10-question AI Practitioner diagnostic

Security, Compliance & Governance for AI

A financial company trains fraud-detection models with Amazon SageMaker AI. Regulators require that the storage volumes attached to training instances and the model artifacts written to Amazon S3 be encrypted at rest using keys the company itself creates, controls, and can revoke. How should the team meet this requirement?

• ARely on SageMaker AI's default encryption, which uses keys that AWS owns and manages on the customer's behalf
• BSpecify a customer managed AWS KMS key for the training job's volume encryption and for the output data configuration that writes model artifacts to S3
• CEnable Amazon Macie on the S3 output bucket so it encrypts the model artifacts it discovers
• DConfigure SSE-S3 (Amazon S3 managed keys) on the output bucket