AIF-C01 Applications of Foundation Models Practice Test 4 — 15 Questions

Question 1

A company uses Amazon Bedrock to generate code snippets for internal tools. They notice that the generated code often contains security vulnerabilities such as SQL injection and cross-site scripting. The security team has compiled a comprehensive list of secure coding guidelines and examples of vulnerable patterns. The development team wants to reduce vulnerabilities without significantly slowing down the code generation process. They have tried adding the guidelines to the system prompt, but the model still produces insecure code occasionally. The team is considering additional measures. Which action should they take to most effectively eliminate security vulnerabilities in the generated code?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a post-processing step using Amazon CodeGuru or a similar static analysis tool to scan the generated code for vulnerabilities and reject or fix insecure code.. It introduces a deterministic, post-generation validation layer that catches vulnerabilities the model might miss. Amazon CodeGuru Reviewer or similar static analysis tools can scan generated code for patterns like SQL injection and XSS, then reject or fix insecure code without modifying the generation process itself. This approach directly addresses the security team's guidelines while maintaining generation speed, as the model's inference latency is unaffected.

Answer

Use a larger, more expensive foundation model that specializes in code generation.

Answer

Include the complete secure coding guidelines in every prompt.

Answer

Increase the temperature parameter of the foundation model to promote more diverse outputs.

Question 2

A company is deploying a customer service chatbot using a large language model (LLM) via Amazon Bedrock. The application must meet high accuracy for domain-specific queries, low latency, and be cost-effective. Which TWO strategies should the company adopt to achieve these goals? (Choose two.)

Accepted Answer

Store user prompts in a shared cache to reuse common queries.. Option C is correct because a Retrieval-Augmented Generation (RAG) architecture with a vector database (e.g., Amazon OpenSearch Serverless or Aurora pgvector) injects accurate, up-to-date domain-specific context into the prompt at inference time, which raises answer accuracy for customer service queries without the cost and latency of retraining. Option A is correct because caching frequent or identical prompts (for example with Amazon Bedrock prompt caching or an ElastiCache/DynamoDB response cache) avoids repeated LLM invocations, directly reducing both latency and per-token cost for common customer queries. Option B is not appropriate here because fine-tuning on transcripts is expensive, slow to iterate, and does not guarantee factual accuracy or freshness, making it a poor fit for the stated low-latency and cost-effective requirements. Option D is not correct because deliberately trading accuracy for throughput conflicts with the requirement for high accuracy on domain-specific queries. Option E is not correct because increasing the maximum token limit only allows longer inputs; it does not improve domain accuracy and can actually increase latency and cost.

Answer

Fine-tune the model on a large corpus of customer service transcripts to improve domain knowledge.

Answer

Select a smaller, faster model that trades some accuracy for throughput.

Answer

Increase the model's maximum token limit to handle longer customer queries.

Question 3

A retail company wants to build a product description generator using Amazon Bedrock. The marketing team requires that the model output always follows a specific JSON schema with fields 'title', 'description', and 'price'. Which approach should the developer use to reliably enforce this structure?

Accepted Answer

Provide a detailed prompt with an example JSON output and use the model's response format parameter if supported.. To reliably enforce a specific JSON schema, the best approach is to leverage the model's native support for structured output, such as a response format parameter set to JSON, and to provide a clear prompt with an example. This constrains the model's generation to valid JSON, reducing the need for post-processing. Other methods like Guardrails or stop sequences do not control output structure.

Answer

Use the Amazon Bedrock Guardrails feature to define a regex pattern that validates the JSON structure.

Answer

Post-process the model's output with an AWS Lambda function that uses regular expressions to extract the required fields.

Answer

Configure the model's inference parameters to include a stop sequence that forces JSON formatting.

Question 4

A developer is using Amazon Bedrock to generate code snippets. They want to reduce the likelihood of the model generating insecure code. Which approach is MOST effective?

Accepted Answer

Use a lower temperature and provide a prompt that explicitly instructs the model to follow security best practices.. The most effective approach to reduce insecure code generation is to use a lower temperature and a prompt that explicitly instructs the model to follow security best practices. Lower temperature reduces randomness, and explicit instructions guide the model toward secure patterns. Fine-tuning or Guardrails are less direct or effective for this purpose.

Answer

Increase the temperature parameter to encourage more creative and secure code.

Answer

Fine-tune the model on a dataset of secure code repositories.

Answer

Enable Amazon Bedrock Guardrails with a word filter that blocks insecure code patterns.

Question 5

A marketing firm uses Amazon Bedrock to generate ad copy. They notice that the generated text often includes factual inaccuracies about their products. Which technique would most effectively reduce these inaccuracies?

Accepted Answer

Implement Retrieval-Augmented Generation (RAG) with a product knowledge base.. Retrieval-Augmented Generation (RAG) grounds the model's output in a trusted, external knowledge base by retrieving relevant product documents before generating text. This directly addresses factual inaccuracies because the model references authoritative data rather than relying solely on its parametric memory, which may contain outdated or incorrect information.

Answer

Use longer, more detailed prompts.

Answer

Increase the temperature parameter to 0.9.

Answer

Fine-tune the model on a dataset of previous ad copies.

Question 6

A developer is using Amazon Bedrock to build a chatbot that answers customer queries. The chatbot must only respond based on the provided company documentation. Which approach best meets this requirement?

Accepted Answer

Use a RAG architecture with the company documentation as the knowledge base.. Retrieval-Augmented Generation (RAG) architecture retrieves relevant chunks from the company documentation at query time and injects them into the prompt, ensuring the model's response is grounded solely in the provided documents. This approach prevents the model from relying on its internal training data or generating information outside the documentation, which is critical for a closed-domain chatbot.

Answer

Use prompt engineering to instruct the model to only use documentation.

Answer

Fine-tune a foundation model on the company documentation.

Answer

Use a text classification model to filter responses.

Question 7

A financial services company is deploying a foundation model to analyze customer sentiment from call transcripts. The model outputs must be consistent and deterministic for auditing purposes. Which parameter configuration should the company use?

Accepted Answer

Set temperature to 0 and top_p to 1.. Setting temperature to 0 and top_p to 1 forces the model to always select the highest-probability token at each step, producing deterministic and repeatable outputs. This is essential for auditing and compliance in financial services, where consistency is required. Any nonzero temperature introduces randomness, which undermines determinism.

Answer

Set temperature to 0.1 and top_p to 0.9.

Answer

Set temperature to 0.7 and top_p to 1.0.

Answer

Set temperature to 0.5 and top_p to 0.5.

Question 8

An e-commerce company is using a foundation model to generate product descriptions. They want to reduce costs by caching frequently requested descriptions. Which AWS service should they use to implement a cache?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides an in-memory caching layer (using Redis or Memcached) that can store frequently requested product descriptions, reducing the need to invoke the foundation model repeatedly. This directly lowers inference costs and latency by serving cached responses instead of generating new ones each time.

Answer

Amazon CloudFront

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 9

A company wants to use a foundation model to automatically moderate user-generated content. The model must filter out inappropriate content with high accuracy. Which Amazon service is best suited for this task?

Accepted Answer

Amazon Comprehend. Amazon Comprehend is the correct choice because it is a natural language processing (NLP) service that can analyze text for sentiment, key phrases, and — critically — toxicity and inappropriate content using built-in or custom classifiers. This directly matches the requirement to moderate user-generated text with high accuracy, as it can detect hate speech, profanity, and other harmful language.

Answer

Amazon Translate

Answer

Amazon Rekognition

Answer

Amazon Polly

Question 10

A startup is using Amazon Bedrock to power a virtual assistant. They need to ensure that personally identifiable information (PII) is not included in the model's responses. Which feature should they enable?

Accepted Answer

Enable PII redaction in the Bedrock guardrails.. Amazon Bedrock Guardrails provide a configurable content filtering and PII redaction feature that can automatically detect and mask personally identifiable information (PII) in model inputs and outputs. By enabling PII redaction within guardrails, the startup can ensure that sensitive data like names, addresses, or credit card numbers are removed or obfuscated before the virtual assistant's responses reach the user. This is the direct and intended mechanism for preventing PII leakage in model responses.

Answer

Enable model invocation logging.

Answer

Configure a VPC endpoint.

Answer

Enable data encryption at rest.

Question 11

A company is using Amazon Bedrock to generate marketing content. They want to evaluate the quality of the generated text. Which TWO metrics are most appropriate for evaluating text quality?

Accepted Answer

Perplexity. Perplexity (B) is a standard intrinsic metric for generative language models that measures how well a probability distribution predicts a sample, with lower values indicating the model is less surprised by the text and thus produces more fluent, coherent output. BLEU (E) is a reference-based metric that compares n-gram overlap between generated text and one or more reference texts, making it well suited for evaluating the quality of machine-generated marketing copy against human-written examples. Precision (A), Accuracy (C), and F1 score (D) are classification metrics that require discrete predicted labels and ground-truth classes, so they do not apply to free-form text generation where the output is a sequence of tokens rather than a category.

Answer

Precision

Answer

Accuracy

Answer

F1 score

Question 12

A data scientist is fine-tuning a foundation model on Amazon Bedrock for a custom summarization task. Which THREE practices should they follow to optimize the fine-tuning process?

Accepted Answer

Start with a base model that is already strong in the domain.. Option A is correct because selecting a base model already strong in the target domain gives the fine-tuning process a better starting point, reducing the amount of task-specific data and compute needed to reach high summarization quality. Option C is correct because a representative dataset that reflects the target task ensures the model learns the desired summarization style, domain vocabulary, and input-output distribution, which directly improves fine-tuning effectiveness. Option D is correct because monitoring training loss and validation loss lets the data scientist detect overfitting early and apply mitigations such as early stopping, regularization, or more data, keeping generalization strong. Option B is not correct because leaving hyperparameters at defaults ignores task-specific tuning of values like learning rate, batch size, and epoch count, which often materially affects fine-tuning results. Option E is not correct because training for as many epochs as possible typically causes overfitting, degrading validation performance rather than optimizing the process.

Answer

Use the default hyperparameters without tuning.

Answer

Train for as many epochs as possible.

Question 13

A company is using Amazon Bedrock to generate code snippets. They want to ensure the generated code is secure. Which TWO practices should they implement?

Accepted Answer

Use guardrails to block insecure code patterns.. Option B is correct because Amazon Bedrock Guardrails let you define denied topics, content filters, and (critically for this scenario) sensitive-information and custom word/regex filters that can detect and block insecure code patterns such as hardcoded credentials or known dangerous constructs before the response is returned. Option D is correct because no generative model guarantees secure output; generated code must be treated as untrusted and go through human review plus SAST/DAST and unit testing in the CI/CD pipeline before deployment, which is the standard secure-SDLC control for AI-generated artifacts. Option A does not belong because raising the max token limit only affects output length, not security posture. Option C does not belong because temperature 0 makes sampling more deterministic but does not make code secure. Option E does not belong because a larger model may improve accuracy or fluency, but accuracy is not a security control and does not prevent insecure code.

Answer

Increase the max token limit to generate longer code.

Answer

Set the temperature to 0 for deterministic output.

Answer

Use a larger model for better accuracy.

Question 14

Refer to the exhibit. An IAM policy is attached to a user. Which models can the user invoke?

Accepted Answer

Only Claude v2. The IAM policy explicitly allows the `bedrock:InvokeModel` action only on the resource ARN `arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-v2`. This means the user can invoke only the Claude v2 model. No other models, including other Claude versions or any model with 'claude' in its name, are permitted because the resource ARN is exact and does not use wildcards.

Answer

No models

Answer

Claude v2 and any model with a name containing 'claude'

Answer

Any model in the account

Question 15

A company is building a chatbot using Amazon Bedrock to answer customer questions about their product catalog. The chatbot should only use information from the company's internal knowledge base and should not generate answers based on the model's pre-training data. Which feature should be enabled?

Accepted Answer

Configure a knowledge base with Retrieval Augmented Generation (RAG). Configuring a knowledge base with Retrieval Augmented Generation (RAG) allows the chatbot to retrieve relevant documents from the company's internal knowledge base and use them as context for generating answers. This ensures the model's responses are grounded solely in the provided data, preventing reliance on its pre-training knowledge.

Answer

Use prompt engineering to instruct the model to only use the knowledge base

Answer

Enable model invocation logging to review responses

Answer

Fine-tune the model on the product catalog data