AIP-C01 AI Safety Security And Governance Practice Test 1 — 15 Questions

Question 1

You are configuring a Guardrail for a multilingual application. What is the best practice for configuring content filters?

Accepted Answer

Create one Guardrail per language. Configure multiple language-specific filters or ensure the Guardrail content filter is configured to handle the detected language of the input.

Answer

Disable filters for non-English languages

Answer

Translate all inputs to English first

Answer

Use a regex-based filter only

Question 2

You are deploying a Generative AI application using Amazon SageMaker JumpStart. You need to ensure that the model endpoint is protected against prompt injection attacks. Which approach is most effective?

Accepted Answer

Use a prompt-based filter system that detects malicious intent via a secondary validation model. Implementing Guardrails for Amazon Bedrock or a similar input validation layer using semantic checks is the recommended way to mitigate prompt injection.

Answer

Encrypt the model weights with a CMK

Answer

Enable Amazon Inspector on the endpoint

Answer

Disable the API Gateway execute-api method

Question 3

An enterprise requires that all Generative AI model outputs are logged for compliance, but logs must not contain any PII. How can this be achieved in an AWS environment using Amazon Bedrock?

Accepted Answer

Enable Bedrock Model Invocation Logging with Guardrails PII redaction enabled. Configuring Model Invocation Logging in Bedrock to send logs to CloudWatch or S3, combined with Guardrails PII redaction, ensures compliant logging.

Answer

Write a Lambda function to strip logs before writing to S3

Answer

Use IAM policies to prevent logs from being written

Answer

Use AWS CloudTrail to log API calls and enable redaction in CloudWatch

Question 4

A developer wants to prevent the Generative AI application from producing content related to hate speech or violence. What is the most efficient configuration in Amazon Bedrock?

Accepted Answer

Implement Amazon Bedrock Guardrails with content filters. Bedrock Guardrails allows for configuring content filters with specific thresholds for hate, sexual, violence, and self-harm content.

Answer

Create a custom fine-tuned model

Answer

Use AWS Config rules to monitor the model

Answer

Add a system prompt to the application code

Question 5

A company is using RAG with Amazon Bedrock Knowledge Bases. They need to ensure that users can only retrieve documents they are authorized to see. How should this be implemented?

Accepted Answer

Use the filters attribute in the Retrieve API call based on document metadata. You must implement metadata filtering in the Knowledge Base query. When invoking Retrieve, you can apply filters based on user attributes stored in the document metadata.

Answer

Encrypt the documents with different KMS keys

Answer

Create separate Knowledge Bases for every user

Answer

Apply IAM policies to the S3 bucket

Question 6

To ensure compliance with data residency requirements, you must restrict which AWS regions your Generative AI application can process data. What is the most effective way to enforce this?

Accepted Answer

Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) can be used to deny Bedrock service access in restricted regions.

Answer

VPC Endpoint policies

Answer

IAM policies for all users

Answer

CloudFront geographic restrictions

Question 7

Your organization needs to ensure that only authorized IAM users can access specific foundation models in Bedrock. Which configuration is required?

Accepted Answer

Attach an IAM policy with bedrock:InvokeModel allowing access to specific model ARNs. You must explicitly grant permission to the specific Bedrock model ARNs in the IAM policy attached to the user or role.

Answer

Enable AWS Organizations SCPs only

Answer

Use Amazon Cognito user pools

Answer

Use Resource-Based Policies on the foundation model

Question 8

Which service should be used to monitor the cost and usage of API requests made to Amazon Bedrock models?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides detailed analytics and reporting on usage costs for all AWS services, including Bedrock.

Answer

Amazon CloudWatch Metrics

Answer

AWS Trusted Advisor

Answer

Amazon QuickSight

Question 9

A company is using Amazon Bedrock to build a customer support chatbot and needs to ensure that PII is masked before the request reaches the foundation model. Which feature should the developer implement?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails provides built-in PII redaction capabilities to identify and mask sensitive information in both prompts and responses.

Answer

AWS KMS with envelope encryption

Answer

Amazon Macie

Answer

AWS WAF with custom regex rules

Question 10

A company is using Amazon Q Business. How can they restrict access to specific data sources for different groups of users?

Accepted Answer

Configure ACLs in the data source connector. Amazon Q Business uses access control lists (ACLs) synced from the data source to ensure users only retrieve information they have permissions to access.

Answer

Create separate Amazon Q applications

Answer

Manually delete documents for specific users

Answer

Apply IAM policies to the user's login

Question 11

A firm wants to audit the specific version of a foundation model used for every inference request. How can they achieve this?

Accepted Answer

Enable Bedrock Model Invocation Logging. Model Invocation Logging logs the modelId, which includes the version or ARN, providing an audit trail for every request.

Answer

Query Amazon SageMaker Model Monitor

Answer

Enable CloudTrail logs

Answer

Use AWS Config to track model changes

Question 12

A researcher wants to ensure the model output does not reference external websites. How can this be enforced?

Accepted Answer

Configure a Guardrail with a Denied Topics policy. Bedrock Guardrails can be configured with a Word Policy to deny specific patterns or regex that identify URLs, or a topic policy to block external references.

Answer

Use a custom system prompt to tell the model not to use URLs

Answer

Disable model streaming

Answer

Use IAM to block internet access for the application

Question 13

A developer needs to ensure that an application only uses approved foundation models. How can they govern this centrally?

Accepted Answer

Use Service Control Policies (SCPs) to deny non-approved models. Using AWS Organizations SCPs, an administrator can restrict the bedrock:InvokeModel action to a list of allowed model IDs.

Answer

Create an IAM role for each model

Answer

Use Amazon Cognito

Answer

Hardcode the model ID in the application code

Question 14

You need to ensure that all data sent to an Amazon Bedrock model is encrypted in transit using private connectivity. What is the recommended service?

Accepted Answer

AWS PrivateLink (VPC Endpoints). Interface VPC Endpoints (AWS PrivateLink) allow traffic to stay within the AWS network, avoiding the public internet.

Answer

AWS WAF

Answer

AWS CloudFront

Answer

AWS Certificate Manager

Question 15

Which AWS tool is used to monitor the performance and latency of an application calling Bedrock?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides metrics for request latency, invocation count, and errors for Bedrock models.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

AWS Config