Encrypting data at rest and in transit | AWS Certified AI Practitioner (AIF-C01) original practice question

5.2Basic

Prompt logs and model calls need protection.

Check encryption boundaries.

Choose two controls.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

Detailed explanation

CorrectEncrypt logs, stores, and backups at rest and manage key access

Media leakage is reduced.

CorrectUse TLS for transfers and monitor certificates, endpoints, and cipher settings

Network interception is reduced.

IncorrectAt-rest encryption makes plaintext transit acceptable

The network is a separate risk.

IncorrectEncryption removes the need for key rotation and access control

A leaked key decrypts data.

An example you can run in a temporary verification environment.

AWS公式AIF-C01 Domain 5.2の保存時暗号化、転送時暗号化、鍵管理を確認する。

保存と通信の両方の暗号化境界と鍵管理を説明できる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-467

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20