easyMultiple SelectObjective-mapped
AIF-C01 Practice Question: A company uses Amazon Bedrock to build a…
A company uses Amazon Bedrock to build a generative AI application. They need to secure the application by restricting access to the model and preventing sensitive data from being stored in prompts. Which TWO actions should they take? (Choose two.)
⚠ Common exam trap
AWS often tests the distinction between logging/auditing services (CloudTrail, VPC Flow Logs) and actual security enforcement mechanisms (Guardrails, IAM), leading candidates to confuse observability with prevention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Amazon Bedrock Guardrails to define content filters and deny topics.
Amazon Bedrock Guardrails (Option C) directly addresses the need to prevent sensitive data from being stored in prompts by allowing you to define content filters, deny topics, and configure sensitive information filters that block or mask such data before it reaches the model. This is the native service feature designed for content safety and data leakage prevention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable VPC Flow Logs for Bedrock.
Why it's wrong here
VPC Flow Logs capture network traffic, not prompt content or access control.
- ✗
Enable AWS CloudTrail to log all Bedrock API calls.
Why it's wrong here
Logging is important for auditing but does not restrict access or filter prompts.
- ✓
Use Amazon Bedrock Guardrails to define content filters and deny topics.
Why this is correct
Guardrails can filter sensitive data and enforce content policies.
- ✓
Implement IAM policies that allow only specific users to invoke the model.
Why this is correct
IAM policies restrict access to the model invocation actions.
- ✗
Use AWS KMS to encrypt the model data.
Why it's wrong here
Encryption does not prevent sensitive data from being included in prompts.
Go deeper
Related to this question
About these practice questions
This AIF-C01 question is part of Courseiva's 619-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.