Amazon AWS AIP-C01 Data Security and Privacy Controls Practice Test

 

Topic 13 focuses on Data Security and Privacy Controls for the AWS Certified Generative AI Developer – Professional certification and the AIP-C01 exam, using Amazon Bedrock and AWS generative AI services and architecture scenarios where relevant. For broader exam preparation, review the AWS Certified Generative AI Developer – Professional AIP-C01 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

The enterprise search architecture group needs an architecture that can keep supported service traffic on private network paths without traversing the public internet. Which choice best meets that need?

1. VPC endpoints for AWS services
2. data masking
3. least-privilege IAM policies
4. Amazon Macie

Correct Answer: A

 

Correct Answer

Answer A is correct because VPC endpoints for AWS services is designed to keep supported service traffic on private network paths without traversing the public internet. It uses AWS privatelink-backed endpoints so VPC resources can reach supported services privately.

Incorrect Answers

Answer B is incorrect because data masking is primarily used to replace sensitive values with controlled surrogates while preserving useful data shape, which is a different requirement from the one being tested.

Answer C is incorrect because least-privilege IAM policies is primarily used to limit each GenAI component to only the resources and actions required for its function, which is a different requirement from the one being tested.

Answer D is incorrect because Amazon Macie is primarily used to discover sensitive data such as personally identifiable information in Amazon S3, which is a different requirement from the one being tested.

 

Question 2

The insurance automation team must limit each GenAI component to only the resources and actions required for its function. Which approach is the strongest fit?

1. least-privilege IAM policies
2. Amazon Comprehend PII detection
3. AWS Lake Formation
4. data anonymization

Correct Answer: A

 

Correct Answer

Answer A is correct because least-privilege IAM policies is designed to limit each GenAI component to only the resources and actions required for its function. It reduces blast radius by granting narrowly scoped identity permissions instead of broad administrative access.

Incorrect Answers

Answer B is incorrect because Amazon Comprehend PII detection is primarily used to detect personally identifiable information in text before model processing, which is a different requirement from the one being tested.

Answer C is incorrect because AWS Lake Formation is primarily used to apply granular authorization to governed data lake resources used by GenAI workloads, which is a different requirement from the one being tested.

Answer D is incorrect because data anonymization is primarily used to remove or transform identifying attributes so individuals cannot reasonably be linked to the processed dataset, which is a different requirement from the one being tested.

 

Question 3

The procurement automation group has a design goal to apply granular authorization to governed data lake resources used by GenAI workloads. What should the team choose?

1. CloudWatch data-access monitoring
2. AWS Lake Formation
3. Bedrock privacy controls
4. Guardrails sensitive-information filters

Correct Answer: B

 

Correct Answer

Answer B is correct because AWS Lake Formation is designed to apply granular authorization to governed data lake resources used by GenAI workloads. It centralizes fine-grained permissions for cataloged data rather than relying only on coarse storage-level access.

Incorrect Answers

Answer A is incorrect because CloudWatch data-access monitoring is primarily used to detect abnormal access or operational patterns around sensitive GenAI data flows, which is a different requirement from the one being tested.

Answer C is incorrect because Bedrock privacy controls are primarily used to use managed foundation models without allowing application data to become a customer-visible shared training corpus, which is a different requirement from the one being tested.

Answer D is incorrect because Guardrails sensitive-information filters is primarily used to detect and block or mask configured sensitive information in model interactions, which is a different requirement from the one being tested.

 

Question 4

The observability engineering group must detect abnormal access or operational patterns around sensitive GenAI data flows. Which approach is the strongest fit?

1. S3 Lifecycle retention policy
2. Amazon Macie
3. CloudWatch data-access monitoring
4. AWS KMS encryption

Correct Answer: C

 

Correct Answer

Answer C is correct because CloudWatch data-access monitoring is designed to detect abnormal access or operational patterns around sensitive GenAI data flows. It collects metrics and logs that can trigger alerts when access behavior deviates from expected baselines.

Incorrect Answers

Answer A is incorrect because S3 Lifecycle retention policy is primarily used to delete or transition stored GenAI interaction data according to retention requirements, which is a different requirement from the one being tested.

Answer B is incorrect because Amazon Macie is primarily used to discover sensitive data such as personally identifiable information in Amazon S3, which is a different requirement from the one being tested.

Answer D is incorrect because AWS KMS encryption is primarily used to protect stored GenAI data with centrally managed encryption keys and access controls, which is a different requirement from the one being tested.

 

Question 5

The managed services operations team has a design goal to discover sensitive data such as personally identifiable information in Amazon S3. What should the team choose?

1. Amazon Comprehend PII detection
2. VPC endpoints for AWS services
3. data masking
4. Amazon Macie

Correct Answer: D

 

Correct Answer

Answer D is correct because Amazon Macie is designed to discover sensitive data such as personally identifiable information in Amazon S3. It uses managed data security and classification capabilities to identify sensitive information stored in S3 buckets.

Incorrect Answers

Answer A is incorrect because Amazon Comprehend PII detection is primarily used to detect personally identifiable information in text before model processing, which is a different requirement from the one being tested.

Answer B is incorrect because VPC endpoints for AWS services is primarily used to keep supported service traffic on private network paths without traversing the public internet, which is a different requirement from the one being tested.

Answer C is incorrect because data masking is primarily used to replace sensitive values with controlled surrogates while preserving useful data shape, which is a different requirement from the one being tested.

 

Question 6

The service management platform is prioritizing a requirement to detect personally identifiable information in text before model processing. Which implementation is most appropriate?

1. Bedrock privacy controls
2. Amazon Comprehend PII detection
3. data anonymization
4. least-privilege IAM policies

Correct Answer: B

 

Correct Answer

Answer B is correct because Amazon Comprehend PII detection is designed to detect personally identifiable information in text before model processing. It returns identified PII entities and locations so applications can redact, mask, or route text safely.

Incorrect Answers

Answer A is incorrect because Bedrock privacy controls are primarily used to use managed foundation models without allowing application data to become a customer-visible shared training corpus, which is a different requirement from the one being tested.

Answer C is incorrect because data anonymization is primarily used to remove or transform identifying attributes so individuals cannot reasonably be linked to the processed dataset, which is a different requirement from the one being tested.

Answer D is incorrect because least-privilege IAM policies is primarily used to limit each GenAI component to only the resources and actions required for its function, which is a different requirement from the one being tested.

 

Question 7

The digital experience platform is prioritizing a requirement to use managed foundation models without allowing application data to become a customer-visible shared training corpus. Which implementation is most appropriate?

1. AWS Lake Formation
2. S3 Lifecycle retention policy
3. Bedrock privacy controls
4. Guardrails sensitive-information filters

Correct Answer: C

 

Correct Answer

Answer C is correct because Bedrock privacy controls are designed to use managed foundation models without allowing application data to become a customer-visible shared training corpus. It relies on Bedrock service privacy and isolation controls for supported model interactions.

Incorrect Answers

Answer A is incorrect because AWS Lake Formation is primarily used to apply granular authorization to governed data lake resources used by GenAI workloads, which is a different requirement from the one being tested.

Answer B is incorrect because S3 Lifecycle retention policy is primarily used to delete or transition stored GenAI interaction data according to retention requirements, which is a different requirement from the one being tested.

Answer D is incorrect because Guardrails sensitive-information filters is primarily used to detect and block or mask configured sensitive information in model interactions, which is a different requirement from the one being tested.

 

Question 8

The cloud governance office has a design goal to delete or transition stored GenAI interaction data according to retention requirements. What should the team choose?

1. AWS KMS encryption
2. CloudWatch data-access monitoring
3. data masking
4. S3 Lifecycle retention policy

Correct Answer: D

 

Correct Answer

Answer D is correct because S3 Lifecycle retention policy is designed to delete or transition stored GenAI interaction data according to retention requirements. It automates object lifecycle actions so sensitive data is not retained indefinitely by default.

Incorrect Answers

Answer A is incorrect because AWS KMS encryption is primarily used to protect stored GenAI data with centrally managed encryption keys and access controls, which is a different requirement from the one being tested.

Answer B is incorrect because CloudWatch data-access monitoring is primarily used to detect abnormal access or operational patterns around sensitive GenAI data flows, which is a different requirement from the one being tested.

Answer C is incorrect because data masking is primarily used to replace sensitive values with controlled surrogates while preserving useful data shape, which is a different requirement from the one being tested.

 

Question 9

The travel booking application is prioritizing a requirement to replace sensitive values with controlled surrogates while preserving useful data shape. Which implementation is most appropriate?

1. data masking
2. Amazon Macie
3. data anonymization
4. VPC endpoints for AWS services

Correct Answer: A

 

Correct Answer

Answer A is correct because data masking is designed to replace sensitive values with controlled surrogates while preserving useful data shape. It obscures original values before they are exposed to models or downstream users.

Incorrect Answers

Answer B is incorrect because Amazon Macie is primarily used to discover sensitive data such as personally identifiable information in Amazon S3, which is a different requirement from the one being tested.

Answer C is incorrect because data anonymization is primarily used to remove or transform identifying attributes so individuals cannot reasonably be linked to the processed dataset, which is a different requirement from the one being tested.

Answer D is incorrect because VPC endpoints for AWS services is primarily used to keep supported service traffic on private network paths without traversing the public internet, which is a different requirement from the one being tested.

 

Question 10

The compliance engineering group has a design goal to remove or transform identifying attributes so individuals cannot reasonably be linked to the processed dataset. What should the team choose?

1. Guardrails sensitive-information filters
2. data anonymization
3. least-privilege IAM policies
4. Amazon Comprehend PII detection

Correct Answer: B

 

Correct Answer

Answer B is correct because data anonymization is designed to remove or transform identifying attributes so individuals cannot reasonably be linked to the processed dataset. It reduces privacy risk by breaking direct or indirect linkage to a person before GenAI use.

Incorrect Answers

Answer A is incorrect because Guardrails sensitive-information filters is primarily used to detect and block or mask configured sensitive information in model interactions, which is a different requirement from the one being tested.

Answer C is incorrect because least-privilege IAM policies is primarily used to limit each GenAI component to only the resources and actions required for its function, which is a different requirement from the one being tested.

Answer D is incorrect because Amazon Comprehend PII detection is primarily used to detect personally identifiable information in text before model processing, which is a different requirement from the one being tested.

 

Question 11

The document intelligence team has a design goal to detect and block or mask configured sensitive information in model interactions. What should the team choose?

1. AWS KMS encryption
2. Bedrock privacy controls
3. Guardrails sensitive-information filters
4. AWS Lake Formation

Correct Answer: C

 

Correct Answer

Answer C is correct because Guardrails sensitive-information filters is designed to detect and block or mask configured sensitive information in model interactions. It applies managed sensitive-information policies to prompts and responses.

Incorrect Answers

Answer A is incorrect because AWS KMS encryption is primarily used to protect stored GenAI data with centrally managed encryption keys and access controls, which is a different requirement from the one being tested.

Answer B is incorrect because Bedrock privacy controls are primarily used to use managed foundation models without allowing application data to become a customer-visible shared training corpus, which is a different requirement from the one being tested.

Answer D is incorrect because AWS Lake Formation is primarily used to apply granular authorization to governed data lake resources used by GenAI workloads, which is a different requirement from the one being tested.

 

Question 12

The human resources automation team has a design goal to protect stored GenAI data with centrally managed encryption keys and access controls. What should the team choose?

1. CloudWatch data-access monitoring
2. AWS KMS encryption
3. VPC endpoints for AWS services
4. S3 Lifecycle retention policy

Correct Answer: B

 

Correct Answer

Answer B is correct because AWS KMS encryption is designed to protect stored GenAI data with centrally managed encryption keys and access controls. It provides key management for encryption at rest across integrated AWS services.

Incorrect Answers

Answer A is incorrect because CloudWatch data-access monitoring is primarily used to detect abnormal access or operational patterns around sensitive GenAI data flows, which is a different requirement from the one being tested.

Answer C is incorrect because VPC endpoints for AWS services is primarily used to keep supported service traffic on private network paths without traversing the public internet, which is a different requirement from the one being tested.

Answer D is incorrect because S3 Lifecycle retention policy is primarily used to delete or transition stored GenAI interaction data according to retention requirements, which is a different requirement from the one being tested.

 

Question 13

The platform reliability team describes a component that uses AWS PrivateLink-backed endpoints so VPC resources can reach supported services privately. Which capability is being described?

1. Amazon Macie
2. least-privilege IAM policies
3. data masking
4. VPC endpoints for AWS services

Correct Answer: D

 

Correct Answer

Answer D is correct because the description directly matches VPC endpoints for AWS services. VPC endpoints for AWS services uses AWS PrivateLink-backed endpoints so VPC resources can reach supported services privately.

Incorrect Answers

Answer A is incorrect because Amazon Macie is primarily used to discover sensitive data such as personally identifiable information in Amazon S3, which is a different requirement from the one being tested.

Answer B is incorrect because least-privilege IAM policies is primarily used to limit each GenAI component to only the resources and actions required for its function, which is a different requirement from the one being tested.

Answer C is incorrect because data masking is primarily used to replace sensitive values with controlled surrogates while preserving useful data shape, which is a different requirement from the one being tested.

 

Question 14

Within the enterprise search program’s architecture, which capability matches this technical description: reduces blast radius by granting narrowly scoped identity permissions instead of broad administrative access?

1. data anonymization
2. AWS Lake Formation
3. least-privilege IAM policies
4. Amazon Comprehend PII detection

Correct Answer: C

 

Correct Answer

Answer C is correct because the description directly matches least-privilege IAM policies. least-privilege IAM policies reduces blast radius by granting narrowly scoped identity permissions instead of broad administrative access.

Incorrect Answers

Answer A is incorrect because data anonymization is primarily used to remove or transform identifying attributes so individuals cannot reasonably be linked to the processed dataset, which is a different requirement from the one being tested.

Answer B is incorrect because AWS Lake Formation is primarily used to apply granular authorization to governed data lake resources used by GenAI workloads, which is a different requirement from the one being tested.

Answer D is incorrect because Amazon Comprehend PII detection is primarily used to detect personally identifiable information in text before model processing, which is a different requirement from the one being tested.

 

Question 15

The workflow modernization program describes a component that centralizes fine-grained permissions for cataloged data rather than relying only on coarse storage-level access. Which capability is being described?

1. CloudWatch data-access monitoring
2. AWS Lake Formation
3. Guardrails sensitive-information filters
4. Bedrock privacy controls

Correct Answer: B

 

Correct Answer

Answer B is correct because the description directly matches AWS Lake Formation. AWS Lake Formation centralizes fine-grained permissions for cataloged data rather than relying only on coarse storage-level access.

Incorrect Answers

Answer A is incorrect because CloudWatch data-access monitoring is primarily used to detect abnormal access or operational patterns around sensitive GenAI data flows, which is a different requirement from the one being tested.

Answer C is incorrect because Guardrails sensitive-information filters is primarily used to detect and block or mask configured sensitive information in model interactions, which is a different requirement from the one being tested.

Answer D is incorrect because Bedrock privacy controls are primarily used to use managed foundation models without allowing application data to become a customer-visible shared training corpus, which is a different requirement from the one being tested.

 

Question 16

Within the medical research assistant’s architecture, which capability matches this technical description: collects metrics and logs that can trigger alerts when access behavior deviates from expected baselines?

1. S3 Lifecycle retention policy
2. AWS KMS encryption
3. CloudWatch data-access monitoring
4. Amazon Macie

Correct Answer: C

 

Correct Answer

Answer C is correct because the description directly matches CloudWatch data-access monitoring. CloudWatch data-access monitoring collects metrics and logs that can trigger alerts when access behavior deviates from expected baselines.

Incorrect Answers

Answer A is incorrect because S3 Lifecycle retention policy is primarily used to delete or transition stored GenAI interaction data according to retention requirements, which is a different requirement from the one being tested.

Answer B is incorrect because AWS KMS encryption is primarily used to protect stored GenAI data with centrally managed encryption keys and access controls, which is a different requirement from the one being tested.

Answer D is incorrect because Amazon Macie is primarily used to discover sensitive data such as personally identifiable information in Amazon S3, which is a different requirement from the one being tested.

 

Question 17

The regional cloud architecture group describes a component that uses managed data security and classification capabilities to identify sensitive information stored in S3 buckets. Which capability is being described?

1. Amazon Macie
2. VPC endpoints for AWS services
3. Amazon Comprehend PII detection
4. data masking

Correct Answer: A

 

Correct Answer

Answer A is correct because the description directly matches Amazon Macie. Amazon Macie uses managed data security and classification capabilities to identify sensitive information stored in S3 buckets.

Incorrect Answers

Answer B is incorrect because VPC endpoints for AWS services is primarily used to keep supported service traffic on private network paths without traversing the public internet, which is a different requirement from the one being tested.

Answer C is incorrect because Amazon Comprehend PII detection is primarily used to detect personally identifiable information in text before model processing, which is a different requirement from the one being tested.

Answer D is incorrect because data masking is primarily used to replace sensitive values with controlled surrogates while preserving useful data shape, which is a different requirement from the one being tested.

 

Question 18

The retail recommendation team describes a component that returns identified PII entities and locations so applications can redact, mask, or route text safely. Which capability is being described?

1. Amazon Comprehend PII detection
2. Bedrock privacy controls
3. least-privilege IAM policies
4. data anonymization

Correct Answer: A

 

Correct Answer

Answer A is correct because the description directly matches Amazon Comprehend PII detection. Amazon Comprehend PII detection returns identified PII entities and locations so applications can redact, mask, or route text safely.

Incorrect Answers

Answer B is incorrect because Bedrock privacy controls are primarily used to use managed foundation models without allowing application data to become a customer-visible shared training corpus, which is a different requirement from the one being tested.

Answer C is incorrect because least-privilege IAM policies is primarily used to limit each GenAI component to only the resources and actions required for its function, which is a different requirement from the one being tested.

Answer D is incorrect because data anonymization is primarily used to remove or transform identifying attributes so individuals cannot reasonably be linked to the processed dataset, which is a different requirement from the one being tested.

 

Question 19

The telecommunications service documents this GenAI behavior: relies on Bedrock service privacy and isolation controls for supported model interactions. Which capability matches it?

1. AWS Lake Formation
2. Bedrock privacy controls
3. Guardrails sensitive-information filters
4. S3 Lifecycle retention policy

Correct Answer: B

 

Correct Answer

Answer B is correct because the description directly matches Bedrock privacy controls. Bedrock privacy controls relies on Bedrock service privacy and isolation controls for supported model interactions.

Incorrect Answers

Answer A is incorrect because AWS Lake Formation is primarily used to apply granular authorization to governed data lake resources used by GenAI workloads, which is a different requirement from the one being tested.

Answer C is incorrect because Guardrails sensitive-information filters is primarily used to detect and block or mask configured sensitive information in model interactions, which is a different requirement from the one being tested.

Answer D is incorrect because S3 Lifecycle retention policy is primarily used to delete or transition stored GenAI interaction data according to retention requirements, which is a different requirement from the one being tested.

 

Question 20

The marketing content platform documents this GenAI behavior: automates object lifecycle actions so sensitive data is not retained indefinitely by default. Which capability matches it?

1. CloudWatch data-access monitoring
2. data masking
3. S3 Lifecycle retention policy
4. AWS KMS encryption

Correct Answer: C

 

Correct Answer

Answer C is correct because the description directly matches S3 Lifecycle retention policy. S3 Lifecycle retention policy automates object lifecycle actions so sensitive data is not retained indefinitely by default.

Incorrect Answers

Answer A is incorrect because CloudWatch data-access monitoring is primarily used to detect abnormal access or operational patterns around sensitive GenAI data flows, which is a different requirement from the one being tested.

Answer B is incorrect because data masking is primarily used to replace sensitive values with controlled surrogates while preserving useful data shape, which is a different requirement from the one being tested.

Answer D is incorrect because AWS KMS encryption is primarily used to protect stored GenAI data with centrally managed encryption keys and access controls, which is a different requirement from the one being tested.

 

Question 21

The API platform team needs to identify a capability with this behavior: obscures original values before they are exposed to models or downstream users. What is the best match?

1. data masking
2. Amazon Macie
3. VPC endpoints for AWS services
4. data anonymization

Correct Answer: A

 

Correct Answer

Answer A is correct because the description directly matches data masking. data masking obscures original values before they are exposed to models or downstream users.

Incorrect Answers

Answer B is incorrect because Amazon Macie is primarily used to discover sensitive data such as personally identifiable information in Amazon S3, which is a different requirement from the one being tested.

Answer C is incorrect because VPC endpoints for AWS services is primarily used to keep supported service traffic on private network paths without traversing the public internet, which is a different requirement from the one being tested.

Answer D is incorrect because data anonymization is primarily used to remove or transform identifying attributes so individuals cannot reasonably be linked to the processed dataset, which is a different requirement from the one being tested.

 

Question 22

The product recommendation platform describes a component that reduces privacy risk by breaking direct or indirect linkage to a person before GenAI use. Which capability is being described?

1. Amazon Comprehend PII detection
2. Guardrails sensitive-information filters
3. least-privilege IAM policies
4. data anonymization

Correct Answer: D

 

Correct Answer

Answer D is correct because the description directly matches data anonymization. data anonymization reduces privacy risk by breaking direct or indirect linkage to a person before GenAI use.

Incorrect Answers

Answer A is incorrect because Amazon Comprehend PII detection is primarily used to detect personally identifiable information in text before model processing, which is a different requirement from the one being tested.

Answer B is incorrect because Guardrails sensitive-information filters is primarily used to detect and block or mask configured sensitive information in model interactions, which is a different requirement from the one being tested.

Answer C is incorrect because least-privilege IAM policies is primarily used to limit each GenAI component to only the resources and actions required for its function, which is a different requirement from the one being tested.

 

Question 23

The audit analytics group documents this GenAI behavior: applies managed sensitive-information policies to prompts and responses. Which capability matches it?

1. AWS KMS encryption
2. AWS Lake Formation
3. Bedrock privacy controls
4. Guardrails sensitive-information filters

Correct Answer: D

 

Correct Answer

Answer D is correct because the description directly matches Guardrails sensitive-information filters. Guardrails sensitive-information filters applies managed sensitive-information policies to prompts and responses.

Incorrect Answers

Answer A is incorrect because AWS KMS encryption is primarily used to protect stored GenAI data with centrally managed encryption keys and access controls, which is a different requirement from the one being tested.

Answer B is incorrect because AWS Lake Formation is primarily used to apply granular authorization to governed data lake resources used by GenAI workloads, which is a different requirement from the one being tested.

Answer C is incorrect because Bedrock privacy controls are primarily used to use managed foundation models without allowing application data to become a customer-visible shared training corpus, which is a different requirement from the one being tested.

 

Question 24

Within the AI platform governance team’s architecture, which capability matches this technical description: provides key management for encryption at rest across integrated AWS services?

1. VPC endpoints for AWS services
2. CloudWatch data-access monitoring
3. S3 Lifecycle retention policy
4. AWS KMS encryption

Correct Answer: D

 

Correct Answer

Answer D is correct because the description directly matches AWS KMS encryption. AWS KMS encryption provides key management for encryption at rest across integrated AWS services.

Incorrect Answers

Answer A is incorrect because VPC endpoints for AWS services is primarily used to keep supported service traffic on private network paths without traversing the public internet, which is a different requirement from the one being tested.

Answer B is incorrect because CloudWatch data-access monitoring is primarily used to detect abnormal access or operational patterns around sensitive GenAI data flows, which is a different requirement from the one being tested.

Answer C is incorrect because S3 Lifecycle retention policy is primarily used to delete or transition stored GenAI interaction data according to retention requirements, which is a different requirement from the one being tested.

 

Question 25

The corporate knowledge assistant includes VPC endpoints for AWS services in its architecture. What is its primary role?

1. Keep supported service traffic on private network paths without traversing the public internet
2. Replace sensitive values with controlled surrogates while preserving useful data shape
3. Limit each GenAI component to only the resources and actions required for its function
4. Discover sensitive data such as personally identifiable information in Amazon S3

Correct Answer: A

 

Correct Answer

Answer A is correct because VPC endpoints for AWS services is specifically used to keep supported service traffic on private network paths without traversing the public internet. It uses AWS privatelink-backed endpoints so VPC resources can reach supported services privately.

Incorrect Answers

Answer B is incorrect because that requirement aligns with data masking, not VPC endpoints for AWS services.

Answer C is incorrect because that requirement aligns with least-privilege IAM policies, not VPC endpoints for AWS services.

Answer D is incorrect because that requirement aligns with Amazon Macie, not VPC endpoints for AWS services.