Preventing secrets in prompts | AWS Certified AI Practitioner (AIF-C01) original practice question

5.2Basic

A user includes an API key in text for summarization.

Prevent storage and display.

Choose two controls.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

入力と出力を検査して秘密情報をマスキングし、保存・表示・ツール引数へ流さない: Exposure paths are reduced.
秘密情報はシークレット管理へ保管し、短期資格情報と最小権限を使う: Authentication is separate from prompts.
モデルへ秘密情報を渡せばモデルが安全に暗号化してくれる: It is not a secret manager.
共有ログへ秘密情報を残してデバッグを容易にする: Exposure expands.

Detailed explanation

CorrectInspect and mask secrets so they do not reach logs, display, or tool arguments

Exposure paths are reduced.

CorrectStore credentials in a secret manager and use short-lived least-privilege access

Authentication is separate from prompts.

IncorrectThe model will encrypt any secret it receives

It is not a secret manager.

IncorrectKeep secrets in shared logs for debugging

Exposure expands.

An example you can run in a temporary verification environment.

AWS公式AIF-C01 Domain 5.2のシークレット、認証、ログ保護を確認する。

プロンプトを秘密情報の保管場所にせず、認証経路を分離できる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-449

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20