Domain 5 review: security, compliance and governance

Domain 5 also carries 14 of every 100 scored points. It asks how AI systems are secured and how organizations govern them and stay compliant. Jonah's diagnostic, reviewed in lesson 11, showed this was his weakest domain: three of six domain 5 items wrong, two because he did not know which AWS service did what. Hannah Weiss, the group's privacy and security lead, joined part of the AI hour in October to explain how client data is protected, and Noor's notes for this lesson lean heavily on that conversation. "Security questions on this exam are rarely about configuration," Noor wrote. "They are about knowing which control answers which risk, and who is responsible for it."

Task 5.1: securing AI systems

The shared responsibility model still applies to AI. AWS is responsible for the security of the cloud: the facilities, hardware and the managed services themselves. The customer is responsible for security in the cloud: who has access, what data is sent to models, how outputs are used and how settings are configured. With a fully managed service such as Amazon Bedrock, AWS runs the model infrastructure, and the customer controls access, data, prompts, guardrails and logging. AWS states that Bedrock does not use customer prompts and responses to train the underlying models, which is one reason the group chose it.

The guide lists AWS services and features for securing AI systems. IAM roles, policies and permissions control who and what can call a model, read a knowledge base or run an agent, following least privilege. Encryption protects data at rest, with keys managed in AWS Key Management Service, and in transit, using TLS. Amazon Macie discovers and classifies sensitive data such as personal information in Amazon S3, which helps before documents are added to a knowledge base. AWS PrivateLink lets applications reach services such as Bedrock over private network paths rather than the public internet. Amazon Bedrock Guardrails filters prompts and responses. The current guide also names Amazon Bedrock AgentCore Identity, which manages the identities and credentials agents use to call tools, and Policy in AgentCore, which lets you define what agents are allowed to do.

Data origins, privacy and secure data engineering

Source citation and documenting data origins appear in task 5.1. Data lineage records where data came from and how it was transformed; a data inventory, often called a data catalog, records what data exists and who owns it; and SageMaker Model Cards record what data trained a model. When an answer cites the passages it used, people can check it. Best practices for secure data engineering include assessing data quality, using privacy-enhancing technologies such as masking, tokenization or anonymization, controlling access to data, and protecting data integrity so it is not changed without authorization.

The guide lists security and privacy considerations for AI systems: application security, threat detection, vulnerability management, infrastructure protection, prompt injection, encryption at rest and in transit, data leakage prevention, output filtering and validation, audit trails and logging of AI interactions, and toxicity. For the after-hours summaries, Hannah required that technician notes be encrypted, that only the emergency hospital's staff can read the summaries, that every request to the model be logged, and that guardrails mask client phone numbers and addresses in any text sent outside the clinical record. Client data stays in the United States, in the us-west-2 Region, by the board's choice and consistent with Colorado's privacy law.

Hallucination detection and grounding

Task 5.1 also includes methods to detect hallucinations and improve accuracy: retrieval augmented generation to ground answers in trusted sources, output validation that checks answers against rules or data before they are used, and confidence scoring that routes uncertain answers to a person. Bedrock Guardrails includes contextual grounding checks that flag responses not supported by the retrieved source text or not relevant to the question. For the group, any summary that the grounding check flags is marked for the morning veterinarian to read against the original notes.

Task 5.2: governance and compliance

The guide names AWS services that help with governance and regulatory compliance. AWS Config records and evaluates the configuration of resources against rules, such as requiring encryption on every storage bucket. Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure. AWS Artifact gives on-demand access to AWS's compliance reports and agreements, which auditors and privacy officers ask for. AWS CloudTrail records API activity, including calls to Bedrock, for audit. AWS Trusted Advisor checks accounts against best practices in areas including security and cost. These are the same services Jonah met in the Cloud Practitioner material; the AI exam asks you to apply them to AI workloads.

Data governance strategies in the guide include managing data lifecycles, logging, residency, monitoring, observation and retention. Residency means keeping data in a chosen country or Region; retention means keeping data only as long as needed and deleting it afterwards. Governance protocols include written policies, a review cadence and strategy, governance frameworks, transparency standards and training requirements for teams. The guide names one framework explicitly: the Generative AI Security Scoping Matrix, an AWS framework that classifies generative AI use into five scopes according to how much of the solution you own.

In scope 1, people use a public consumer generative AI app; the organization controls little beyond its usage policy. In scope 2, the organization uses an enterprise application with generative AI features under a business agreement. In scope 3, it builds its own application on a pre-trained model accessed through a service such as Bedrock. In scope 4, it fine-tunes a model with its own data. In scope 5, it trains a model from scratch. As you move from scope 1 to scope 5, your organization takes on more responsibility for data, security, compliance and model behavior. The after-hours summaries are a scope 3 application; if the group ever fine-tuned a model, it would move to scope 4 and take on governance of the training data.

Practice items for domain 5

First: a privacy officer must show regulators that every call to the generative AI service is recorded, with who made it and when. Which service provides this? AWS CloudTrail. Second: before indexing ten years of shared-drive documents into a knowledge base, the team wants to find files containing client addresses and card numbers. Which service fits? Amazon Macie. Third: a company subscribes to a business productivity suite with built-in AI features under an enterprise agreement. Which scope of the Scoping Matrix is this? Scope 2. Fourth: an agent must call the booking system on behalf of staff without storing their passwords. Which feature named in the guide addresses agent credentials? Amazon Bedrock AgentCore Identity. Fifth: auditors want proof that the cloud provider's data centers meet a recognized security standard. Which service provides it? AWS Artifact.

Retention, residency and logging of AI interactions

Governance questions often turn on what happens to data over time. Prompts and responses can contain personal information, so organizations must decide whether to log them, where those logs are stored, who can read them and how long they are kept. Logging helps with audit, troubleshooting and detecting misuse, but every stored copy is also something to protect. Hannah's policy for the after-hours summaries keeps model invocation logs for a fixed period in an encrypted bucket in the same Region as the clinical data, readable only by the security team, and deletes them on schedule. That one policy touches residency, retention, encryption, access control and audit at once, which is exactly how the exam tends to combine these ideas.

Monitoring and observation are the other half. A deployed AI application should be watched for unusual use, rising error rates, unexpected costs and drift in the quality of answers. Amazon CloudWatch collects metrics and alarms; CloudTrail records API activity; and evaluation runs repeated over time show whether quality is holding. Governance means someone is responsible for looking at those signals on a regular cadence and acting on them, which is why the guide lists review cadence and strategies alongside policies and frameworks.

Logging deserves the same care as the data it records. Prompt and response logs can contain personal information, so they need encryption, access limited to the people who investigate incidents, and a retention period that follows the organization's policy rather than keeping everything forever. AWS CloudTrail records who called which API, while application logs or Amazon Bedrock model invocation logging record what was asked and answered. An exam item about proving who changed a guardrail points to CloudTrail; one about reviewing what a chatbot told customers points to invocation logs.

Policies and training

The final items in task 5.2 are about people and process. A written AI use policy states which tools staff may use, with what data, and who approves new uses. Transparency standards say how the organization tells people when AI is involved. Training requirements make sure staff know the policy and the limits of the tools. For the group, the policy is short: no client data in public consumer AI apps, which is scope 1; approved tools listed by Hannah; every new AI use reviewed by Hannah and, if clinical, by Dr. Kaur; and annual training for anyone who uses an approved tool. On the exam, when a question asks how an organization should prevent staff from pasting confidential data into public tools, a clear policy with training, backed by technical controls where possible, is the expected direction.

Keep in mind that domain 5 questions often combine two ideas from different task statements. A scenario might ask how to keep an assistant from inventing policy details while also proving to auditors who used it. The answer then has two parts: grounding and guardrails for accuracy, and CloudTrail for the audit trail. Reading for both requirements, and checking that the option you choose meets each one, is the habit that turns domain 5 from Jonah's weakest domain into a source of points. A useful check before committing to an answer is to name the risk each option addresses; if an option addresses a risk the scenario never mentioned, it is probably a distractor.

To finish, link domain 5 back to the exam's structure. With only about seven scored questions, domain 5 rewards precise recall of a fairly small set of services and ideas: shared responsibility, IAM, encryption with KMS, PrivateLink, Macie, Guardrails, the AgentCore identity and policy features, lineage and model cards, grounding methods, the five governance services and the five scopes. A one-page summary of these, reviewed every few days, is enough for most candidates to turn the domain into reliable points.