external API secret.

Rotate it without unnecessary downtime and limit leakage.

Choose two practices.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

Secrets Managerなどへ保存し、アプリへは必要時に取得させる: Secrets are separated from source and images.
自動ローテーション、二重キー期間、利用監視、失効手順を用意する: Updates and emergency invalidation are operable.
環境変数ならログやダンプに出ても安全とみなす: Runtime diagnostics can expose them.
一つの秘密を全環境で無期限に共有する: Blast radius and recovery cost grow.

Detailed explanation

CorrectStore the secret in a service such as Secrets Manager and retrieve it when needed

Secrets are separated from source and images.

CorrectUse automatic rotation, an overlap window, monitoring, and revocation procedures

Updates and emergency invalidation are operable.

IncorrectTreat environment variables as safe even in logs and dumps

Runtime diagnostics can expose them.

IncorrectShare one secret across all environments indefinitely

Blast radius and recovery cost grow.

An example you can run in a temporary verification environment.

AWS Secrets Manager公式のローテーション、IAM、監査とAIF-C01 Domain 5.1を確認する。

API秘密情報を保管・取得・更新・失効のライフサイクルで管理できる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-223

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20