AIF-C01 Practice Question 100: Customer Managed Key Custom Model
AWS Certified AI Practitioner (AIF-C01) · Test 10 · question 10 of 10
A bank fine-tunes a foundation model in Amazon Bedrock. Its compliance policy requires that the bank itself controls and audits the key that protects the custom model, and that the bank can make the model unusable at any time without deleting it. Which approach meets these requirements?
Show answer and explanation
Answer:
Amazon Bedrock encrypts custom models with AWS owned keys by default, but you can choose customer managed keys that you manage yourself. Bedrock then uses KMS grants to use the key on your behalf. AWS states that *"you can revoke access to the grant ... or remove the service's access to your customer managed key at any time by modifying the key policy. If you do so, Amazon Bedrock won't be able to access the custom model encrypted by your key."* Key usage is also visible in AWS CloudTrail. This gives the bank control, an audit trail and a reversible kill switch (option A).
- B is wrong because with AWS owned keys you *"can't view, manage, or use AWS owned keys, or audit their use."* The bank has no control over the key. - C is wrong because SSE-S3 keys are managed by AWS, and the training data is not the model. After a job completes, Bedrock does not retain the training data, and deleting a bucket does not affect the custom model. - D is wrong because a customer managed key on the training data protects only the data at rest in S3. The model artifacts stay under the default AWS owned key, so the bank still cannot revoke access to the model.