5.2Basic
A user includes an API key in text for summarization.
Prevent storage and display.
Choose two controls.
× Incorrect
Inspect and mask secrets in input and output, and keep authentication in a secret manager with short-lived least-privilege credentials.
Detailed explanation
CorrectStore credentials in a secret manager and use short-lived least-privilege access
Authentication is separate from prompts.
IncorrectThe model will encrypt any secret it receives
It is not a secret manager.
IncorrectKeep secrets in shared logs for debugging
Exposure expands.
CorrectInspect and mask secrets so they do not reach logs, display, or tool arguments
Exposure paths are reduced.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 5.2のシークレット、認証、ログ保護を確認する。
Official references
What to confirm
プロンプトを秘密情報の保管場所にせず、認証経路を分離できる。
Key points
- Secret
- Masking
- Short-lived credential
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Secret management
Controlled storage, retrieval, rotation, and access of sensitive credentials.
Short-lived credential
Authentication material that expires after a limited period.
Question IDAWS-AIF-449
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue