Skip to content
calwm

Red pen: Security, compliance and governance for AI

Exam answers on Security, compliance and governance for AI are often almost right. Each round hands you a short document with a few mistakes hidden in it. Mark the faulty lines, say why each one is wrong, and see what a good version would say.

Find the mistake before the auditor does.

Grab the red pen2 documents, about 4 min

What you will practise

You will practise Security, compliance and governance for AI, with questions touching AI governance and AI security.

  • AI governance
  • AI security

It is part of the AWS Certified AI Practitioner track (AIF-C01), where Security, compliance and governance for AI is about 14% of the exam.

A taste of what you will get

  • The assistant only needs to call one model and read one knowledge base.

    Sample document 1: Felix's access plan for the member assistant. Which lines are wrong, and why?

    • Permissions: the assistant's role allows every Bedrock action on all resources
    • Network: calls to Bedrock go through AWS PrivateLink
    • Data: member documents are encrypted with a KMS key
    • Logging: API activity logging is switched off to save money
    • Input: a guardrail filters prompt attacks in member messages

    Answer: Line 1 (Permissions: the assistant's role allows every Bedrock action on all resources): It grants far more access than the assistant needs. Better: Allow only invoking the one model and querying the one knowledge base. Line 4 (Logging: API activity logging is switched off to save money): Nobody can see who did what, for audits or incidents. Better: Turn on AWS CloudTrail to record who took which action, and when.

  • The regulator wants evidence that the assistant's controls work, both on AWS and at Harbour.

    Sample document 2: Rosa's audit pack for the regulator. Which lines are wrong, and why?

    • Proof of our own controls: AWS's SOC report from AWS Artifact
    • API activity: AWS CloudTrail logs for the last 12 months
    • Settings changes: none recorded; the team remembers them
    • Encryption: member data encrypted with KMS keys
    • Review: governance policies reviewed every quarter

    Answer: Line 1 (Proof of our own controls: AWS's SOC report from AWS Artifact): It covers AWS's controls, not Harbour's own setup. Better: Use AWS's report for AWS's part, and add evidence of Harbour's own controls. Line 3 (Settings changes: none recorded; the team remembers them): Memory isn't evidence: record them with AWS Config. Better: Turn on AWS Config to keep a history of every configuration change.

Advertise here

How scoring works

  • Every correct answer pays 10 XP for each difficulty level, so an easy item is worth 10, a medium one 20 and a hard one 30.
  • Answer with time to spare and you can earn up to 5 bonus XP on top.
  • A wrong answer pays nothing. It does not cost you anything either.
  • Flashcards pay 2 XP each time you grade yourself 3 or higher.
  • Using a hint costs 2 XP, so use it when it helps, not when it is comfortable.
  • Finish a session on consecutive days to build a streak. Your progress lives in your browser, and signing in syncs it.

Quick answers

How long does the red pen on Security, compliance and governance for AI take?
About 4 minutes for 2 documents. Pause whenever you like.
Do I need an account to play the red pen?
No. Progress is saved in your browser, and signing in syncs it across devices.