AIP-C01 AI Safety Security And Governance — 15 Questions

Question 1

An enterprise requires that all Generative AI model outputs are logged for compliance, but logs must not contain any PII. How can this be achieved in an AWS environment using Amazon Bedrock?

Accepted Answer

Enable Bedrock Model Invocation Logging with Guardrails PII redaction enabled. Bedrock Model Invocation Logging captures full request and response payloads to CloudWatch Logs or S3, and when combined with Bedrock Guardrails configured with PII detection and redaction, sensitive entities are masked before the log is written. This satisfies both the compliance requirement (full audit trail of model interactions) and the privacy requirement (no PII in logs) without custom code. Guardrails supports built-in PII filters for categories like NAME, EMAIL, SSN, and PHONE.

Answer

Write a Lambda function to strip logs before writing to S3

Answer

Use IAM policies to prevent logs from being written

Answer

Use AWS CloudTrail to log API calls and enable redaction in CloudWatch

Question 2

Which service should be used to monitor the cost and usage of API requests made to Amazon Bedrock models?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the service designed to visualize, understand, and manage AWS costs and usage over time. It provides detailed cost and usage reports, including for Amazon Bedrock API requests, allowing users to monitor spending by service, account, or tag. CloudWatch Metrics provides operational metrics like invocation counts and latency, but not cost data. Trusted Advisor offers best-practice checks, and QuickSight is a BI tool for custom dashboards.

Answer

Amazon CloudWatch Metrics

Answer

AWS Trusted Advisor

Answer

Amazon QuickSight

Question 3

A researcher wants to ensure the model output does not reference external websites. How can this be enforced?

Accepted Answer

Configure a Guardrail with a Denied Topics policy. Amazon Bedrock Guardrails provide a Denied Topics policy that can block model outputs referencing specified topics, including external websites or URLs. Configuring a guardrail with a denied topic for external references enforces the restriction at the service level, independent of prompt wording. This is the correct mechanism for enforcing output constraints.

Answer

Use a custom system prompt to tell the model not to use URLs

Answer

Disable model streaming

Answer

Use IAM to block internet access for the application

Question 4

A developer needs to ensure that an application only uses approved foundation models. How can they govern this centrally?

Accepted Answer

Use Service Control Policies (SCPs) to deny non-approved models. Service Control Policies (SCPs) in AWS Organizations allow you to centrally govern which AWS services and actions are allowed across all accounts in an organization. To ensure an application only uses approved foundation models (e.g., specific Amazon Bedrock models), the developer can use an SCP that denies access to non-approved model IDs or actions, enforcing the restriction at the organizational level regardless of IAM permissions in individual accounts.

Answer

Create an IAM role for each model

Answer

Use Amazon Cognito

Answer

Hardcode the model ID in the application code

Question 5

A firm needs to ensure that all Generative AI model training data, if used for fine-tuning, is compliant with GDPR. Where should the training data reside?

Accepted Answer

Region-compliant S3 buckets with restricted IAM access and encryption. The data should be stored in S3 buckets located within the region that complies with GDPR, with appropriate encryption and access controls.

Answer

Publicly accessible S3 buckets

Answer

Temporary local storage on the training instance

Answer

DynamoDB tables

Question 6

A business wants to restrict the length of generated outputs to prevent high costs. How can this be done?

Accepted Answer

Set maxTokenCount in the inference configuration. Setting maxTokenCount (or max_new_tokens) in the inference configuration is the correct approach because it directly caps the number of tokens the model can generate per request, which is the primary driver of output cost and latency. This is a native model/inference parameter supported by Amazon Bedrock and SageMaker endpoints, so it enforces the limit at generation time rather than after the fact.

Answer

Use Lambda to truncate text

Answer

Disable streaming

Answer

Use Guardrails to block long responses

Question 7

You are configuring a Guardrail for a multilingual application. What is the best practice for configuring content filters?

Accepted Answer

Create one Guardrail per language. Configure multiple language-specific filters or ensure the Guardrail content filter is configured to handle the detected language of the input.

Answer

Disable filters for non-English languages

Answer

Translate all inputs to English first

Answer

Use a regex-based filter only

Question 8

A generative AI application running on Amazon Bedrock uses an Amazon OpenSearch Serverless vector index for retrieval-augmented generation. A security audit requires that every document retrieved for a user is filtered by the user's department before it is passed to the foundation model. The team wants the filtering to occur inside the vector search without changing application code or the vector schema. Which solution meets these requirements with the LEAST operational effort?

Accepted Answer

Attach metadata to each vector and use the metadata filtering capability of Amazon Bedrock Knowledge Bases during retrieval.. Metadata filtering in Amazon Bedrock Knowledge Bases evaluates attribute expressions during vector retrieval, so only documents matching the user's department reach the foundation model. It avoids duplicate indexes, extra Lambda code, and schema changes. Field-level security and post-retrieval filtering do not achieve in-search document-level authorization for RAG.

Answer

Use an AWS Lambda function after retrieval to call the OpenSearch _search API and remove documents whose department does not match the user.

Answer

Enable OpenSearch Serverless security analytics and define a field-level security policy that restricts the department field.

Answer

Create a separate OpenSearch Serverless collection for each department and route queries based on the caller's IAM role.

Question 9

A government agency is deploying a generative AI application on Amazon Bedrock that processes classified documents. The agency must ensure that all data processed by the application remains within a specific AWS Region and is never used to train or improve the underlying foundation model. The agency also needs to prove compliance to auditors. Which combination of actions should the agency take to meet these requirements?

Accepted Answer

Use Amazon Bedrock in the designated Region, ensure the Bedrock service is configured to not use data for model improvement, and obtain AWS Artifact reports and service documentation for auditors.. The agency must enforce data residency by using Amazon Bedrock in the designated Region and explicitly configure the service to not use data for model improvement. To satisfy auditors, they should collect AWS Artifact reports and service documentation that attest to these controls. The other options either rely on unverified defaults, confuse network isolation with data usage attestation, or propose a service change that does not inherently provide the required guarantees.

Answer

Use Amazon Bedrock in the designated Region and rely on the default data handling policy, which guarantees that data is never used for model training.

Answer

Configure Amazon Bedrock to use a VPC endpoint in the designated Region and enable model invocation logging, then provide the logs to auditors as evidence of data residency and non-training.

Answer

Deploy the application on Amazon SageMaker instead of Amazon Bedrock, because SageMaker guarantees that no data is ever used for training.

Question 10

You are deploying a Generative AI application using Amazon SageMaker JumpStart. You need to ensure that the model endpoint is protected against prompt injection attacks. Which approach is most effective?

Accepted Answer

Use a prompt-based filter system that detects malicious intent via a secondary validation model. A prompt-based filter system that uses a secondary validation model to detect malicious intent is the most effective approach because prompt injection is a semantic/behavioral attack that must be detected by analyzing the input and output content, not by infrastructure controls. A dedicated classifier or LLM-as-judge can flag jailbreak patterns, instruction overrides, and data exfiltration attempts before they reach the primary model.

Answer

Encrypt the model weights with a CMK

Answer

Enable Amazon Inspector on the endpoint

Answer

Disable the API Gateway execute-api method

Question 11

A developer wants to prevent the Generative AI application from producing content related to hate speech or violence. What is the most efficient configuration in Amazon Bedrock?

Accepted Answer

Implement Amazon Bedrock Guardrails with content filters. Amazon Bedrock Guardrails provides configurable content filters that can block hate speech, violence, sexual content, insults, and misconduct, with adjustable strength levels per category. It is the most efficient configuration because it is a managed, no-code policy layer applied at inference time without retraining or modifying the model. Guardrails also supports denied topics, word filters, and PII redaction.

Answer

Create a custom fine-tuned model

Answer

Use AWS Config rules to monitor the model

Answer

Add a system prompt to the application code

Question 12

A company is using RAG with Amazon Bedrock Knowledge Bases. They need to ensure that users can only retrieve documents they are authorized to see. How should this be implemented?

Accepted Answer

Use the filters attribute in the Retrieve API call based on document metadata. Amazon Bedrock Knowledge Bases support metadata filtering on the Retrieve and RetrieveAndGenerate APIs. By attaching authorization metadata (e.g., department, clearance level) to documents during ingestion and passing a filters attribute in the Retrieve call based on the user's identity, the application ensures users only retrieve documents they are authorized to see. This enforces document-level access control at query time.

Answer

Encrypt the documents with different KMS keys

Answer

Create separate Knowledge Bases for every user

Answer

Apply IAM policies to the S3 bucket

Question 13

To ensure compliance with data residency requirements, you must restrict which AWS regions your Generative AI application can process data. What is the most effective way to enforce this?

Accepted Answer

Service Control Policies (SCPs). Service Control Policies (SCPs) in AWS Organizations are the most effective way to enforce region restrictions across an entire account or organizational unit. An SCP with a Deny condition on aws:RequestedRegion (excluding approved regions) blocks API calls to non-compliant regions regardless of what IAM permissions individual users hold. This provides a centralized, hard guardrail for data residency.

Answer

VPC Endpoint policies

Answer

IAM policies for all users

Answer

CloudFront geographic restrictions

Question 14

Your organization needs to ensure that only authorized IAM users can access specific foundation models in Bedrock. Which configuration is required?

Accepted Answer

Attach an IAM policy with bedrock:InvokeModel allowing access to specific model ARNs. Amazon Bedrock integrates with AWS IAM to control access to foundation models. To restrict which IAM users can invoke specific models, you attach an IAM policy that includes the bedrock:InvokeModel action and specifies the ARNs of the allowed foundation models. This policy can be attached to users, groups, or roles, and it enforces least privilege at the model level. Without such a policy, users either have no access or overly broad access, so this is the required configuration.

Answer

Enable AWS Organizations SCPs only

Answer

Use Amazon Cognito user pools

Answer

Use Resource-Based Policies on the foundation model

Question 15

A company is using Amazon Bedrock to build a customer support chatbot and needs to ensure that PII is masked before the request reaches the foundation model. Which feature should the developer implement?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails is the native feature designed to apply safeguards — including PII detection and masking — to prompts and responses before they reach or return from the foundation model. It lets you define sensitive information filters that identify PII (names, emails, SSNs, credit cards) and either block or mask it, satisfying the requirement that PII never reaches the model.

Answer

AWS KMS with envelope encryption

Answer

Amazon Macie

Answer

AWS WAF with custom regex rules