5.2Basic
Prompt logs and model calls need protection.
Check encryption boundaries.
Choose two controls.
× Incorrect
Encrypt logs, stores, and backups at rest and use TLS for transfers, with key permissions, rotation, and monitoring.
Detailed explanation
CorrectEncrypt logs, stores, and backups at rest and manage key access
Media leakage is reduced.
CorrectUse TLS for transfers and monitor certificates, endpoints, and cipher settings
Network interception is reduced.
IncorrectEncryption removes the need for key rotation and access control
A leaked key decrypts data.
IncorrectAt-rest encryption makes plaintext transit acceptable
The network is a separate risk.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 5.2の保存時暗号化、転送時暗号化、鍵管理を確認する。
Official references
What to confirm
保存と通信の両方の暗号化境界と鍵管理を説明できる。
Key points
- At rest
- In transit
- Key management
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Encryption at rest
Protection applied while data is stored in a service, database, log, or backup.
Encryption in transit
Protection applied while data travels between clients, services, or networks.
Question IDAWS-AIF-467
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue