Overview
Security, Compliance, and Governance for AI Solutions has two task statements. Task 5.1 covers securing AI systems: IAM roles, policies and permissions, encryption, Amazon Macie, AWS PrivateLink, the shared responsibility model, Amazon Bedrock AgentCore Identity, Policy in AgentCore and Amazon Bedrock Guardrails. It also covers source citation and data lineage, secure data engineering, threats such as prompt injection, data leakage and toxic output, audit logging of AI interactions, and grounding methods that reduce hallucinations.
Task 5.2 covers governance and compliance: AWS Config, Amazon Inspector, AWS Artifact, AWS CloudTrail and AWS Trusted Advisor, data governance strategies for lifecycle, residency, logging, monitoring and retention, and governance processes such as policies, review cadence, team training and the Generative AI Security Scoping Matrix.
How it's tested
Domain 5 questions describe a security, privacy, audit or compliance requirement for an AI workload and ask which AWS service, feature or practice satisfies it. Distractors are usually real AWS services with a related but different purpose, so precise one-line definitions of each service decide most answers.
-
Match the security service
A protection need such as encryption, private connectivity, sensitive data discovery or least-privilege access is described, and you choose the AWS service or feature.
-
Prove compliance
An auditor needs evidence, configuration history or compliance reports, and you pick CloudTrail, Config, Artifact, Inspector or Trusted Advisor.
-
Defend the GenAI app
Prompt injection, data leakage, toxic output or hallucination is described, and you choose guardrails, output validation, grounding or access controls.
A healthcare company plans to fine-tune a model on documents stored in Amazon S3 and must make sure no patient identifiers enter the training data. The first need is discovery of sensitive data. Amazon Macie scans S3 and reports personal data such as names and identifiers, so the team can remove or mask it before training. Encryption with AWS KMS protects the data, but it does not reveal what the files contain.
Task statements 2
Official task statements from the Amazon Web Services outline, in outline order.
5.1 Explain methods to secure AI systemsAWS security services, data lineage, secure data engineering, AI threats and grounding.
- What it means
- This task statement covers the AWS services and features that secure AI systems (IAM roles, policies and permissions, encryption, Amazon Macie, AWS PrivateLink, the shared responsibility model, Amazon Bedrock AgentCore Identity, Policy in AgentCore, Amazon Bedrock Guardrails), source citation and data lineage, secure data engineering practices, security and privacy risks such as prompt injection and data leakage, and methods to detect hallucinations and ground outputs.
- What to understand
- IAM grants least-privilege access to models, data and endpoints. AWS KMS encrypts data at rest, and TLS protects it in transit. Amazon Macie discovers sensitive data in S3. AWS PrivateLink keeps traffic to services such as Amazon Bedrock on the AWS network instead of the internet. AgentCore Identity manages credentials agents use to reach other systems, and Policy in AgentCore limits which tools and actions an agent may take. Data lineage and SageMaker Model Cards record where data came from. Prompt injection, data leakage and toxic output call for guardrails, output filtering and audit logs. RAG grounding, output validation and confidence scoring reduce hallucinations.
- How it shows up
- A security or privacy risk to an AI workload is described, and you choose the service, feature or practice that mitigates it.
- Common confusion
- Assuming AWS secures customer data and prompts; under shared responsibility, access control and data protection remain the customer's job.
5.2 Recognize governance and compliance regulations for AI systemsCompliance services, data governance strategies and governance processes.
- What it means
- This task statement covers AWS services that assist with governance and compliance (AWS Config, Amazon Inspector, AWS Artifact, AWS CloudTrail, AWS Trusted Advisor), data governance strategies such as lifecycle management, logging, residency, monitoring, observation and retention, and governance processes including policies, review cadence and strategies, frameworks such as the Generative AI Security Scoping Matrix, transparency standards and team training.
- What to understand
- CloudTrail records API activity, such as who invoked a model and when. AWS Config tracks resource configuration changes and checks them against rules. Amazon Inspector scans workloads for software vulnerabilities. AWS Artifact provides AWS compliance reports and agreements on demand. Trusted Advisor checks accounts against best practices for cost, security and limits. Data residency keeps data in required Regions, and retention policies decide how long logs and data are kept. The Generative AI Security Scoping Matrix sorts use cases into five scopes, from consumer apps to self-trained models, so controls match ownership.
- How it shows up
- An audit, compliance or governance requirement is described, and you choose the AWS service or governance practice that meets it.
- Common confusion
- Confusing AWS Artifact with CloudTrail; Artifact provides AWS compliance reports, while CloudTrail logs account activity.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Shared responsibility model for AI
AWS secures the infrastructure and managed services; customers secure their data, access, prompts and applications.
- Remember
- Customer data and IAM are always customer duties.
- Tested as
- Responsibility questions.
- Trap
- Expecting AWS to configure your permissions.
-
IAM least privilege
Grant only the permissions needed to invoke models or read data.
- Remember
- Roles over long-term keys.
- Tested as
- Access control questions.
- Trap
- Granting broad administrator access to an AI app.
-
Amazon Macie
Discovers and reports sensitive data such as PII in Amazon S3.
- Remember
- Discovery, not encryption.
- Tested as
- Data privacy questions.
- Trap
- Confusing it with GuardDuty.
-
AWS PrivateLink
Private connectivity from a VPC to AWS services like Amazon Bedrock.
- Remember
- Traffic avoids the public internet.
- Tested as
- Network security questions.
- Trap
- Choosing a NAT gateway for private access.
-
AgentCore Identity and Policy in AgentCore
Manage agent credentials and restrict which tools and actions agents can use.
- Remember
- Security for autonomous agents.
- Tested as
- New 2026 agent questions.
- Trap
- Relying on prompt instructions alone to limit agents.
-
Prompt injection
Malicious input that tries to override instructions or extract data.
- Remember
- Mitigate with guardrails, validation and least privilege.
- Tested as
- Threat questions.
- Trap
- Assuming encryption prevents it.
-
Grounding
Tying outputs to retrieved, trusted sources to reduce hallucination.
- Remember
- RAG plus validation and confidence scoring.
- Tested as
- Hallucination questions.
- Trap
- Treating grounding as a network control.
-
AWS CloudTrail
Logs API calls and account activity.
- Remember
- Answers who did what and when.
- Tested as
- Audit questions.
- Trap
- Confusing it with CloudWatch metrics.
-
AWS Config
Records resource configurations and evaluates them against rules.
- Remember
- Configuration history and compliance.
- Tested as
- Governance questions.
- Trap
- Using it for vulnerability scanning.
-
Amazon Inspector
Automated vulnerability scanning of workloads.
- Remember
- Finds software flaws and exposure.
- Tested as
- Vulnerability questions.
- Trap
- Confusing it with Config.
-
AWS Artifact
On-demand access to AWS compliance reports and agreements.
- Remember
- Evidence about AWS, not your account activity.
- Tested as
- Compliance evidence questions.
- Trap
- Expecting it to log user actions.
-
Generative AI Security Scoping Matrix
Five scopes from consumer apps to self-trained models that guide security controls.
- Remember
- More ownership means more responsibility.
- Tested as
- Governance framework questions.
- Trap
- Treating it as an AWS service.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Compliance and audit services
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| AWS CloudTrail | Records API and user activity | Who did what, when | Confusing it with CloudWatch |
| AWS Config | Tracks configuration changes against rules | Configuration compliance | Using it to scan for CVEs |
| Amazon Inspector | Scans for software vulnerabilities | Vulnerability management | Expecting configuration history |
| AWS Artifact | Provides AWS compliance reports | Evidence about AWS controls | Expecting your account logs |
| AWS Trusted Advisor | Best-practice checks on cost, security, limits | Recommendations, not enforcement | Treating it as an auditor |
Data protection controls
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Amazon Macie | Finds sensitive data in S3 | Discovers PII | Expecting it to encrypt data |
| AWS KMS encryption | Encrypts data at rest with managed keys | Protects stored data | Expecting it to find PII |
| AWS PrivateLink | Private network path to AWS services | Keeps traffic off the internet | Confusing it with encryption |
| Amazon Bedrock Guardrails | Filters prompts and responses, masks PII | Application-level content control | Treating it as network security |
Generative AI Security Scoping Matrix
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Scopes 1-2 | Consumer and enterprise apps using third-party GenAI | Least customer control | Ignoring data shared with the provider |
| Scope 3 | Building on pre-trained models | Customer owns app and prompts | Assuming the provider secures the app |
| Scopes 4-5 | Fine-tuned or self-trained models | Most customer responsibility | Forgetting training data governance |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
KMS finds PII
- What candidates pick
- Choose AWS KMS to identify personal data before training.
- Why it looks right
- Encryption is the best-known privacy control.
- Why it's wrong
- KMS encrypts data but cannot see what it contains; Amazon Macie discovers and classifies sensitive data in S3.
Clue to watch for The need is to find or classify sensitive data.
-
Artifact for activity logs
- What candidates pick
- Use AWS Artifact to show which users invoked a model.
- Why it looks right
- Artifact is linked to compliance.
- Why it's wrong
- Artifact supplies AWS compliance reports; CloudTrail records API calls such as model invocations in your account.
Clue to watch for The auditor asks who did what and when.
-
Config scans vulnerabilities
- What candidates pick
- Use AWS Config to find software vulnerabilities on instances.
- Why it looks right
- Config is a governance service.
- Why it's wrong
- Config tracks configuration state and rule compliance; Amazon Inspector scans workloads for vulnerabilities.
Clue to watch for The finding is a CVE or unpatched software.
-
AWS owns everything
- What candidates pick
- State that AWS is responsible for securing prompts and training data in Amazon Bedrock.
- Why it looks right
- Bedrock is a fully managed service.
- Why it's wrong
- AWS secures the underlying infrastructure and service, but customers still control IAM, data classification, encryption choices and application security.
Clue to watch for The question asks who is responsible for data or access.
-
System prompt stops injection
- What candidates pick
- Rely on a system prompt telling the model to ignore malicious instructions.
- Why it looks right
- It is quick and needs no extra service.
- Why it's wrong
- Attackers can override prompt instructions; layered controls such as Guardrails, input validation, output filtering and least privilege are required.
Clue to watch for Users can submit free text to the model.
-
Internet route for private data
- What candidates pick
- Call Amazon Bedrock from a VPC through a NAT gateway when traffic must stay private.
- Why it looks right
- NAT gateways give outbound access.
- Why it's wrong
- NAT routes traffic to public endpoints; AWS PrivateLink interface endpoints keep traffic on the AWS network.
Clue to watch for The requirement says no public internet.
Answer framework
Use these steps for Domain 5 questions about securing and governing AI workloads on AWS.
- Classify the requirement as access control, data protection, network isolation, threat defense, audit evidence or governance process before reading options.
- Apply shared responsibility: AWS secures infrastructure and managed services, while the customer controls IAM, data, prompts, application logic and agent permissions.
- Match the service exactly: IAM for access, KMS for encryption, Macie for PII discovery, PrivateLink for private traffic, CloudTrail for activity, Config for configuration, Inspector for vulnerabilities, Artifact for reports.
- For GenAI threats, layer Guardrails, input validation, output filtering and logging, and use AgentCore Identity and Policy to restrict agents.
- For hallucinations, ground answers with RAG and citations, validate outputs and use confidence scores, then document lineage and retention under a governance framework.
Practice question
Want more like this? The AIF-C01 practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Treat this domain as a service-matching exercise backed by a few principles. Start with the shared responsibility model applied to AI: list what AWS secures for Amazon Bedrock and SageMaker AI and what stays with you, including IAM, data classification, prompts and agent permissions.
Next, build flashcards with one line per service: IAM, KMS, Macie, PrivateLink, Guardrails, AgentCore Identity, Policy in AgentCore, CloudTrail, Config, Inspector, Artifact and Trusted Advisor. Group the easily confused ones, such as CloudTrail versus CloudWatch and Config versus Inspector, and quiz yourself on the difference until it is automatic.
Then study GenAI-specific threats. For prompt injection, data leakage, toxicity and hallucination, write the layered controls that apply, and note where audit logging fits. Read the Generative AI Security Scoping Matrix overview and learn the five scopes in order.
Finish with governance processes, such as data retention, residency, review cadence and training, since these appear as process questions rather than service questions. Timed practice sets help, because distractors here are real services that are close in purpose.
FAQ
How much of AIF-C01 is Domain 5?
Security, Compliance, and Governance for AI Solutions is 14% of the scored content, about seven of the fifty scored questions, across two task statements.
Who is responsible for securing data used with Amazon Bedrock?
The customer. AWS secures the service and infrastructure, while customers control IAM permissions, data classification, encryption choices and how their applications use models.
How do CloudTrail and AWS Config differ for AI audits?
CloudTrail logs API activity such as model invocations. Config records resource configurations over time and checks them against compliance rules.
When should I use Amazon Macie?
When you need to discover or classify sensitive data, such as personal information, stored in Amazon S3, for example before using it to train or ground a model.
What is the Generative AI Security Scoping Matrix?
An AWS framework that sorts GenAI use into five scopes, from consumer apps to self-trained models, to help decide which security controls apply.
How can hallucinations be reduced?
Ground responses with RAG and source citations, validate outputs, apply confidence scoring and use Guardrails contextual grounding checks where available.
What do AgentCore Identity and Policy in AgentCore do?
AgentCore Identity manages the credentials agents use to reach AWS and external services. Policy in AgentCore defines which tools and actions an agent is allowed to take.
Other Artificial Intelligence & Machine Learning certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 5 knowledge
You have covered AI security services, GenAI threats, grounding, compliance services and governance processes. See whether you can match each requirement to the exact service.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the AIF-C01 AI tutor Get any concept explained your way