A team is building a generative-AI assistant over customer records. Which TWO controls belong in a sound AI data-governance plan? (Select TWO.)
Choose 2 answers.
A.Restrict data access with IAM policies scoped to what the application actually needs
Correct. Least-privilege scoping is foundational to AI data governance.
B.Send all customer data to the foundation model so it learns the business
Maximizing data exposure violates minimization principles.
C.Detect and redact PII before documents reach the model context
Correct. PII detection/redaction before model context is a core safeguard.
D.Disable encryption so the model can read the data faster
Disabling encryption removes a protection with no real benefit.
E.Share the dataset publicly to improve community benchmarks
Publishing customer data is a serious privacy breach.
Why this answer
Sound AI governance applies least-privilege access control to training/context data and prevents sensitive data (PII) from leaking into prompts — via classification and redaction. Data sent to a model provider should be minimized, not maximized.
Correct answers: A, C · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the AI Security & Governance practice session.
Practice AI Security & Governance