AIF-C01 Applications of Foundation Models Practice Question
A developer is using Amazon Bedrock to generate code snippets. The model often produces insecure code. Which prompt engineering technique is MOST effective to improve security?
⚠ Common exam trap
The trap here is that candidates often overestimate the effectiveness of few-shot examples or reasoning techniques for security, assuming they implicitly teach safety, when in fact explicit instructions are required to override the model's default training biases toward common (but insecure) coding patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Include specific instructions to avoid common security vulnerabilities
Directly instructing the model to avoid specific security vulnerabilities (e.g., SQL injection, buffer overflows) is the most explicit and effective way to constrain the output. Amazon Bedrock models respond well to clear, imperative instructions in the system prompt or user message, making this a direct application of prompt engineering for safety. Chain-of-thought or few-shot examples may improve reasoning or style but do not guarantee the model will avoid insecure patterns unless explicitly told to do so.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use chain-of-thought prompting to step through the code
Why it's wrong here
Chain-of-thought focuses on reasoning, not security.
- ✗
Provide few-shot examples of secure code
Why it's wrong here
Few-shot examples help but may not be sufficient for all cases.
- ✗
Set max_tokens to a low value to limit output
Why it's wrong here
Token limit does not affect code security.
- ✓
Include specific instructions to avoid common security vulnerabilities
Why this is correct
Direct instructions in the prompt can effectively guide the model.
Go deeper
Related to this question
About these practice questions
One of 619 original AIF-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AIF-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AIF-C01 exam.