Restricting resource policies | AWS Certified AI Practitioner (AIF-C01) original practice question

5.1Standard

An inference service should read one S3 bucket.

A cross-account path is also required.

Choose two designs.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

Detailed explanation

CorrectSpecify principal, action, resource ARN, conditions, and external account

The intended scope is explicit.

CorrectTest trust, resource, SCP, and explicit-deny policy evaluation together

Combined authorization is verified.

IncorrectAllow an entire bucket with a wildcard

Least privilege is lost.

IncorrectAllow another account without checking trust

An unintended principal may gain access.

An example you can run in a temporary verification environment.

AWS IAM公式とAIF-C01 Domain 5.1のリソースポリシー、SCP、最小権限を確認する。

AIサービスのリソースアクセスを主体・操作・ARN・条件で限定できる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-364

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20