Sample question 2 — Data Preparation for Machine Learning (ML)
A logistics provider runs several model workflows and wants every stored model file protected with a key it controls, while a compliance team needs to see, per access, which workload used that key. The provider also insists that no workflow outside the approved set be able to decrypt the stored models. Which AWS solution should the provider choose?
- A. Apply a bucket policy that permits only the approved workflow roles to read the stored models.
- B. Keep the model files inside a private subnet that has no route to the public internet.
- C. Use the storage service's built-in encryption and review the access logs each month.
- D. Encrypt Amazon S3 artifacts with AWS KMS customer managed keys and grant usage through scoped key policies.
Answer: D. Option D is correct because the provider-owned key in AWS KMS keeps control with the logistics business, the scoped key policies confine decryption to the approved workflows, and the key usage log answers the compliance team's per-access question. Option A would limit which roles may read the models but would not give the provider its own key or record key use. Option B would hide the files from the network without protecting them at rest. Option C would rely on provider-held encryption and would not tie each decryption to a specific workload.
