5.1Standard
An AI workload may connect only to approved AWS services.
Prevent unexpected model or log exfiltration.
Choose two designs.
× Incorrect
Combine routes, security groups, network ACLs, proxies, and allow-lists, then monitor destination, volume, failures, and changes.
Detailed explanation
CorrectMonitor egress destination, volume, failures, and configuration changes
Exfiltration and misconfiguration can be detected.
IncorrectAllow all destinations and ports for external APIs
Attack and exfiltration surface grows.
CorrectCombine routes, security groups, network ACLs, proxies, and destination allow-lists
Paths and destinations are limited.
IncorrectTreat outbound traffic as harmless because it is a response
Data and destination are still risks.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 5.1のネットワーク、最小権限、データ保護を確認する。
Official references
What to confirm
AIワークロードの外向き通信もセキュリティ境界として設計できる。
Key points
- Allow list
- Egress
- Monitoring
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Egress control
A rule that limits traffic leaving a workload by destination, port, protocol, or route.
Allowlist
An explicit list of destinations, identities, or actions that are permitted.
Question IDAWS-AIF-266
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue