AIF-C01 Practice Exam 1 — 20 Questions

Question 1

A company is using Amazon Bedrock to generate code snippets. They want to ensure the generated code is secure. Which TWO practices should they implement?

Accepted Answer

Use guardrails to block insecure code patterns.. Option B is correct because Amazon Bedrock Guardrails allow you to define policies that filter or block generated content containing insecure code patterns, such as SQL injection or hardcoded credentials, before the output is returned. This provides a proactive security layer that prevents insecure code from reaching the user, directly addressing the requirement to ensure generated code is secure.

Answer

Increase the max token limit to generate longer code.

Answer

Set the temperature to 0 for deterministic output.

Answer

Use a larger model for better accuracy.

Question 2

A healthcare company is using Amazon Bedrock to summarize patient notes. The compliance team requires that no patient data is used to improve the underlying foundation model. Which configuration should the team choose?

Accepted Answer

Disable model training data logging in the AWS console.. Option C is correct because disabling model training data logging in the AWS console prevents Amazon Bedrock from using customer inference data to improve the underlying foundation model. This setting ensures compliance with the requirement that no patient data is used for model training, as Bedrock offers a specific toggle to opt out of data sharing for model improvement.

Answer

Enable data encryption in transit and at rest.

Answer

Use a different foundation model from a different provider.

Answer

Configure a VPC endpoint for Amazon Bedrock.

Question 3

A company is using Amazon Bedrock to generate marketing copy. They want to evaluate the quality of the generated text. Which metric is MOST suitable for assessing the relevance and coherence of the content?

Accepted Answer

ROUGE-N. ROUGE-N (Recall-Oriented Understudy for Gisting Evaluation) measures the overlap of n-grams between generated text and reference text, making it suitable for assessing relevance and coherence in content generation tasks like marketing copy. It evaluates how well the generated text captures key phrases and maintains logical flow, which aligns with the need to assess content quality beyond simple factual accuracy.

Answer

Accuracy

Answer

Perplexity

Answer

BLEU score

Question 4

An organization wants to detect anomalies in real-time streaming data from IoT devices. The data includes sensor readings, and the team plans to use a machine learning model. Which AWS service should be used to build and deploy the model with minimal operational overhead?

Accepted Answer

Amazon SageMaker. Amazon SageMaker is the correct choice because it provides a fully managed environment for building, training, and deploying machine learning models at scale. For real-time anomaly detection on streaming IoT data, SageMaker can host a trained model as a real-time endpoint that processes incoming sensor readings via Amazon Kinesis Data Streams or AWS Lambda, minimizing operational overhead by handling infrastructure, scaling, and monitoring automatically.

Answer

AWS Glue

Answer

Amazon QuickSight

Answer

Amazon Kinesis Data Analytics

Question 5

A company is deploying a machine learning model for real-time fraud detection. The model must make predictions with latency under 10 milliseconds. The data scientist trained a gradient boosting model that achieves high accuracy but has inference latency of 50 milliseconds. The team has access to a larger instance type with more CPU cores. Which approach should the data scientist take to reduce inference latency while maintaining accuracy?

Accepted Answer

Deploy the model on a larger instance with more CPU cores.. Option B is correct because increasing the number of CPU cores allows the gradient boosting model to parallelize tree evaluation across multiple cores, reducing inference latency. Since the model is already trained and accurate, this hardware scaling directly addresses the 50 ms bottleneck without altering the model's structure or accuracy.

Answer

Switch to batch inference and run predictions every 100 milliseconds.

Answer

Reduce the maximum tree depth and retrain the model.

Answer

Apply post-training pruning to remove redundant trees.

Question 6

A company is using Amazon Bedrock to generate marketing content. They want to evaluate the quality of the generated text. Which TWO metrics are most appropriate for evaluating text quality?

Accepted Answer

Perplexity. Perplexity measures how well a language model predicts a sample, with lower values indicating higher confidence and coherence in generated text. BLEU evaluates the overlap between generated text and reference text, making it suitable for assessing fluency and relevance in content generation tasks like marketing copy.

Answer

Precision

Answer

Accuracy

Answer

F1 score

Question 7

A company wants to classify customer emails into categories (e.g., complaint, inquiry, feedback) using a foundation model. Which approach is MOST efficient?

Accepted Answer

Use Amazon Comprehend for custom classification. Amazon Comprehend provides a managed custom classification API that is purpose-built for text classification tasks like categorizing emails. It requires only a small set of labeled data to train a custom classifier, eliminating the need to manage infrastructure or fine-tune large models, making it the most efficient choice for this specific use case.

Answer

Train a custom model using Amazon SageMaker

Answer

Fine-tune a large language model on labeled emails

Answer

Use Amazon Lex with a classifier intent

Question 8

A team is training a binary classification model using Amazon SageMaker. They notice that the training accuracy is 99% but the test accuracy is only 70%. Which technique should they apply first to address this?

Accepted Answer

Apply regularization. The high training accuracy (99%) paired with significantly lower test accuracy (70%) is a classic symptom of overfitting, where the model memorizes the training data instead of learning generalizable patterns. Regularization (Option B) is the first-line technique to combat overfitting by adding a penalty to the loss function (e.g., L1 or L2 regularization), which discourages overly complex decision boundaries. In Amazon SageMaker, this can be implemented via hyperparameters like `l1` or `l2` in built-in algorithms or by adding dropout layers in a custom framework.

Answer

Reduce training data

Answer

Increase learning rate

Answer

Increase model complexity

Question 9

Which TWO of the following are types of feature scaling?

Accepted Answer

Standardization. Standardization (Z-score scaling) transforms features to have a mean of 0 and a standard deviation of 1, making it a valid type of feature scaling. It is essential when using algorithms that assume normally distributed data, such as linear regression, SVM, or PCA, and it does not bound the data to a fixed range.

Answer

One-hot encoding

Answer

Principal Component Analysis (PCA)

Answer

Binning

Question 10

Refer to the exhibit. A data scientist ran a training job on Amazon SageMaker. The job failed with the error shown. What is the most likely cause?

Accepted Answer

The batch size is too large for the instance's GPU memory. The error message indicates a CUDA out-of-memory error, which occurs when the GPU memory is insufficient for the requested batch size. Option D is correct because increasing the batch size beyond the GPU's memory capacity causes the training job to fail with this specific error.

Answer

The S3 input path is incorrect

Answer

The IAM role does not have permission to access S3

Answer

The training code has a syntax error

Question 11

Refer to the exhibit. A SageMaker training job fails with an 'AccessDenied' error when trying to read files from the S3 bucket 'my-training-data'. The IAM role used by the training job has the policy shown. What is the most likely reason for the failure?

Accepted Answer

The policy does not include the s3:ListBucket action. The IAM policy grants s3:GetObject but not s3:ListBucket. When a SageMaker training job reads files from S3, the SageMaker SDK or framework (e.g., TensorFlow, PyTorch) often performs a ListBucket call first to enumerate objects in the prefix. Without s3:ListBucket, the SDK cannot discover the files, resulting in an AccessDenied error even though GetObject is allowed.

Answer

The bucket policy requires encryption in transit

Answer

The training job is using the wrong AWS region

Answer

The policy does not include the s3:PutObject action

Question 12

An organization wants to use Amazon Rekognition to analyze images of people for a security application. They must comply with GDPR. What is the best practice?

Accepted Answer

Ensure all images are anonymized before analysis. Option C is correct because GDPR requires that personal data, including facial images, be processed lawfully and with appropriate safeguards. Anonymizing images before analysis with Amazon Rekognition ensures that the data cannot be linked back to an identifiable person, thereby reducing GDPR compliance risk. This aligns with the principle of data minimization and privacy by design.

Answer

Store images indefinitely for audit

Answer

Use celebrity recognition

Answer

Use face detection only

Question 13

A data scientist sets up a Model Monitoring schedule for data quality. What is a potential security issue with this configuration?

Accepted Answer

The monitoring job uses a single role for both training and monitoring, violating least privilege. Option A is correct because using a single AWS Identity and Access Management (IAM) role for both the training job and the monitoring job violates the principle of least privilege. The training role typically requires broader permissions (e.g., access to training datasets, SageMaker full access), while the monitoring role only needs read-only access to the endpoint and write access to the monitoring output location. Sharing a single role increases the blast radius if the monitoring job is compromised, as an attacker could leverage the elevated training permissions to modify or exfiltrate data.

Answer

The schedule runs every hour, which may generate too many logs

Answer

The monitoring job uses the same endpoint as the production model

Answer

The output is stored in an S3 bucket with no encryption

Question 14

Refer to the exhibit. A security analyst is reviewing CloudTrail logs and notices a training job creation from an IP address (203.0.113.5) that is not associated with the company's network. What is the most likely cause?

Accepted Answer

The user john.doe is accessing the AWS Management Console from a VPN.. The IP address 203.0.113.5 is a non-routable test IP (RFC 5737) and not associated with the company's network. The most likely cause is that user john.doe is accessing the AWS Management Console through a VPN, which would route traffic through the VPN's public IP rather than the corporate network. This explains why the source IP appears external while the user identity is legitimate.

Answer

The CloudTrail log is being generated by a cross-account role.

Answer

The training job was created using the AWS CLI from an external machine.

Answer

The training job was created by a malicious actor who stole credentials.

Question 15

A financial services company is deploying a machine learning model that must comply with SOC 2 and PCI DSS. They need to ensure that the model artifacts and training data are encrypted, access is audited, and the environment is protected from network threats. Which THREE AWS services should they implement?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, which helps protect the environment from network threats as required by SOC 2 and PCI DSS. By analyzing VPC Flow Logs, DNS logs, and CloudTrail events, it can detect anomalies such as port scanning or data exfiltration, directly addressing the need for network threat protection in a compliant ML deployment.

Answer

Amazon DynamoDB Accelerator (DAX)

Answer

AWS WAF

Question 16

A security engineer creates the above IAM policy to allow a user to invoke an Amazon Bedrock model. However, invocation fails. What is the issue?

Accepted Answer

The ARN should use "foundation-model" instead of "model".. Option C is correct because the IAM policy's resource ARN incorrectly uses 'model' in the path, but Amazon Bedrock requires 'foundation-model' to reference foundation models. The correct ARN format for invoking a Bedrock foundation model is 'arn:aws:bedrock:region::foundation-model/model-id'. Using 'model' instead of 'foundation-model' causes the policy to not match any valid Bedrock resource, resulting in an invocation failure.

Answer

The action should be "bedrock:InvokeModelWithResponseStream".

Answer

The resource ARN is missing the account ID.

Answer

The statement is missing a condition for the model ID.

Question 17

A research team is using Amazon Bedrock to analyze scientific papers. They want the model to generate answers based only on papers published after 2023. Which approach should they use?

Accepted Answer

Use Amazon Bedrock Knowledge Bases with a metadata filter to retrieve only papers published after 2023, and generate responses based on retrieved content.. Option D is correct because Amazon Bedrock Knowledge Bases with a metadata filter allows you to restrict retrieval to only documents that match specific metadata criteria, such as publication year. By filtering the vector search to only include papers published after 2023, the model generates responses based solely on that retrieved content, ensuring it does not rely on pre-2023 data. This approach is the only one that guarantees the model's answers are grounded exclusively in the specified time range.

Answer

Fine-tune the model on a dataset of post-2023 papers and deploy it.

Answer

Set the maxTokens to a low value to force the model to rely on recent context.

Answer

Include a system prompt instructing the model to ignore data before 2023.

Question 18

A developer encounters the error shown above when using Amazon Bedrock. What is the most likely cause?

Accepted Answer

The IAM role lacks the required permission. The error indicates an access denied or authorization failure when invoking the Amazon Bedrock model. The most likely cause is that the IAM role used by the developer does not have the required permission, such as `bedrock:InvokeModel`, attached to its policy. Without this permission, the API call to Bedrock is rejected regardless of model availability or service status.

Answer

The model is not available in the region

Answer

The request is throttled

Answer

The model is out of service

Question 19

A company is using Amazon Bedrock to generate images. They want to ensure the outputs comply with content policies. Which TWO AWS services can help? (Choose two.)

Accepted Answer

Amazon Augmented AI (A2I). Amazon Augmented AI (A2I) is correct because it enables human review of model predictions to ensure compliance with content policies. For image generation on Bedrock, A2I can route outputs that fall below a confidence threshold to human reviewers, providing a safety net for policy adherence.

Answer

Amazon GuardDuty

Answer

AWS WAF

Answer

Amazon Comprehend

Question 20

A data scientist is using a foundation model to summarize long documents. Which TWO of the following steps are most likely to improve the quality of the summaries?

Accepted Answer

Break the input document into chunks and summarize each chunk separately.. Option A is correct because foundation models have a fixed maximum context window (e.g., 4,096 tokens for GPT-3.5). By breaking a long document into smaller chunks and summarizing each independently, you avoid truncation and ensure the model can process the entire content without losing information. This chunking strategy is a standard preprocessing technique for handling documents that exceed the model's context length.

Answer

Use a high temperature parameter to increase creativity.

Answer

Use a low frequency penalty to reduce repetition.

Answer

Use a longer context length by increasing the max tokens parameter.