How many Troubleshooting Scenario Questions questions are on this page?

This page has 8 Troubleshooting Scenario Questions scenario questions for the AIF-C01 exam, each with detailed explanations and wrong-answer analysis.

How should I approach AIF-C01 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified AI Practitioner AIF-C01 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise AWS Certified AI Practitioner AIF-C01 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

AIF-C01

exam code

Amazon Web Services

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

Refer to the exhibit. A data scientist created this endpoint config for a foundation model in Amazon SageMaker. However, the endpoint fails to scale under load. What is the most likely reason?

Exhibit

{
  "EndpointConfigName": "my-fm-endpoint-config",
  "ProductionVariants": [
    {
      "VariantName": "variant1",
      "ModelName": "my-fm-model",
      "InitialInstanceCount": 1,
      "InstanceType": "ml.g5.xlarge",
      "InitialVariantWeight": 1.0
    }
  ]
}

A
Missing AutoScaling configuration
Auto scaling policy is required to add instances under load.
B
Variant weight is 1.0
Why wrong: Weight of 1.0 is normal for a single variant.
C
Instance type is too small
Why wrong: Instance type affects capacity, but scaling is the missing piece.
D
InitialInstanceCount is 1
Why wrong: Initial count of 1 is fine; scaling would handle load.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. A developer deploys this CloudFormation stack but the agent fails to query the knowledge base. What is a likely cause?

Exhibit

Resources:
  BedrockAgent:
    Type: AWS::Bedrock::Agent
    Properties:
      AgentName: MyAgent
      FoundationModel: anthropic.claude-v2
      Instruction: "You are a helpful assistant."
      KnowledgeBases:
        - KnowledgeBaseId: !Ref MyKnowledgeBase
      PromptOverrideConfiguration: null
  MyKnowledgeBase:
    Type: AWS::Bedrock::KnowledgeBase
    Properties:
      Name: MyKB
      RoleArn: !GetAtt KBRole.Arn
      KnowledgeBaseConfiguration:
        Type: VECTOR
        VectorKnowledgeBaseConfiguration:
          EmbeddingModelArn: !Sub arn:aws:bedrock:${AWS::Region}::foundation-model/amazon.titan-embed-text-v1
      StorageConfiguration:
        Type: OPENSEARCH_SERVERLESS
        OpensearchServerlessConfiguration:
          CollectionArn: !GetAtt MyCollection.Arn
          VectorIndexName: my-index
  MyCollection:
    Type: AWS::OpenSearchServerless::Collection
    Properties:
      Name: my-collection
      Type: VECTORSEARCH

A
The KnowledgeBaseId is not passed correctly
Why wrong: KnowledgeBaseId uses !Ref, which is correct.
B
The agent role does not have permissions to invoke the knowledge base
The agent's IAM role must have bedrock:InvokeKnowledgeBase permission.
C
The embedding model is not available in the region
Why wrong: The embedding model arn is region-specific and assigned via Sub.
D
The OpenSearch collection type should be SEARCH not VECTORSEARCH
Why wrong: VECTORSEARCH is correct for vector storage.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

Refer to the exhibit. A security officer has attached this IAM policy to a user to allow invocation of a SageMaker endpoint. However, the user is unable to invoke the endpoint from an EC2 instance in the same VPC. What is the most likely cause?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sagemaker:InvokeEndpoint",
      "Resource": "arn:aws:sagemaker:us-east-1:123456789012:endpoint/my-model-endpoint",
      "Condition": {
        "StringEquals": {
          "aws:SourceVpce": "vpce-12345678"
        }
      }
    }
  ]
}

A
The SageMaker endpoint is not configured to accept traffic from the VPC.
Why wrong: The endpoint may be configured for VPC access, but the policy condition is the issue.
B
The IAM policy does not allow the sagemaker:InvokeEndpoint action without conditions.
Why wrong: The policy allows the action; the condition is the cause.
C
The user's IAM role is missing the s3:GetObject permission for model artifacts.
Why wrong: The policy shown is for invoking the endpoint, not for accessing artifacts.
D
The EC2 instance is not using the specified VPC endpoint (vpce-12345678).
The condition restricts invocation to traffic coming through that specific VPC endpoint.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

A data scientist is unable to invoke the Claude v2 model from an EC2 instance with IP 10.0.1.5. What is the most likely reason?

Exhibit

Refer to the exhibit.

Exhibit:
```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "bedrock:InvokeModel",
      "Resource": "arn:aws:bedrock:us-east-1:123456789012:model/anthropic.claude-v2",
      "Condition": {
        "IpAddress": {"aws:SourceIp": "10.0.0.0/8"}
      }
    }
  ]
}
```

A
The condition is too restrictive
Why wrong: The condition allows IPs in the 10.0.0.0/8 range, which includes 10.0.1.5.
B
The policy does not allow the ec2:AssociateAddress action
Why wrong: The policy is for Bedrock InvokeModel, not EC2; the error is about invoking the model, not networking.
C
The resource ARN is incorrect because it should not include the account ID
Bedrock model ARNs omit the account ID; having it results in an invalid resource.
D
The model is not available in us-east-1
Why wrong: Claude v2 is available in us-east-1.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A company is using Amazon Bedrock to generate code snippets. They notice the model occasionally generates code that fails to compile. What is the most effective way to improve code quality without retraining?

A
Reduce the temperature parameter to 0 for deterministic output.
Why wrong: While it reduces randomness, it doesn't improve syntax/compilation correctness.
B
Increase the max token limit to allow the model to complete the code fully.
Why wrong: Does not address quality of the generated code.
C
Fine-tune the model on a dataset of correct code snippets.
Why wrong: Overkill and time-consuming; prompt engineering is more efficient.
D
Use few-shot prompt engineering with correct code examples and formatting instructions.
Examples help the model understand the expected output and reduce errors.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

Refer to the exhibit. A company has the S3 bucket policy shown above. The company uses Amazon Rekognition to analyze images in the 'my-images' bucket. An IAM role used by a Lambda function calls Rekognition. Why might Rekognition be unable to read images from the bucket?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "rekognition.amazonaws.com"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-images/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "123456789012"
        }
      }
    }
  ]
}

A
The Lambda function does not have an IAM role that allows Rekognition to call S3
Why wrong: Rekognition does not assume the Lambda role; it uses the bucket policy.
B
The bucket policy does not grant Rekognition access to the bucket
Why wrong: The policy grants s3:GetObject to Rekognition service principal.
C
The bucket policy does not include PutObject permission
Why wrong: Rekognition only needs GetObject to read images.
D
The condition 'aws:SourceAccount' does not match the account of the Rekognition service
The condition ensures that the request originates from the specified account; if not, access is denied.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

An administrator reviews a CloudTrail log entry for a CreateModel API call. Which security concern should they investigate?

Exhibit

Refer to the exhibit.
[CloudTrail Log Entry]
{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "AssumedRole",
    "arn": "arn:aws:sts::123456789012:assumed-role/SageMakerExecutionRole/i-0123456789abcdef0",
    "accountId": "123456789012",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "arn": "arn:aws:iam::123456789012:role/SageMakerExecutionRole"
      }
    }
  },
  "eventTime": "2024-03-15T10:00:00Z",
  "eventSource": "sagemaker.amazonaws.com",
  "eventName": "CreateModel",
  "resources": [
    {
      "arn": "arn:aws:sagemaker:us-east-1:123456789012:model/my-model",
      "type": "AWS::SageMaker::Model"
    }
  ],
  "requestParameters": {
    "modelName": "my-model",
    "primaryContainer": {
      "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-image:latest",
      "modelDataUrl": "s3://my-bucket/model.tar.gz"
    },
    "executionRoleArn": "arn:aws:iam::123456789012:role/SageMakerExecutionRole"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.42",
  "userAgent": "sagemaker.amazonaws.com"
}

A
The model name is not encrypted in the log
Why wrong: CloudTrail logs are encrypted; model names are not sensitive.
B
The model data URL uses HTTP instead of HTTPS
HTTPS should be used to encrypt data in transit; using HTTP is a security risk.
C
The source IP address is an external IP
Why wrong: External IPs are normal; the concern is the lack of HTTPS.
D
The execution role ARN is visible in the log
Why wrong: Role ARNs are not secrets; they are identifiers.

Full breakdown with real-world context →

Question 8easymultiple choice

Full question →

A company uses Amazon Bedrock Agents to build an agent that interacts with users through a chat interface. The agent is configured with a knowledge base containing product documentation. Sometimes the agent fails to answer simple questions like 'What is your return policy?' and instead says it cannot find the answer. The knowledge base does contain the return policy. What is the most likely reason?

A
Increase the agent's maximum timeout for processing
Why wrong: Timeout is unlikely the issue if the agent quickly returns a failure; the agent is not waiting long enough to search.
B
Use a more powerful foundation model for reasoning
Why wrong: While a stronger model could interpret prompts better, the core issue is prompt guidance, not model capacity.
C
Add more documents to the knowledge base
Why wrong: The policy already exists; adding more data may increase noise and does not address the agent's failure to retrieve.
D
Simplify and clarify the agent's instruction prompt to emphasize knowledge base usage
A clear prompt instructing the agent to consult the knowledge base for all answers can dramatically improve consistency.

Full breakdown with real-world context →

These AIF-C01 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style AIF-C01 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related AIF-C01 topic practice pages

Applications of Foundation Models practice questions

Fundamentals of AI and ML practice questions

Fundamentals of Generative AI practice questions

Guidelines for Responsible AI practice questions

Security, Compliance and Governance for AI Solutions practice questions

AIF-C01 fundamentals practice questions

AIF-C01 scenario practice questions

AIF-C01 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. A data scientist created this endpoint config for a foundation model in Amazon SageMaker. However, the endpoint fails to scale under load. What is the most likely reason?

Exhibit

Refer to the exhibit. A developer deploys this CloudFormation stack but the agent fails to query the knowledge base. What is a likely cause?

Exhibit

Refer to the exhibit. A security officer has attached this IAM policy to a user to allow invocation of a SageMaker endpoint. However, the user is unable to invoke the endpoint from an EC2 instance in the same VPC. What is the most likely cause?

Exhibit

A data scientist is unable to invoke the Claude v2 model from an EC2 instance with IP 10.0.1.5. What is the most likely reason?

Exhibit

A company is using Amazon Bedrock to generate code snippets. They notice the model occasionally generates code that fails to compile. What is the most effective way to improve code quality without retraining?

Refer to the exhibit. A company has the S3 bucket policy shown above. The company uses Amazon Rekognition to analyze images in the 'my-images' bucket. An IAM role used by a Lambda function calls Rekognition. Why might Rekognition be unable to read images from the bucket?

Exhibit

An administrator reviews a CloudTrail log entry for a CreateModel API call. Which security concern should they investigate?

Exhibit