hardMultiple ChoiceObjective-mapped
AIF-C01 Practice Question: Deploying a generative AI model on Amazon Bedrock
A company is deploying a generative AI model on Amazon Bedrock. The model is accessed by an application running on Amazon ECS Fargate. The security team requires that all data sent to and from the Bedrock model be encrypted in transit, and that the ECS task does not have internet access. The ECS tasks are launched in a private VPC subnet with a VPC endpoint for Bedrock configured. However, when the application attempts to invoke the Bedrock model, the call fails with a timeout error. The VPC endpoint policy is set to allow all actions from all principals. What is the most likely cause of the failure?
⚠ Common exam trap
AWS often tests the distinction between network-level failures (timeouts) and authorization failures (access denied), and the trap here is that candidates confuse VPC endpoint policy with security group rules, assuming a permissive policy is sufficient for connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The security group associated with the VPC endpoint does not allow inbound HTTPS traffic from the ECS tasks
The timeout error indicates a network connectivity issue, not an authentication or authorization problem. Since the ECS tasks are in a private subnet without internet access and a VPC endpoint for Bedrock is configured, the most likely cause is that the security group associated with the VPC endpoint does not allow inbound HTTPS (port 443) traffic from the ECS tasks. Without this inbound rule, the TCP handshake fails, resulting in a timeout.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ECS tasks are not configured to use a NAT gateway to reach the Bedrock endpoint
Why it's wrong here
The VPC endpoint allows private connectivity without a NAT gateway.
- ✗
The VPC endpoint policy does not grant the ECS task IAM role permission to invoke Bedrock
Why it's wrong here
The policy allows all actions; the issue is network connectivity, not permissions.
- ✗
The ECS task IAM role does not have the bedrock:InvokeModel permission
Why it's wrong here
Missing permissions would result in an access denied error, not a timeout.
- ✓
The security group associated with the VPC endpoint does not allow inbound HTTPS traffic from the ECS tasks
Why this is correct
The security group must allow inbound HTTPS from the ECS tasks' security group; otherwise, traffic is blocked.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 619 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.