Minimizing key access | AWS Certified AI Practitioner (AIF-C01) original practice question

5.2Standard

KMS keys protect AI logs and data.

Limit who can decrypt.

Choose two designs.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

暗号化・復号の主体、用途、リソース、条件、期間をIAMポリシーで限定する: Unneeded decryption is blocked.
管理操作とデータ利用のログ、拒否アラート、定期レビュー、緊急無効化を設定する: Misuse can be detected and stopped.
鍵を使える権限を全てのアプリケーションへ付与する: Least privilege is violated.
暗号化されていれば鍵の拒否ログは監視しなくてよい: Attack signals are missed.

Detailed explanation

CorrectLimit encryption and decryption by principal, purpose, resource, condition, and duration

Unneeded decryption is blocked.

CorrectMonitor use, denials, administrative actions, review, and emergency disablement

Misuse can be detected and stopped.

IncorrectGive every application permission to use the key

Least privilege is violated.

IncorrectIgnore denied key operations because data is encrypted

Attack signals are missed.

An example you can run in a temporary verification environment.

AWS公式AIF-C01 Domain 5.2のKMS、IAM、鍵アクセス監視を確認する。

暗号化を鍵の保護まで含むアクセス制御として運用できる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-502

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20