Security, Compliance, and Governance for AI Solutions – AIF-C01 Study Guide
This domain accounts for 14% of the exam and covers securing AI systems, governing data, and meeting compliance requirements on AWS. Much of it applies general AWS security thinking — IAM, encryption, the shared responsibility model, logging — to AI/ML workloads, plus a few governance services. Know the shared responsibility split and which service does audit, compliance, sensitive-data discovery, and monitoring, and this domain scores reliably.
Securing AI Systems
Core controls, applied to Bedrock and SageMaker like any AWS workload:
- AWS Identity and Access Management (IAM) — controls who can access AI resources via users, roles, and policies. Apply least privilege.
- Encryption — protect data at rest and in transit.
- Data protection — keep proprietary data isolated and under your control; don't over-share.
"Control who can invoke a model" → IAM. "Protect data confidentiality" → encryption + least-privilege access.
The Shared Responsibility Model for AI
For a managed AI service like Amazon Bedrock:
| Responsibility | Owner |
|---|---|
| Physical datacenters, hardware, hypervisor, service infrastructure | AWS ("security of the cloud") |
| Your data, access permissions (IAM), and secure configuration/use | Customer ("security in the cloud") |
The customer never patches AWS servers; AWS never manages your IAM policies or classifies your data. Match a described task to the correct side.
Unlock with a paid plan
5 more sections (about 349 words) continue below. Every paid plan unlocks all AIF-C01 study guides, the full question bank and mock exams, from $4.97/month.