AIP-C01 Foundation Model Integration Data And Compliance Practice Test 2 — 15 Questions

Question 1

A developer is preprocessing a large corpus of PDF documents for RAG. To ensure the highest accuracy for multi-modal retrieval tasks, which data strategy is most effective?

Accepted Answer

Applying semantic chunking and adding metadata tags for filtering. Chunking and metadata enrichment allow the retriever to locate specific sections rather than retrieving entire documents, improving precision.

Answer

Converting all text to images before embedding

Answer

Using a fixed-size character count of 500 without overlap

Answer

Concatenating all chunks into one large vector

Question 2

An organization is integrating a custom model via Bedrock Custom Models. They need to ensure that the data used for fine-tuning remains within their VPC. Which configuration meets this requirement?

Accepted Answer

Configuring an interface VPC endpoint for Amazon Bedrock. AWS PrivateLink for Amazon Bedrock allows the traffic to never traverse the public internet, keeping the data flow contained within the VPC context.

Answer

Using AWS Glue for data preparation only

Answer

Deploying the model in an on-premises data center

Answer

Encrypting the dataset with AWS CloudHSM

Question 3

You are configuring a Knowledge Base for Amazon Bedrock. You need to ingest data from an S3 bucket that contains sensitive financial reports. Which feature allows you to ensure the data is encrypted during the ingestion and retrieval process?

Accepted Answer

AWS KMS with customer-managed keys (CMKs). AWS KMS with customer-managed keys (CMKs) is the correct answer because Amazon Bedrock Knowledge Bases use KMS encryption to protect data at rest during ingestion into the vector store and during retrieval. Customer-managed keys give you control over the key policy, rotation, and audit trail via CloudTrail, which is essential for sensitive financial reports subject to compliance requirements. Bedrock integrates natively with KMS so encryption is applied transparently to the underlying S3 data source, the vector embeddings, and the retrieved chunks.

Answer

AWS Secrets Manager for S3 credentials

Answer

Amazon Bedrock Model invocation logs

Answer

S3 Bucket policies only

Question 4

A company is designing a RAG architecture. Which TWO of the following steps are required to successfully link an Amazon S3 source to an Amazon Bedrock Knowledge Base?

Accepted Answer

Configure an IAM role with S3 read access for Bedrock. The process requires selecting the data source (S3) and specifying the embedding model to convert text to vectors.

Answer

Create a Glue Data Catalog for the S3 bucket

Answer

Enable AWS WAF on the S3 bucket

Answer

Create a Lambda function to split PDFs manually

Question 5

An enterprise is planning to implement generative AI with strict compliance requirements. Which THREE practices should the developer include to ensure data privacy and regulatory compliance?

Accepted Answer

Enable Amazon Bedrock Guardrails to filter PII. Proper compliance involves encryption, access control (IAM), and the use of Guardrails for content moderation.

Answer

Disable all CloudWatch logging to prevent data leakage

Answer

Store all prompts in plain text in S3 for auditing

Question 6

A team is preparing data for fine-tuning a custom model on Amazon Bedrock. Which TWO of the following are best practices for high-quality training datasets?

Accepted Answer

Provide data in JSONL format with clear prompt-response pairs. Dataset preparation requires high-quality, relevant data and appropriate formatting (JSONL) for successful fine-tuning.

Answer

Include as much raw data as possible, even if noisy

Answer

Use automated AI tools to generate the training data from scratch

Answer

Convert all data into a CSV format

Question 7

A healthcare company is building a generative AI application on Amazon Bedrock that processes patient intake forms containing protected health information (PHI). Compliance requires that all data remains encrypted at rest and in transit, and that the company manages its own encryption keys to meet HIPAA requirements. The company uses AWS Key Management Service (KMS) customer managed keys for other workloads. Which combination of configurations should the developer implement to meet these requirements?

Accepted Answer

Create a KMS customer managed key and specify it when configuring the Bedrock knowledge base and when invoking models, ensuring data at rest is encrypted with that key; use TLS 1.2 for all API calls.. Using a KMS customer managed key for Bedrock knowledge bases and model invocation ensures that data at rest is encrypted with a key the company controls, which is essential for HIPAA compliance. Enforcing TLS 1.2 for all API calls protects data in transit. Other options either rely on AWS owned keys or incorrectly focus on encrypting the model rather than the data, leaving gaps in compliance.

Answer

Use AWS KMS customer managed keys to encrypt the Bedrock model and configure the application to use HTTPS for all API calls.

Answer

Store all PHI in Amazon S3 with default encryption and use a VPC endpoint to access Bedrock, relying on S3's default encryption for at-rest protection.

Answer

Enable encryption at rest using AWS owned keys and enforce TLS 1.2 for data in transit.

Question 8

A healthcare analytics company wants to use Amazon Bedrock to summarize patient feedback. The data includes protected health information (PHI) and must not be stored or used to train any third-party models. The company also needs an audit trail of all model invocations for compliance. Which combination of features should they implement?

Accepted Answer

Use Bedrock with a base model and enable Model Invocation Logging with data retention policies, ensuring no data is used for training.. Amazon Bedrock ensures that customer data is not used to train base models, and customers can enable Model Invocation Logging to capture invocation details for auditing. By using a base model and configuring logging with retention policies, the company can maintain an audit trail without violating the requirement that PHI must not be stored or used for training. Other options either involve fine-tuning with PHI or lack adequate controls.

Answer

Use Bedrock's provisioned throughput with a base model and enable Model Invocation Logging to CloudWatch Logs.

Answer

Enable Model Invocation Logging to CloudWatch Logs and use a Bedrock custom model with fine-tuning.

Answer

Use Bedrock with a guardrail that blocks PHI and enable Model Invocation Logging to S3 with encryption.

Question 9

A financial services firm is using Amazon Bedrock to build a conversational assistant that must comply with strict data residency requirements. All data must remain within the AWS Region where the application is deployed, and no data should be transmitted outside that Region. The firm is using a Bedrock knowledge base with an Amazon OpenSearch Serverless vector store and a foundation model hosted in the same Region. During testing, the developer notices that model invocation logs are being delivered to an Amazon S3 bucket in a different Region. What is the most likely cause and the correct remediation?

Accepted Answer

The S3 bucket for model invocation logs is configured in a different Region; the developer must reconfigure the logging destination to an S3 bucket in the same Region as the Bedrock resources.. Model invocation logs are sent to the S3 bucket specified in the Bedrock logging configuration. If that bucket resides in a different Region, logs leave the Region, violating data residency. The fix is to configure logging to use an S3 bucket in the same Region as the Bedrock resources. Other options incorrectly blame vector replication, cross-Region inference, or VPC endpoints, which are not the cause here.

Answer

The foundation model is being invoked through a cross-Region inference profile; the developer must switch to an in-Region model endpoint to prevent data from leaving the Region.

Answer

The VPC endpoint for Bedrock is misconfigured to route traffic through a different Region; the developer must recreate the VPC endpoint in the correct Region.

Answer

The OpenSearch Serverless collection is configured for cross-Region replication; the developer must disable replication to keep vectors within the Region.

Question 10

A developer is integrating Amazon Bedrock with an on-premises application. The application must invoke foundation models asynchronously and handle large volumes of requests without overwhelming the backend. The developer needs to implement a scalable, decoupled architecture. Which TWO AWS services should be used together to achieve this? (Choose two.)

Accepted Answer

AWS Lambda. To decouple an on-premises application from Amazon Bedrock and handle large volumes asynchronously, Amazon SQS provides a durable buffer, and AWS Lambda scales automatically to process messages and invoke models. This pattern ensures that the application does not need to wait for responses and can handle spikes in traffic without overwhelming the backend.

Answer

Amazon EventBridge

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 11

A company is deploying a generative AI application on Amazon Bedrock that uses a knowledge base to answer questions about internal policies. The compliance team requires that all data stored in the knowledge base be encrypted at rest with a customer managed key, and that the application logs all user queries and model responses for audit purposes. The company also wants to ensure that the data in the knowledge base is automatically refreshed when source documents are updated. Which TWO configurations should the developer implement to meet these requirements? (Choose two.)

Accepted Answer

Configure the knowledge base to use an AWS KMS customer managed key for encryption at rest.. To meet encryption at rest with customer managed keys, the knowledge base must be configured with an AWS KMS customer managed key. To log user queries and model responses, model invocation logging must be enabled. Automatic refresh of source documents can be achieved by scheduling syncs, but the question asks for two configurations; the encryption and logging are the critical ones for compliance.

Answer

Set up an AWS Lambda function triggered by Amazon S3 events to re-sync the knowledge base whenever source documents change.

Answer

Configure the knowledge base to use an AWS owned key for encryption and rely on S3 default encryption for source documents.

Answer

Use AWS CloudTrail to log all user queries and model responses for audit purposes.

Question 12

Which TWO factors are critical when choosing a model for a RAG architecture that requires high grounding accuracy?

Accepted Answer

The model's support for citation and source attribution.. Option C is correct because high grounding accuracy in RAG depends on the model's ability to cite and attribute retrieved sources, letting users verify that answers are anchored in the provided documents rather than hallucinated. Option E is correct because a larger context window allows more retrieved chunks to be included in the prompt, giving the model sufficient evidence to ground its response accurately. Option A is not critical, since the training date affects knowledge freshness but RAG grounding comes from retrieved context, not parametric memory. Option B is irrelevant, as image generation has no bearing on textual grounding accuracy. Option D is not decisive, because parameter count alone does not determine how faithfully a model uses retrieved context.

Answer

The model's training date.

Answer

The model's ability to generate images.

Answer

The number of parameters in the model.

Question 13

A developer is designing a RAG system and wants to ensure high-quality retrieval. Which THREE techniques should be implemented to improve semantic search relevance?

Accepted Answer

Using a reranking model to score retrieved documents. Option A is correct because a reranking model (e.g., a cross-encoder) re-scores the initially retrieved candidates against the query, capturing fine-grained query-document interactions that bi-encoder vector similarity misses, which directly boosts top-k relevance. Option B is correct because semantic chunking based on document structure (headings, sections, paragraphs) preserves coherent meaning units, so each embedding represents a complete idea rather than an arbitrary text slice, improving retrieval precision. Option D is correct because hybrid search combines lexical keyword matching (e.g., BM25) with dense vector search, capturing exact terms, rare entities, and acronyms that pure embeddings often miss while retaining semantic matching. Option C is not correct because simply maximizing vector dimensions increases storage and compute cost without guaranteeing better relevance, and can even hurt performance through overfitting or noise. Option E is not correct because fixed-size overlap chunking ignores semantic boundaries, frequently splitting related content and diluting embedding quality compared to structure-aware chunking.

Answer

Increasing the vector dimension size to maximum

Answer

Using only fixed-size overlap chunking

Question 14

A developer wants to choose a foundation model in Amazon Bedrock that offers the best balance of reasoning capability and latency for a customer support chatbot. Which tool should the developer use to evaluate models?

Accepted Answer

Bedrock Model Evaluation jobs.. The Bedrock Model Evaluation service allows developers to compare model performance using automated and human-in-the-loop metrics.

Answer

Amazon CloudWatch Metrics for Bedrock.

Answer

AWS Glue DataBrew.

Answer

Amazon SageMaker Model Monitor.

Question 15

An organization is deploying a RAG architecture using Amazon Bedrock and Amazon OpenSearch Serverless. The security team requires that all data remain within the VPC. How should the developer configure the integration?

Accepted Answer

Deploy the Bedrock Knowledge Base using a PrivateLink interface endpoint for Bedrock and a VPC endpoint for OpenSearch Serverless.. To keep all data within the VPC, you must use AWS PrivateLink interface endpoints for Bedrock and a VPC endpoint for OpenSearch Serverless. This ensures that traffic between the Knowledge Base, Bedrock, and the vector store never traverses the public internet. The S3 Gateway Endpoint alone is insufficient because Bedrock and OpenSearch Serverless require interface endpoints.

Answer

Configure the Knowledge Base to use an S3 Gateway Endpoint only.

Answer

Use a NAT Gateway to route all traffic to the Bedrock service.

Answer

Use an API Gateway with a WAF to restrict access to the vector store.