AIP-C01 AI Safety Security And Governance Practice Test 2 — 15 Questions

Question 1

A company requires that every AI-generated document must include a watermark for traceability. How can this be handled in Bedrock?

Accepted Answer

Use a custom post-processing Lambda function to inject metadata. Bedrock does not natively watermark text; however, it supports output formats and integration with third-party tools or custom post-processing to append metadata or tracking tokens.

Answer

Use fine-tuning to force the model to watermark

Answer

Enable watermarking in the Bedrock console settings

Answer

Use AWS KMS to sign the generated text

Question 2

A team wants to track who accessed a model and when. Which service provides this audit log?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls made to AWS services, including Bedrock, creating an audit trail of identity and time.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon CloudWatch

Question 3

A team is storing sensitive documents for RAG. They need to ensure that the document chunks in the vector database are encrypted at rest. How?

Accepted Answer

Configure the vector database (e.g., OpenSearch) with KMS encryption. When creating a Knowledge Base in Bedrock, you must specify a KMS key to encrypt the underlying vector store (e.g., OpenSearch Serverless).

Answer

Use TLS for all connections

Answer

Use Amazon S3-managed encryption

Answer

Encrypt the source S3 bucket only

Question 4

To prevent accidental deletion of a Knowledge Base, which feature should be applied?

Accepted Answer

Apply an IAM policy denying DeleteKnowledgeBase. AWS resource policies or IAM policies can be used to deny the 'Delete' action on the Knowledge Base resource.

Answer

Use AWS Backup

Answer

Enable MFA Delete on S3

Answer

Enable S3 Versioning

Question 5

An organization is concerned about 'Model Hallucinations' and needs a way to ground model outputs in trusted company documents. Which service supports this?

Accepted Answer

Amazon Bedrock Knowledge Bases. Amazon Bedrock Knowledge Bases provide RAG (Retrieval-Augmented Generation), which grounds model responses in provided documents.

Answer

Amazon SageMaker Feature Store

Answer

AWS Glue Data Catalog

Answer

Amazon DynamoDB

Question 6

A developer needs to share a Bedrock prompt template with another team securely. What is the recommended method?

Accepted Answer

Use Amazon Bedrock Prompt Management. Amazon Bedrock Prompt Management allows for creating and sharing versioned prompt templates across accounts or teams securely.

Answer

Save the prompt as a text file in S3 with public access

Answer

Send the prompt in an email

Answer

Store the prompt in a Git repository without encryption

Question 7

A firm needs to ensure that all Generative AI model training data, if used for fine-tuning, is compliant with GDPR. Where should the training data reside?

Accepted Answer

Region-compliant S3 buckets with restricted IAM access and encryption. The data should be stored in S3 buckets located within the region that complies with GDPR, with appropriate encryption and access controls.

Answer

Publicly accessible S3 buckets

Answer

Temporary local storage on the training instance

Answer

DynamoDB tables

Question 8

You are building a chat application and notice sensitive internal data is leaking in responses. You have enabled Guardrails. What else should be checked?

Accepted Answer

Review the system prompt and the Knowledge Base document retrieval filters. The system prompt might be overly permissive or failing to reinforce the boundaries defined in the Guardrail.

Answer

Change the foundation model provider

Answer

Increase the temperature setting

Answer

Check if the model is fine-tuned on public data

Question 9

A business wants to restrict the length of generated outputs to prevent high costs. How can this be done?

Accepted Answer

Set maxTokenCount in the inference configuration. In the inference parameters of the Bedrock API (or the Bedrock InvokeModel request), you can set 'maxTokenCount' to limit the response length.

Answer

Use Lambda to truncate text

Answer

Disable streaming

Answer

Use Guardrails to block long responses

Question 10

A company is using a third-party model via Bedrock and needs to ensure that the model provider does not use their data to train their base models. What must they do?

Accepted Answer

Understand that AWS does not use customer data to train their foundation models. Amazon Bedrock operates under the AWS service terms, which state that AWS does not use customer data to train foundation models, including third-party models, unless the customer specifically opts in.

Answer

Disable all logging

Answer

Enable the 'Opt-out' setting in the Bedrock console

Answer

Encrypt all data with a customer-managed key

Question 11

Which service should be used to provide secure identity and access management for an application accessing Bedrock?

Accepted Answer

AWS IAM. AWS IAM is the core service for managing identities and permissions for all AWS services, including Bedrock.

Answer

AWS Secrets Manager

Answer

AWS Directory Service

Answer

Amazon Cognito

Question 12

When fine-tuning a model on Amazon Bedrock, which THREE security considerations are critical?

Accepted Answer

Limiting IAM permissions for the fine-tuning job. Data governance, encryption, and access control are critical for fine-tuning security.

Answer

Using a root user account to launch the training job

Answer

Making the training dataset publicly readable

Question 13

Your organization wants to evaluate the quality and safety of model outputs using a formal testing framework. Which service is designed for this?

Accepted Answer

Amazon Bedrock Model Evaluation. Amazon Bedrock Model Evaluation allows you to run systematic evaluations of models based on custom or built-in datasets to measure quality and safety.

Answer

AWS CloudWatch Synthetics

Answer

Amazon SageMaker Pipelines

Answer

AWS CodePipeline

Question 14

What is the role of an AWS Service Control Policy (SCP) in an AI governance framework?

Accepted Answer

To enforce organizational compliance and restrict service access. SCPs provide centralized guardrails to define the maximum permissions that can be granted to IAM roles across all accounts in an organization.

Answer

To store model weights securely

Answer

To automatically optimize model latency

Answer

To monitor user chat history

Question 15

You are designing a secure Generative AI architecture on AWS. Which TWO of the following are recommended practices for securing the data ingestion pipeline for RAG?

Accepted Answer

Enforce TLS 1.2+ for all data movement. Encrypting data in transit (TLS) and at rest (KMS) are fundamental for data pipeline security.

Answer

Disable all logging in the pipeline to prevent data exposure

Answer

Store API keys in plain text within the Lambda code

Answer

Store all documents in a public S3 bucket for ease of access