AIF-C01 Practice Test 24 — 15 Questions

Question 1

A financial services company uses Amazon Bedrock to power a customer-facing chatbot that answers questions about loan products. During a compliance review, auditors ask the team to demonstrate that the chatbot's responses are grounded in approved policy documents and that the model is not generating unsupported financial advice. Which AWS service or feature should the team use to trace each response back to the specific source passages used to generate it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Bedrock Knowledge Bases with citations enabled. The requirement is per-response provenance: showing which approved source passages produced each answer. Amazon Bedrock Knowledge Bases with citations enabled returns references to the retrieved chunks alongside the generated text, giving auditors a traceable map. Guardrails can detect ungrounded output but does not cite sources, while Model Monitor and CloudTrail address operational drift and API activity rather than content traceability.

Answer

Amazon Bedrock Guardrails with contextual grounding checks

Answer

AWS CloudTrail with Bedrock data events logging

Answer

Amazon SageMaker Model Monitor with data quality baseline

Question 2

A developer runs this AWS CLI command to invoke a model in us-west-2 but receives an error: 'An error occurred (ModelNotFoundException) when calling the InvokeModel operation: Model not found'. What is the most likely cause?

Accepted Answer

The model is not available in the us-west-2 region. The error 'ModelNotFoundException' specifically indicates that the model ID or ARN is not recognized in the specified region. AWS Bedrock models are region-specific; not all foundation models are available in every AWS region. The developer invoked the model in us-west-2, but the requested model may only be available in regions like us-east-1 or us-west-1, causing the service to return a ModelNotFoundException rather than a permissions or formatting error.

Answer

The request body is not properly formatted

Answer

The --region parameter is missing from the command

Answer

The user's IAM role lacks permissions to invoke the model

Question 3

Which THREE are best practices for building a secure and scalable generative AI application using Amazon Bedrock? (Choose 3)

Accepted Answer

Implement guardrails to filter harmful content. Option A is correct because Amazon Bedrock Guardrails let you define denied topics, content filters, word filters, and PII redaction policies that are applied to both prompts and model responses, which is a core best practice for filtering harmful or non-compliant content in a generative AI application. Option D is correct because AWS KMS provides customer-managed keys and envelope encryption for data at rest, including model artifacts, knowledge bases, and logs, satisfying security and compliance requirements for protecting sensitive data. Option E is correct because Bedrock offers a unified, serverless API to access foundation models from multiple providers such as Anthropic, Meta, Mistral, Cohere, and Amazon, enabling model choice, fallback, and cost/performance optimization without managing infrastructure, which supports scalability. Option B is not a Bedrock best practice because deploying models on self-managed EC2 instances moves you away from Bedrock's serverless, managed scaling and shifts patching, scaling, and security responsibilities to you. Option C is incorrect because hardcoding API keys in source code exposes credentials to leakage via repositories and logs; you should use AWS Secrets Manager or IAM roles instead.

Answer

Deploy models on EC2 instances for better control

Answer

Store API keys in source code for easy access

Question 4

A company is deploying a generative AI model on Amazon Bedrock and needs to monitor for potential misuse. Which THREE measures should they implement? (Choose 3)

Accepted Answer

Configure Amazon Bedrock Guardrails to block harmful content.. Option B is correct because Amazon Bedrock Guardrails are purpose-built to detect and block harmful or inappropriate content (e.g., hate, violence, prompt injection) in both prompts and model responses, directly addressing misuse monitoring and prevention. Option C is correct because AWS CloudTrail records all Bedrock API activity and management events, providing an auditable trail of who invoked which model, when, and from where, which is essential for detecting misuse. Option E is correct because enabling model invocation logging sends full request/response data to Amazon CloudWatch Logs, allowing continuous monitoring, alerting, and forensic analysis of model inputs and outputs. Option A is not appropriate because MFA applies to human console sign-ins, not programmatic API calls, and Bedrock APIs use IAM credentials/signatures rather than MFA tokens. Option D is not required for misuse monitoring; a private VPC endpoint improves network isolation but does not detect or log misuse, and Bedrock endpoints are AWS-managed services accessed via VPC endpoints rather than being 'placed' in a VPC.

Answer

Require multi-factor authentication (MFA) for all API calls.

Answer

Place the Bedrock endpoint in a private VPC with no internet access.

Question 5

A company wants to deploy a real-time inference endpoint for a custom model on SageMaker. The model has high latency (100ms) and they need to handle variable traffic with spikes. Which deployment strategy is most cost-effective?

Accepted Answer

Deploy on a single SageMaker endpoint with automatic scaling. A single SageMaker endpoint with automatic scaling allows the endpoint to dynamically adjust the number of instances based on traffic patterns, handling variable traffic and spikes cost-effectively. For a model with 100ms latency, automatic scaling can add instances during spikes and remove them during low traffic, ensuring you only pay for the compute resources you use while maintaining low inference latency.

Answer

Deploy on a SageMaker multi-model endpoint

Answer

Use batch transform

Answer

Use a single large instance type

Question 6

An e-commerce company stores user interaction logs in Amazon S3. They want to use machine learning to segment users based on purchasing behavior. Which unsupervised learning algorithm is most appropriate?

Accepted Answer

K-means clustering. K-means clustering is the most appropriate unsupervised learning algorithm for segmenting users based on purchasing behavior because it groups data points into clusters based on feature similarity without requiring labeled training data. The e-commerce scenario involves discovering natural groupings (segments) in user interaction logs, which is a classic clustering task, and K-means efficiently partitions users into K distinct segments by minimizing within-cluster variance.

Answer

Linear regression

Answer

Random forest

Answer

Neural network

Question 7

A company wants to build a customer service chatbot that answers questions about their internal policy documents. The documents are updated monthly, and the team cannot afford to retrain a model each time. Which approach is MOST appropriate?

Accepted Answer

Use Retrieval-Augmented Generation (RAG) with the policy documents indexed in a vector store. Retrieval-Augmented Generation (RAG) is the most appropriate approach because it allows the chatbot to answer questions based on the latest policy documents without retraining the model. By indexing the documents in a vector store, the system retrieves relevant chunks for each query and passes them to the LLM as context, enabling accurate, up-to-date responses even as documents change monthly.

Answer

Use a larger foundation model with a longer context window and paste all documents into each prompt

Answer

Train a custom model from scratch on the policy documents each month

Answer

Fine-tune a base LLM on the policy documents monthly

Question 8

A social media company uses Amazon Comprehend to moderate user comments. They want to avoid censoring legitimate speech while catching hate speech. Which approach aligns with responsible AI governance?

Accepted Answer

Implement a human-in-the-loop review for borderline cases. A human-in-the-loop (HITL) review for borderline cases aligns with responsible AI governance by balancing automated detection with human judgment. Amazon Comprehend can flag comments with moderate confidence scores (e.g., 0.5–0.9) for manual review, ensuring that ambiguous or context-dependent hate speech is not censored while still catching clear violations. This approach mitigates false positives and respects free expression, which is a core tenet of responsible AI.

Answer

Use multiple models and average their scores

Answer

Use a single model with high confidence threshold

Answer

Rely solely on automated filtering

Question 9

A company wants to personalize its generative AI model for its specific domain without sharing data with third-party model providers. Which method should they use?

Accepted Answer

Fine-tuning the foundation model on their proprietary data. Fine-tuning the foundation model on proprietary data allows the company to adapt the model's weights to its specific domain without sharing data with third parties. This method trains the model on private datasets, enabling it to learn domain-specific patterns and terminology while keeping data in-house, which is critical for data privacy and compliance.

Answer

Prompt engineering with domain-specific examples

Answer

Retrieval-augmented generation (RAG) with a domain-specific knowledge base

Answer

Model distillation using a larger foundation model

Question 10

A company uses Amazon Bedrock to generate marketing copy. The summaries are too verbose. Which parameter should be decreased to directly limit the length of the output?

Accepted Answer

max_tokens. The `max_tokens` parameter directly controls the maximum number of tokens (words or subwords) in the generated output. By decreasing this value, you explicitly cap the length of the marketing copy, making it less verbose. This is the most direct way to limit output length in Amazon Bedrock and other LLM APIs.

Answer

temperature

Answer

top_p

Answer

frequency_penalty

Question 11

During model training, the loss decreases rapidly for the first few epochs and then plateaus. The validation loss starts increasing after some epochs. What should the team do to improve generalization?

Accepted Answer

Early stopping. The validation loss increasing while training loss continues to decrease is a classic sign of overfitting. Early stopping (Option B) halts training when validation performance stops improving, preventing the model from memorizing noise in the training data and thereby improving generalization.

Answer

Increase learning rate

Answer

Increase training epochs

Answer

Add more layers

Question 12

A team is training a binary classification model using Amazon SageMaker. They notice that the training accuracy is 99% but the test accuracy is only 70%. Which technique should they apply first to address this?

Accepted Answer

Apply regularization. The high training accuracy (99%) paired with significantly lower test accuracy (70%) is a classic symptom of overfitting, where the model memorizes the training data instead of learning generalizable patterns. Regularization (Option B) is the first-line technique to combat overfitting by adding a penalty to the loss function (e.g., L1 or L2 regularization), which discourages overly complex decision boundaries. In Amazon SageMaker, this can be implemented via hyperparameters like `l1` or `l2` in built-in algorithms or by adding dropout layers in a custom framework.

Answer

Reduce training data

Answer

Increase learning rate

Answer

Increase model complexity

Question 13

A financial institution uses Amazon SageMaker to host a model for credit scoring. The model was trained on data that includes demographic attributes. During a routine audit, the compliance team finds that the model produces significantly different approval rates for applicants of different ethnicities, even when credit profiles are similar. The institution must continue using the model but needs to ensure compliance with fair lending laws. What should the company do FIRST?

Accepted Answer

Run Amazon SageMaker Clarify to analyze the model for bias and generate a bias report.. Amazon SageMaker Clarify is the correct first step because it provides built-in bias detection and explainability for machine learning models. Before taking any corrective action, the company must first quantify and understand the nature and extent of the bias using SageMaker Clarify's bias metrics (e.g., Difference in Positive Proportions, Disparate Impact). This diagnostic report is essential for compliance documentation and for determining whether the bias is due to the model, the data, or the threshold, thereby guiding any subsequent remediation steps.

Answer

Adjust the decision threshold to equalize approval rates across groups.

Answer

Document the disparity in a compliance report and continue using the model.

Answer

Replace the model with a simpler explainable model to eliminate bias.

Question 14

A healthcare company is developing a machine learning model using Amazon SageMaker to process protected health information (PHI). They have strict security requirements to comply with HIPAA. The company has implemented the following measures: All training data is stored in an S3 bucket with server-side encryption using AWS KMS. The data is accessed exclusively through Amazon SageMaker notebooks running in a private VPC with no internet access. The VPC has a VPC endpoint for S3 to ensure traffic stays within the AWS network. Despite these measures, a recent security audit discovered that the S3 bucket containing the training data is accessible from an IP address outside the company's network. Upon investigation, it was found that the bucket policy allowed access from any IP address due to a misconfigured bucket policy. Which corrective action should the company take to prevent this issue from recurring?

Accepted Answer

Add a condition in the bucket policy to restrict access to the VPC endpoint ID.. The bucket policy allowed access from any IP address, which is a misconfiguration. To restrict access to only the VPC endpoint, the company should add a condition in the bucket policy that denies requests unless they come from the specific VPC endpoint ID. This ensures that only traffic originating from the VPC endpoint (and thus within the AWS network) can access the bucket, aligning with HIPAA security requirements.

Answer

Move the training data to an EBS volume attached to the SageMaker notebook.

Answer

Remove the bucket policy and rely solely on IAM policies to control access.

Answer

Disable S3 Block Public Access settings to allow more granular control.

Question 15

A company has deployed a machine learning model using Amazon SageMaker and wants to monitor the model for bias over time. Which SageMaker feature should they use to detect bias in the model's predictions after deployment?

Accepted Answer

SageMaker Clarify. SageMaker Clarify is designed to detect bias in ML models both before and after deployment. It can analyze predictions to identify potential bias against certain groups.

Answer

SageMaker Debugger

Answer

SageMaker Model Monitor

Answer

SageMaker Role Manager