Home / AWS Certified AI Practitioner (AIF-C01) / 5 Practice / AWS-AIF-386
Only an internal application should call an inference API.
Prevent unauthenticated direct calls.
Choose two controls.
Hint 1: Focus on the trust boundary Separate who may call the endpoint from what each caller may do, then add controls for transport, abuse, and audit.
Hint 2: Key terms Review the identity, permission, transport, abuse-control, and audit concepts behind an inference endpoint.
AuthenticationThe process of verifying which user or service is making a request.
AuthorizationThe decision about whether an authenticated principal may perform an operation on a resource.
TLSA protocol that authenticates the peer and protects data while it travels across a network.
Short-lived tokenA credential with a limited validity period, reducing exposure if it is disclosed.
Rate limitingA control that caps requests during a time window to reduce abuse and resource exhaustion.
Audit logA record of who performed which operation and when, used for investigation and accountability. × Incorrect Separate caller authentication and authorization, and combine TLS, short-lived tokens, rate limits, audit logs, and input-size limits.
Detailed explanation A Correct Use TLS, short-lived tokens, rate limits, audit logs, and input limits
Communication, abuse, and traceability are protected.
B Correct Check caller authentication separately from per-API authorization
Identity and allowed action are controlled.
C Incorrect Embed an API key in a URL or client code
It can leak easily.
D Incorrect Trust network location and omit authentication
Internal compromise remains possible.
Check official documentation Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 5.1の推論エンドポイント、IAM、認証、監査を確認する。
Official references Official documentation 1 Official documentation 2 What to confirm 推論APIへの呼出し主体・権限・通信・濫用を多層で制御できる。
Key points Authentication Authorization Short-lived token Notes Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認 Check the endpoint documentation for supported authentication, authorization, token, and transport controls. Keep API keys out of URLs and client-side code; treat them as secrets that need rotation and restricted scope. Foundation review Authentication The process of verifying which user or service is making a request.
Authorization The decision about whether an authenticated principal may perform an operation on a resource.
Defense in depth Using independent controls so that a network boundary or one credential does not become the only protection.
Path & Pass is an independent learning site and is not affiliated with any certification body. Questions are original practice content based on published objectives.
