5.1Standard
Log prompts and outputs for troubleshooting.
Do not retain card numbers or personal data.
Choose two designs.
× Incorrect
Detect and mask or tokenize sensitive values before logging, and audit log access, retention, copying, export, and deletion requests.
Detailed explanation
CorrectAudit log access, retention, copying, export, and deletion handling
Logs have their own data lifecycle.
IncorrectTreat internal logs as requiring no access separation
Insider misuse and compromise remain possible.
IncorrectSave all secrets unmodified for incident investigation
The log becomes a source of leakage.
CorrectDetect, mask, or tokenize sensitive values before recording and keep only needed identifiers
Troubleshooting and confidentiality are balanced.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 5.1のログ保護、データ最小化、Guardrailsを確認する。
Official references
What to confirm
調査用ログへ必要な証跡を残しつつ機密情報を最小化できる。
Key points
- Masking
- Tokenization
- Log retention
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Log masking
Hiding or replacing personal data, secrets, or other sensitive values before logging.
Log lifecycle
The stages of collecting, accessing, sharing, retaining, deleting, and auditing logs.
Question IDAWS-AIF-309
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue