3.1Standard
Department documents share one index.
Hide unauthorized evidence.
Choose two controls.
× Incorrect
Apply identity-based filters before retrieval and test allow/deny cases, audit logs, and citation authorization.
Detailed explanation
CorrectTest allow and deny cases and recheck permission for citations
Boundaries are verified.
IncorrectRely on a prompt saying not to reveal secrets
The model is not an authorization layer.
CorrectApply user or service permissions to the retrieval filter before candidates are returned
Unauthorized evidence is excluded.
IncorrectUse one broad shared identity for every user
Least privilege is violated.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 3.1・5.2の検索認可、最小権限、監査を確認する。
Official references
What to confirm
モデルの指示だけに頼らず、検索・引用・監査の各段階で権限を適用できる。
Key points
- Authorization filter
- Least privilege
- Audit
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Authorization filter
A predicate that limits retrieval to resources permitted for a principal.
Least privilege
Granting only the actions and resources required for a defined purpose.
Question IDAWS-AIF-442
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue