AIP-C01 AI Safety Security And Governance — 10 Questions

Question 1

You are configuring a Guardrail for a multilingual application. What is the best practice for configuring content filters?

Accepted Answer

Create one Guardrail per language. Configure multiple language-specific filters or ensure the Guardrail content filter is configured to handle the detected language of the input.

Answer

Disable filters for non-English languages

Answer

Translate all inputs to English first

Answer

Use a regex-based filter only

Question 2

You are deploying a Generative AI application using Amazon SageMaker JumpStart. You need to ensure that the model endpoint is protected against prompt injection attacks. Which approach is most effective?

Accepted Answer

Use a prompt-based filter system that detects malicious intent via a secondary validation model. Implementing Guardrails for Amazon Bedrock or a similar input validation layer using semantic checks is the recommended way to mitigate prompt injection.

Answer

Encrypt the model weights with a CMK

Answer

Enable Amazon Inspector on the endpoint

Answer

Disable the API Gateway execute-api method

Question 3

An enterprise requires that all Generative AI model outputs are logged for compliance, but logs must not contain any PII. How can this be achieved in an AWS environment using Amazon Bedrock?

Accepted Answer

Enable Bedrock Model Invocation Logging with Guardrails PII redaction enabled. Configuring Model Invocation Logging in Bedrock to send logs to CloudWatch or S3, combined with Guardrails PII redaction, ensures compliant logging.

Answer

Write a Lambda function to strip logs before writing to S3

Answer

Use IAM policies to prevent logs from being written

Answer

Use AWS CloudTrail to log API calls and enable redaction in CloudWatch

Question 4

A developer wants to prevent the Generative AI application from producing content related to hate speech or violence. What is the most efficient configuration in Amazon Bedrock?

Accepted Answer

Implement Amazon Bedrock Guardrails with content filters. Bedrock Guardrails allows for configuring content filters with specific thresholds for hate, sexual, violence, and self-harm content.

Answer

Create a custom fine-tuned model

Answer

Use AWS Config rules to monitor the model

Answer

Add a system prompt to the application code

Question 5

A company is using RAG with Amazon Bedrock Knowledge Bases. They need to ensure that users can only retrieve documents they are authorized to see. How should this be implemented?

Accepted Answer

Use the filters attribute in the Retrieve API call based on document metadata. You must implement metadata filtering in the Knowledge Base query. When invoking Retrieve, you can apply filters based on user attributes stored in the document metadata.

Answer

Encrypt the documents with different KMS keys

Answer

Create separate Knowledge Bases for every user

Answer

Apply IAM policies to the S3 bucket

Question 6

To ensure compliance with data residency requirements, you must restrict which AWS regions your Generative AI application can process data. What is the most effective way to enforce this?

Accepted Answer

Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) can be used to deny Bedrock service access in restricted regions.

Answer

VPC Endpoint policies

Answer

IAM policies for all users

Answer

CloudFront geographic restrictions

Question 7

Your organization needs to ensure that only authorized IAM users can access specific foundation models in Bedrock. Which configuration is required?

Accepted Answer

Attach an IAM policy with bedrock:InvokeModel allowing access to specific model ARNs. You must explicitly grant permission to the specific Bedrock model ARNs in the IAM policy attached to the user or role.

Answer

Enable AWS Organizations SCPs only

Answer

Use Amazon Cognito user pools

Answer

Use Resource-Based Policies on the foundation model

Question 8

Which service should be used to monitor the cost and usage of API requests made to Amazon Bedrock models?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides detailed analytics and reporting on usage costs for all AWS services, including Bedrock.

Answer

Amazon CloudWatch Metrics

Answer

AWS Trusted Advisor

Answer

Amazon QuickSight

Question 9

A company is using Amazon Bedrock to build a customer support chatbot and needs to ensure that PII is masked before the request reaches the foundation model. Which feature should the developer implement?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails provides built-in PII redaction capabilities to identify and mask sensitive information in both prompts and responses.

Answer

AWS KMS with envelope encryption

Answer

Amazon Macie

Answer

AWS WAF with custom regex rules

Question 10

A company is using Amazon Q Business. How can they restrict access to specific data sources for different groups of users?

Accepted Answer

Configure ACLs in the data source connector. Amazon Q Business uses access control lists (ACLs) synced from the data source to ensure users only retrieve information they have permissions to access.

Answer

Create separate Amazon Q applications

Answer

Manually delete documents for specific users

Answer

Apply IAM policies to the user's login