AIP-C01 AI Safety Security And Governance Practice Test 3 — 15 Questions

Question 1

What is the role of an AWS Service Control Policy (SCP) in an AI governance framework?

Accepted Answer

To enforce organizational compliance and restrict service access. SCPs provide centralized guardrails to define the maximum permissions that can be granted to IAM roles across all accounts in an organization.

Answer

To store model weights securely

Answer

To automatically optimize model latency

Answer

To monitor user chat history

Question 2

You are designing a secure Generative AI architecture on AWS. Which TWO of the following are recommended practices for securing the data ingestion pipeline for RAG?

Accepted Answer

Enforce TLS 1.2+ for all data movement. Encrypting data in transit (TLS) and at rest (KMS) are fundamental for data pipeline security.

Answer

Disable all logging in the pipeline to prevent data exposure

Answer

Store API keys in plain text within the Lambda code

Answer

Store all documents in a public S3 bucket for ease of access

Question 3

Which THREE of the following are components of a robust AI governance framework in an AWS environment?

Accepted Answer

Implement Amazon Bedrock Guardrails. Option A is correct because Amazon Bedrock Guardrails provides configurable safeguards such as content filters, denied topics, and PII redaction that enforce responsible-AI policies at inference time, which is a core control of an AI governance framework. Option D is correct because Bedrock Model Invocation Logging captures invocation metadata (and optionally full request/response payloads) to CloudWatch Logs or Amazon S3, delivering the auditability and traceability that governance requires. Option E is correct because IAM roles with least-privilege access restrict who and what can invoke models or manage AI resources, satisfying the access-control and segregation-of-duties principles of governance. Option B does not belong because granting all users AdministratorAccess violates least privilege and destroys accountability. Option C does not belong because publicly hosting a model endpoint exposes it to unauthorized use and data exfiltration, directly undermining governance and security.

Answer

Provide all users with AdministratorAccess

Answer

Publicly host the model endpoint

Question 4

A developer needs to monitor their Bedrock application for potential abuse. Which TWO features should they utilize?

Accepted Answer

Amazon CloudWatch metrics (e.g., 5xx error rates). Option A, Amazon CloudWatch metrics such as 5xx error rates, is correct because CloudWatch provides the runtime observability needed to detect abuse-driven failures and anomalies in a Bedrock application, letting the developer alarm on elevated error rates and other service metrics. Option E, AWS CloudTrail to monitor for unusual API calling patterns, is correct because CloudTrail records Bedrock API activity (e.g., InvokeModel calls) and can be analyzed to spot suspicious invocation volumes, unexpected principals, or anomalous call patterns indicative of abuse. Option B, AWS Cost Explorer, only shows aggregated spending trends and cannot identify abusive request patterns or errors. Option C, Amazon Simple Notification Service, is merely a notification delivery mechanism and does not itself detect or monitor abuse. Option D, AWS Trusted Advisor performance checks, focuses on general best-practice and service-limit guidance rather than application-level abuse detection.

Answer

AWS Cost Explorer to track daily spending

Answer

Amazon Simple Notification Service

Answer

AWS Trusted Advisor performance checks

Question 5

When implementing a RAG-based application, which TWO of the following ensure document security?

Accepted Answer

Apply metadata filters to control document access. Option A is correct because applying metadata filters at query time restricts retrieval to only the documents a given user is authorized to see, enforcing document-level access control within the RAG pipeline. Option B is correct because IAM-based connectors authenticate to data sources using identity and access management policies, ensuring that only permitted documents are ingested and that access respects existing enterprise permissions. Option C is wrong because a single shared user removes per-user accountability and grants everyone the same access, defeating least privilege. Option D is wrong because making all documents globally readable exposes sensitive content to every user and query. Option E is wrong because disabling indexing of sensitive documents doesn't secure them within RAG; it merely removes them from retrieval, which is a data-availability decision rather than an access-control mechanism.

Answer

Use a single shared user for all data source connections

Answer

Make all documents globally readable

Answer

Disable indexing of sensitive documents

Question 6

Which TWO steps are required to properly secure Bedrock Knowledge Bases?

Accepted Answer

Use IAM roles for the Knowledge Base to access data. Enabling encryption and managing IAM access are the primary security configurations.

Answer

Disable all encryption to increase performance

Answer

Place the Knowledge Base in a public subnet

Answer

Grant public read access to the S3 bucket

Question 7

When dealing with PII in Generative AI, which THREE practices are recommended?

Accepted Answer

Implement access policies to restrict PII visibility. Option B is correct because implementing least-privilege access policies (e.g., IAM policies and resource-based policies) restricts who can view or process PII, which is a foundational control for protecting sensitive data in Generative AI workloads. Option D is correct because encrypting PII at rest with AWS KMS (using customer managed keys and envelope encryption) ensures that stored data remains unreadable if the underlying storage is compromised, satisfying compliance requirements such as GDPR, HIPAA, and PCI DSS. Option E is correct because Amazon Bedrock Guardrails provides built-in sensitive information filters that can detect and redact PII (such as names, emails, and phone numbers) in both prompts and model responses, preventing PII from leaking into or out of the model. Option A is not recommended because storing PII in plain text logs exposes sensitive data to anyone with log access and violates data minimization and encryption principles. Option C is not recommended because sharing PII freely across all AWS accounts breaks tenant isolation and least-privilege boundaries, increasing the risk of unauthorized access and data leakage.

Answer

Store PII in plain text logs for debugging

Answer

Share PII freely across all AWS accounts

Question 8

Which TWO features of Amazon Bedrock provide governance capabilities?

Accepted Answer

Amazon Bedrock Prompt Management. Amazon Bedrock Guardrails (E) is a governance feature because it lets you define and enforce content filters, denied topics, word filters, and sensitive-information (PII) redaction policies that are applied consistently across foundation models, which directly supports responsible-AI and compliance controls. Amazon Bedrock Prompt Management (C) provides governance by allowing prompts to be versioned, stored, and reused centrally, so teams can track changes, standardize approved prompts, and maintain an auditable lifecycle. The other options do not provide governance: API Gateway integration (A) is an architectural pattern for exposing Bedrock via REST APIs rather than a Bedrock governance capability, Model Pre-training (B) is not a Bedrock feature for customizing models (Bedrock offers fine-tuning and continued pre-training, not full pre-training), and Auto-scaling (D) is an operational capacity concern, not a governance control.

Answer

Amazon Bedrock API Gateway integration

Answer

Amazon Bedrock Model Pre-training

Answer

Amazon Bedrock Auto-scaling

Question 9

Which THREE items should be included in an AI application's security documentation for an audit?

Accepted Answer

Logging and monitoring policies. Option A (Logging and monitoring policies) is correct because auditors need documented evidence of how the AI application records access, inference requests, and anomalous activity, typically via services like CloudWatch, CloudTrail, or Azure Monitor, to demonstrate continuous detection and incident response. Option B (Encryption methods for training/RAG data) is correct because it specifies the cryptographic controls protecting data at rest and in transit — for example AES-256 at rest and TLS 1.2+ in transit — which is essential for verifying confidentiality of sensitive training and retrieval-augmented generation data. Option E (Description of safety filters (Guardrails)) is correct because documenting content moderation, prompt-injection defenses, and output filtering demonstrates that the application enforces responsible-AI and abuse-prevention controls required by audit frameworks. Option C is incorrect because exposing public links to internal datasets would itself be a security and privacy violation, not an audit artifact. Option D is incorrect because storing or sharing user passwords in documentation violates credential-handling best practices; auditors review password policies and hashing (e.g., bcrypt/Argon2), never actual passwords.

Answer

Public links to all internal datasets

Answer

User passwords for all employees

Question 10

Which TWO of the following actions can help mitigate the risk of 'prompt injection' in a Generative AI application?

Accepted Answer

Sanitize user input before passing it to the model. Option D is correct because sanitizing user input before passing it to the model removes or neutralizes embedded instructions, escape characters, and other adversarial payloads that attackers use to hijack the prompt, directly reducing the attack surface for prompt injection. Option E is correct because Amazon Bedrock Guardrails provides configurable input filtering (including denied topics, content filters, and prompt-attack/word filters) that detects and blocks malicious or manipulative prompts before they reach the foundation model, adding a dedicated defense layer against prompt injection. Option A is not correct because disabling the chat interface eliminates the application's functionality rather than mitigating the risk while preserving legitimate use. Option B is not correct because temperature 0.0 only makes model output more deterministic; it does not prevent an injected instruction from being followed. Option C is not correct because using a more powerful foundation model does not inherently provide prompt-injection protection and may even increase susceptibility to sophisticated adversarial prompts.

Answer

Disable the chat interface

Answer

Set the temperature to 0.0

Answer

Use the most powerful foundation model available

Question 11

Which THREE strategies should be implemented to ensure responsible AI practices in a production workload?

Accepted Answer

Perform regular model evaluation for bias. Option A is correct because regularly evaluating the model for bias (e.g., using fairness metrics such as demographic parity or equalized odds across subgroups) detects and mitigates discriminatory behavior before it harms users, which is a core responsible-AI control. Option C is correct because maintaining comprehensive logs of inputs, outputs, model versions, and decisions provides auditability and traceability, enabling incident investigation, compliance reporting, and accountability in production. Option D is correct because human-in-the-loop review for critical outputs ensures a qualified person validates high-impact decisions, catching harmful or erroneous model results that automation alone should not finalize. Option B does not belong because excluding all logging destroys auditability and incident forensics rather than protecting privacy; privacy should be handled via data minimization, encryption, and access controls. Option E does not belong because letting users train the model directly in production risks data poisoning, uncontrolled drift, and loss of governance over model behavior.

Answer

Exclude all logging to protect privacy

Answer

Allow users to train the model directly

Question 12

Which THREE services/features are essential for establishing a secure perimeter for an Amazon Bedrock deployment?

Accepted Answer

Interface VPC Endpoints (PrivateLink). Interface VPC Endpoints (PrivateLink) (A) are essential because they let you access Amazon Bedrock privately from within your VPC over the AWS private network, keeping Bedrock traffic off the public internet and enabling granular endpoint policies. Security Groups on the VPC (D) are essential because they act as stateful virtual firewalls controlling which resources can reach the Bedrock interface endpoint on TCP 443, enforcing least-privilege network access at the perimeter. IAM Policies for resource access control (E) are essential because they authenticate and authorize which principals may invoke Bedrock models and actions, providing the identity-based control layer of the secure perimeter. AWS Public Access Block on all buckets (B) is not essential here since it governs S3 bucket exposure, not Bedrock access, and AWS Shield Standard (C) is automatically enabled DDoS protection that is not a Bedrock-specific perimeter control.

Answer

AWS Public Access Block on all buckets

Answer

AWS Shield Standard

Question 13

A financial services company is deploying a generative AI application that uses Amazon Bedrock to answer employee questions about internal policies. The security team requires that the application automatically redact personally identifiable information (PII) such as account numbers and social security numbers from both user prompts and model responses, without modifying the underlying foundation model. Which AWS service should be integrated into the application's request and response pipeline to meet this requirement?

Accepted Answer

Amazon Comprehend. Amazon Comprehend offers purpose-built PII detection and redaction APIs that can be invoked synchronously within an application's request and response flow. Integrating it before Bedrock invocation and after completion generation ensures sensitive data is masked without retraining or modifying the foundation model. The other services address storage classification, audit logging, or threat detection, none of which provide inline content redaction for generative AI payloads.

Answer

Amazon Macie

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Question 14

A healthcare company is building a generative AI assistant on Amazon Bedrock that summarizes patient records. The compliance team requires that the assistant's outputs are traceable and that any harmful or biased content is detected before being shown to clinicians. The company wants to use AWS-native services and features. (Choose two.)

Accepted Answer

Enable model invocation logging in Amazon Bedrock to capture request and response metadata to Amazon CloudWatch Logs and Amazon S3.. Amazon Bedrock Guardrails evaluates prompts and completions against configurable policies to block harmful or biased content before it is presented, while model invocation logging captures detailed request and response data for traceability. Together they provide both preventive content moderation and a durable audit trail. AWS WAF, Amazon Macie, and AWS Trusted Advisor operate at different layers and cannot inspect or record natural language content for bias or harmful material.

Answer

Use AWS Trusted Advisor to review the Bedrock model for ethical AI compliance.

Answer

Enable Amazon Macie to automatically redact biased statements from Bedrock responses.

Answer

Configure AWS WAF to inspect the generative AI responses for biased language.

Question 15

A media company is using Amazon Bedrock to generate marketing copy. The legal team wants to ensure that the foundation model cannot be used to generate defamatory or explicit content, and they want to enforce these restrictions centrally across all applications that invoke the model. Which AWS feature should the company use to apply these content restrictions?

Accepted Answer

Amazon Bedrock Guardrails. Amazon Bedrock Guardrails is the AWS-native feature designed to enforce content policies such as blocking defamatory, explicit, or otherwise harmful material. It can be applied centrally to model invocations, ensuring consistent enforcement across applications. IAM, model customization, and AWS KMS address access control, model behavior tuning, and encryption respectively, but none provide semantic content filtering.

Answer

AWS Identity and Access Management (IAM) policies

Answer

Amazon Bedrock model customization

Answer

AWS Key Management Service (AWS KMS) encryption