Limiting secret read access | AWS Certified AI Practitioner (AIF-C01) original practice question

5.1Standard

A generation app uses one external API secret.

Other services in the account must not read it.

Choose two designs.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

Detailed explanation

CorrectSeparate a read role per secret or purpose and grant it only to the target app

Exposure blast radius is limited.

CorrectAudit retrieval, use, rotation, and failures and remove unused secrets

The secret lifecycle is traceable.

IncorrectGive every app Secrets Manager administrator access

All secrets can be read.

IncorrectRetry secret failures without a limit

Outages and leaks can be amplified.

An example you can run in a temporary verification environment.

AWS Secrets Manager・IAM公式とAIF-C01 Domain 5.1の最小権限を確認する。

秘密管理サービスの利用と、秘密ごとの読み取り境界を設計できる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-288

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20