Most of securing an AI system is ordinary security applied carefully. A smaller part is specific to there being a model in the path, and that part is where teams are least practised.
The shared responsibility model
AWS secures the cloud itself and you secure what you put in it, with the line between the two moving depending on which service you are using.
With a fully managed service such as Amazon Bedrock, AWS runs the model and the infrastructure, and you own identity, access policy, encryption keys, what you send, and what your application does with what comes back. With a model you host on your own instances, patching and network configuration become yours as well.
The exam tests whether you can place a given responsibility on the correct side.
Identity and access
IAM roles, policies and permissions are the primary control. A model endpoint is a resource like any other, and least privilege applies to who can call it, who can change it, and who can read the data it was trained on.
The training data usually carries more risk than the model. It is the largest collection of sensitive material in the project, and it is frequently the least protected, sitting in a bucket somebody opened during development.
Encryption
At rest covers training data, model artefacts, logs and any store of embeddings. Embeddings deserve particular attention, because they are derived from source documents and are often treated as harmless numbers when they can be partially inverted.
In transit covers every call. AWS PrivateLink keeps traffic to a service on the AWS network rather than the public internet, which is the answer when a question mentions private connectivity to a model endpoint.
Data protection services
Amazon Macie discovers and classifies sensitive data in Amazon S3, which is how you find out that personal information reached a training set. It is the service the exam expects when a question is about locating sensitive data rather than protecting it.
Data lineage and cataloguing record where data came from and how it moved. This is a security control as well as a governance one, since you cannot honour a deletion request or answer a breach question without knowing what a dataset contains and what was trained on it.
Secure data engineering
The syllabus names four practices. Assessing data quality, since bad data produces bad decisions at scale. Privacy enhancing technologies, such as anonymisation, tokenisation and masking before data reaches training. Access control, applied to the data as tightly as to the model. Data integrity, so nobody can alter a training set or an index without it being noticed, which is the defence against poisoning.
The AI specific surfaces
Prompt injection is untrusted text that overrides your instructions. It matters most when the model can act, since an agent with tools turns a text attack into a real one. The controls are filtering input and output, giving tools the narrowest permission that works, and treating model output as untrusted input to whatever consumes it.
Data poisoning corrupts training data or a retrieval index so the system learns or repeats something planted.
Model extraction rebuilds a model by querying it enough times, which is what rate limiting on an endpoint is partly for.
Sensitive disclosure is the model repeating something from training data or from context. Anything placed in a prompt can come back out.
Guardrails for Amazon Bedrock is the managed control here, applying content filters, denied topics and word filters to both directions of the exchange.
The ordinary practices still apply and the exam names them. Application security, vulnerability management, infrastructure protection and threat detection, with Amazon GuardDuty, Amazon Inspector and AWS CloudTrail doing the work they do for any other workload.