AIP-C01 AI Safety Security And Governance — Timed 10 Questions

Question 1

An enterprise requires that all Generative AI model outputs are logged for compliance, but logs must not contain any PII. How can this be achieved in an AWS environment using Amazon Bedrock?

Accepted Answer

Enable Bedrock Model Invocation Logging with Guardrails PII redaction enabled. Bedrock Model Invocation Logging captures full request and response payloads to CloudWatch Logs or S3, and when combined with Bedrock Guardrails configured with PII detection and redaction, sensitive entities are masked before the log is written. This satisfies both the compliance requirement (full audit trail of model interactions) and the privacy requirement (no PII in logs) without custom code. Guardrails supports built-in PII filters for categories like NAME, EMAIL, SSN, and PHONE.

Answer

Write a Lambda function to strip logs before writing to S3

Answer

Use IAM policies to prevent logs from being written

Answer

Use AWS CloudTrail to log API calls and enable redaction in CloudWatch

Question 2

Which service should be used to monitor the cost and usage of API requests made to Amazon Bedrock models?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer is the service designed to visualize, understand, and manage AWS costs and usage over time. It provides detailed cost and usage reports, including for Amazon Bedrock API requests, allowing users to monitor spending by service, account, or tag. CloudWatch Metrics provides operational metrics like invocation counts and latency, but not cost data. Trusted Advisor offers best-practice checks, and QuickSight is a BI tool for custom dashboards.

Answer

Amazon CloudWatch Metrics

Answer

AWS Trusted Advisor

Answer

Amazon QuickSight

Question 3

A researcher wants to ensure the model output does not reference external websites. How can this be enforced?

Accepted Answer

Configure a Guardrail with a Denied Topics policy. Amazon Bedrock Guardrails provide a Denied Topics policy that can block model outputs referencing specified topics, including external websites or URLs. Configuring a guardrail with a denied topic for external references enforces the restriction at the service level, independent of prompt wording. This is the correct mechanism for enforcing output constraints.

Answer

Use a custom system prompt to tell the model not to use URLs

Answer

Disable model streaming

Answer

Use IAM to block internet access for the application

Question 4

A developer needs to ensure that an application only uses approved foundation models. How can they govern this centrally?

Accepted Answer

Use Service Control Policies (SCPs) to deny non-approved models. Service Control Policies (SCPs) in AWS Organizations allow you to centrally govern which AWS services and actions are allowed across all accounts in an organization. To ensure an application only uses approved foundation models (e.g., specific Amazon Bedrock models), the developer can use an SCP that denies access to non-approved model IDs or actions, enforcing the restriction at the organizational level regardless of IAM permissions in individual accounts.

Answer

Create an IAM role for each model

Answer

Use Amazon Cognito

Answer

Hardcode the model ID in the application code

Question 5

A firm needs to ensure that all Generative AI model training data, if used for fine-tuning, is compliant with GDPR. Where should the training data reside?

Accepted Answer

Region-compliant S3 buckets with restricted IAM access and encryption. The data should be stored in S3 buckets located within the region that complies with GDPR, with appropriate encryption and access controls.

Answer

Publicly accessible S3 buckets

Answer

Temporary local storage on the training instance

Answer

DynamoDB tables

Question 6

A business wants to restrict the length of generated outputs to prevent high costs. How can this be done?

Accepted Answer

Set maxTokenCount in the inference configuration. Setting maxTokenCount (or max_new_tokens) in the inference configuration is the correct approach because it directly caps the number of tokens the model can generate per request, which is the primary driver of output cost and latency. This is a native model/inference parameter supported by Amazon Bedrock and SageMaker endpoints, so it enforces the limit at generation time rather than after the fact.

Answer

Use Lambda to truncate text

Answer

Disable streaming

Answer

Use Guardrails to block long responses

Question 7

You are configuring a Guardrail for a multilingual application. What is the best practice for configuring content filters?

Accepted Answer

Create one Guardrail per language. Configure multiple language-specific filters or ensure the Guardrail content filter is configured to handle the detected language of the input.

Answer

Disable filters for non-English languages

Answer

Translate all inputs to English first

Answer

Use a regex-based filter only

Question 8

A generative AI application running on Amazon Bedrock uses an Amazon OpenSearch Serverless vector index for retrieval-augmented generation. A security audit requires that every document retrieved for a user is filtered by the user's department before it is passed to the foundation model. The team wants the filtering to occur inside the vector search without changing application code or the vector schema. Which solution meets these requirements with the LEAST operational effort?

Accepted Answer

Attach metadata to each vector and use the metadata filtering capability of Amazon Bedrock Knowledge Bases during retrieval.. Metadata filtering in Amazon Bedrock Knowledge Bases evaluates attribute expressions during vector retrieval, so only documents matching the user's department reach the foundation model. It avoids duplicate indexes, extra Lambda code, and schema changes. Field-level security and post-retrieval filtering do not achieve in-search document-level authorization for RAG.

Answer

Use an AWS Lambda function after retrieval to call the OpenSearch _search API and remove documents whose department does not match the user.

Answer

Enable OpenSearch Serverless security analytics and define a field-level security policy that restricts the department field.

Answer

Create a separate OpenSearch Serverless collection for each department and route queries based on the caller's IAM role.

Question 9

A government agency is deploying a generative AI application on Amazon Bedrock that processes classified documents. The agency must ensure that all data processed by the application remains within a specific AWS Region and is never used to train or improve the underlying foundation model. The agency also needs to prove compliance to auditors. Which combination of actions should the agency take to meet these requirements?

Accepted Answer

Use Amazon Bedrock in the designated Region, ensure the Bedrock service is configured to not use data for model improvement, and obtain AWS Artifact reports and service documentation for auditors.. The agency must enforce data residency by using Amazon Bedrock in the designated Region and explicitly configure the service to not use data for model improvement. To satisfy auditors, they should collect AWS Artifact reports and service documentation that attest to these controls. The other options either rely on unverified defaults, confuse network isolation with data usage attestation, or propose a service change that does not inherently provide the required guarantees.

Answer

Use Amazon Bedrock in the designated Region and rely on the default data handling policy, which guarantees that data is never used for model training.

Answer

Configure Amazon Bedrock to use a VPC endpoint in the designated Region and enable model invocation logging, then provide the logs to auditors as evidence of data residency and non-training.

Answer

Deploy the application on Amazon SageMaker instead of Amazon Bedrock, because SageMaker guarantees that no data is ever used for training.

Question 10

You are deploying a Generative AI application using Amazon SageMaker JumpStart. You need to ensure that the model endpoint is protected against prompt injection attacks. Which approach is most effective?

Accepted Answer

Use a prompt-based filter system that detects malicious intent via a secondary validation model. A prompt-based filter system that uses a secondary validation model to detect malicious intent is the most effective approach because prompt injection is a semantic/behavioral attack that must be detected by analyzing the input and output content, not by infrastructure controls. A dedicated classifier or LLM-as-judge can flag jailbreak patterns, instruction overrides, and data exfiltration attempts before they reach the primary model.

Answer

Encrypt the model weights with a CMK

Answer

Enable Amazon Inspector on the endpoint

Answer

Disable the API Gateway execute-api method