AIP-C01 Foundation Model Integration Data And Compliance — 15 Questions

Question 1

A healthcare organization must ensure that PII is removed from documents before they are stored in an Amazon Bedrock Knowledge Base. Which THREE actions should the developer take?

Accepted Answer

Configure the Knowledge Base to use a private VPC endpoint to prevent data exfiltration.. Option B is correct because configuring the Knowledge Base to use an Amazon VPC endpoint (AWS PrivateLink) keeps traffic between the VPC and Amazon Bedrock on the AWS private network, preventing PII from being exposed or exfiltrated over the public internet during ingestion and retrieval. Option D is correct because Amazon Comprehend provides PII detection and redaction (for example, using the DetectPiiEntities API with redaction), so running source documents through it before ingestion removes PII prior to vectorization and storage. Option E is correct because an AWS Glue ETL job can transform and sanitize the data in the ingestion pipeline, applying custom scrubbing or masking logic so only de-identified content reaches the Knowledge Base. Option A is not correct because KMS encryption protects data at rest but does not remove or redact PII, so the sensitive content would still be present in the documents. Option C is not correct because Amazon Bedrock does not offer a Data Protection policy feature that automatically strips PII during vectorization; PII removal must be performed explicitly before ingestion.

Answer

Manually encrypt all files using AWS KMS before uploading to S3.

Answer

Enable Amazon Bedrock Data Protection policies to automatically strip PII during vectorization.

Question 2

A company is integrating Amazon Bedrock with a private knowledge base. They need to ensure that PII is masked before the retrieved documents are passed to the Foundation Model. Which approach is most effective?

Accepted Answer

Implement an AWS Lambda function with Amazon Comprehend to redact PII during the ingestion process into the Knowledge Base.. Amazon Comprehend can be integrated into the data ingestion pipeline to detect and redact PII before documents are indexed into the Amazon OpenSearch Serverless vector store.

Answer

Configure the Bedrock Knowledge Base to use a custom encryption key for PII filtering.

Answer

Enable Amazon Macie on the S3 bucket and configure Bedrock to ignore flagged objects.

Answer

Use Amazon Bedrock Guardrails to mask PII during the inference request.

Question 3

A developer is optimizing a RAG solution for a legal firm. The documents are highly dense and technical. Which chunking strategy in Amazon Bedrock Knowledge Bases provides the best balance of retrieval accuracy?

Accepted Answer

Hierarchical chunking.. Hierarchical chunking is designed for complex documents by creating parent and child chunks, which helps maintain context during retrieval.

Answer

Semantic chunking based on paragraph breaks.

Answer

Fixed-size chunking with 100 token overlap.

Answer

Default chunking strategy.

Question 4

A healthcare startup needs to ensure that their Bedrock-based AI application is HIPAA compliant. What is the mandatory step for the data storage layer?

Accepted Answer

Enable server-side encryption with AWS managed keys on the S3 bucket containing the source data.. To meet HIPAA requirements, all data must be encrypted at rest using AWS KMS with customer-managed keys (CMK) and have logging enabled via CloudTrail.

Answer

Store all data in-memory only to avoid persistent storage risks.

Answer

Use public S3 buckets with ACLs enabled.

Answer

Disable logging to prevent sensitive data from appearing in logs.

Question 5

A developer needs to integrate a foundation model that requires custom fine-tuning for a specific domain language. Which service provides the environment for this task?

Accepted Answer

Amazon Bedrock Custom Models. Amazon Bedrock Custom Models allow for fine-tuning base models on private datasets to improve performance on specific tasks or domains.

Answer

AWS Glue DataBrew

Answer

Amazon SageMaker JumpStart

Answer

Amazon Kendra

Question 6

A developer is troubleshooting a slow retrieval process in a RAG system. What is the most likely cause related to the vector store?

Accepted Answer

The vector index is missing an appropriate HNSW index or is not properly partitioned.. If the vector store lacks an index or the index is not partitioned correctly, search latency increases significantly.

Answer

The embedding model is too small.

Answer

The source documents are too short.

Answer

The Bedrock service is overloaded.

Question 7

Which configuration in an Amazon Bedrock Knowledge Base is essential for updating the vector index whenever the source files in S3 change?

Accepted Answer

Configure Data Source Syncing.. Syncing is triggered via the 'Sync' operation, but for automation, S3 Event Notifications coupled with a Lambda function or the Bedrock Sync API is required.

Answer

Use AWS Config to monitor bucket changes.

Answer

Set the knowledge base to 'Auto-Refresh' mode.

Answer

Enable S3 Versioning.

Question 8

Which AWS storage service is the primary source for synchronizing documents in an Amazon Bedrock Knowledge Base?

Accepted Answer

Amazon S3. Amazon S3 is the primary storage service used as a data source for Amazon Bedrock Knowledge Bases. When creating a knowledge base, you specify an S3 bucket containing your documents. Bedrock then ingests, chunks, and embeds these documents into a vector store. Other AWS storage services like EFS, DynamoDB, or Backup are not directly supported as synchronization sources for Bedrock Knowledge Bases.

Answer

Amazon EFS

Answer

AWS Backup

Answer

Amazon DynamoDB

Question 9

Which component in Amazon Bedrock is used to define the structure of the retrieved documents before they are fed into the model?

Accepted Answer

Chunking Strategy.. The 'Chunking Strategy' determines how documents are broken down and structured before being embedded and indexed.

Answer

Prompt Template.

Answer

Vector Database index settings.

Answer

IAM Policy.

Question 10

Which of the following is NOT a benefit of using Amazon Bedrock?

Accepted Answer

Full control over the model's source code.. Bedrock is a managed service, so it does not require managing the infrastructure of the underlying foundation models.

Answer

Serverless architecture.

Answer

Access to multiple FM providers via a single API.

Answer

Data privacy and security controls.

Question 11

A company is setting up a secure RAG pipeline. Which THREE of the following are necessary to ensure data security?

Accepted Answer

Implement IAM policies with the principle of least privilege.. VPC endpoints, IAM policies, and KMS encryption are fundamental components for securing data pipelines in AWS.

Answer

Use public S3 endpoints with read-only access.

Answer

Use default AWS managed public keys.

Question 12

A developer is evaluating model performance for a specific task. Which THREE metrics are commonly used in the Bedrock Model Evaluation console?

Accepted Answer

Inference latency (time to first token).. In the Amazon Bedrock Model Evaluation console, the metrics reported for a job include inference latency (such as time to first token), which is why option A is correct — it measures the responsiveness of the model during evaluation. Option C is correct because when you run an automatic evaluation with a ground truth dataset, Bedrock computes accuracy-style metrics (for example, exact match, F1, or similar scores) comparing model outputs to the reference answers. Option D is correct because Bedrock's evaluation also surfaces toxicity and harmful-content detection metrics, often via built-in or custom metrics that flag unsafe outputs. Options B and E are not evaluation metrics: S3 bucket storage size is a storage-usage figure unrelated to model quality, and the number of active IAM roles is an identity/access count, not a performance or safety metric reported by the Model Evaluation console.

Answer

S3 bucket storage size.

Answer

Number of active IAM roles.

Question 13

A company requires their AI to be available even if a regional outage occurs. How do they handle Bedrock model availability?

Accepted Answer

Implement application-level logic to switch regions for inference.. Cross-region inference is not supported by all models, so the application logic must handle failover between regions where the model is available.

Answer

Use an S3 bucket in every region.

Answer

Request a cross-region Bedrock endpoint from AWS Support.

Answer

Enable global AWS region auto-scaling.

Question 14

A developer is building a RAG system and wants to include document metadata in the search retrieval. How is this done?

Accepted Answer

By adding metadata files alongside the documents in S3 and using custom ingestion logic.. Metadata is attached to the chunks in the vector index. During query, the system can use the `filter` parameter to limit results.

Answer

By prepending the metadata to the prompt.

Answer

It is done automatically by the model.

Answer

It is not possible to use metadata in Bedrock RAG.

Question 15

A financial firm needs to use a third-party foundation model on Amazon Bedrock but must ensure that the model provider does not use their prompts or output to train their base models. Which feature provides this guarantee?

Accepted Answer

Amazon Bedrock Data Privacy Guarantees. AWS Bedrock provides a 'Zero Data Retention' policy by default, ensuring data is not used for model training.

Answer

AWS PrivateLink

Answer

AWS KMS Customer Managed Keys

Answer

Amazon Bedrock Provisioned Throughput