AIF-C01 Fundamentals of Generative AI Practice Question

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "bedrock:InvokeModel",
      "Resource": "arn:aws:bedrock:us-east-1:123456789012:model/anthropic.claude-v2"
    },
    {
      "Effect": "Deny",
      "Action": "bedrock:InvokeModel",
      "Resource": "arn:aws:bedrock:us-east-1:123456789012:model/anthropic.claude-v2",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": "us-east-1"
        }
      }
    }
  ]
}
```

A developer attached this IAM policy to a role used by an application that invokes Claude v2 in us-east-1. The application receives an access denied error. What is the MOST likely cause?

⚠ Common exam trap

The AIF-C01 exam often tests the subtle interaction between Allow and Deny statements with condition operators, where candidates mistakenly think the Deny is blocking because of a region mismatch on the resource ARN itself, rather than understanding that the Deny's condition evaluates the request's region, not the resource's region.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The Deny statement is blocking requests because the condition does not match the resource ARN's region

The Deny statement uses a `StringNotEquals` condition on `aws:RequestedRegion` set to `us-east-1`. This means the Deny applies to any request where the requested region is NOT `us-east-1`. Since the resource ARN in the Deny statement is `arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-v2`, the condition does not match the resource's region (the resource ARN itself is in us-east-1), but the Deny is triggered when the request is made to a different region, blocking the call. The application is likely invoking the model from a region other than us-east-1, causing the Deny to take effect.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The Allow statement does not include a condition on the region
Why it's wrong here
Allow statements without conditions are fine; they grant permission.
✓
The Deny statement is blocking requests because the condition does not match the resource ARN's region
Why this is correct
The Deny condition checks aws:RequestedRegion, which may differ from the region in the resource ARN if requests are made to a different region.
✗
The Deny statement uses StringNotEquals instead of StringEquals
Why it's wrong here
StringNotEquals is correct to deny if region is not us-east-1.
✗
The resource ARN in the Allow statement is incorrect
Why it's wrong here
The ARN appears valid.

Go deeper

AIF-C01 Fundamentals of Generative AI Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question