AI Safety Security And Governance

Your organization needs to ensure that only authorized IAM users can access specific foundation models in Bedrock. Which configuration is required?

A firm wants to audit the specific version of a foundation model used for every inference request. How can they achieve this?

A company is using RAG with Amazon Bedrock Knowledge Bases. They need to ensure that users can only retrieve documents they are authorized to see. How should this be implemented?

Which TWO steps are required to properly secure Bedrock Knowledge Bases?

A healthcare startup is preparing a generative AI chatbot that answers patient questions using Amazon Bedrock. The security team wants to ensure that protected health information is not inadvertently echoed back in model responses and that the model cannot be prompted to reveal its system instructions. Which AWS feature should they enable first to address both concerns?

A team is storing sensitive documents for RAG. They need to ensure that the document chunks in the vector database are encrypted at rest. How?

When fine-tuning a model on Amazon Bedrock, which THREE security considerations are critical?

A financial services company runs a generative AI assistant on Amazon Bedrock that summarizes internal reports. Compliance requires that the assistant never produce investment advice and that every response be traceable to the prompts and model version used. The team wants to enforce these controls centrally without modifying each application. Which combination of AWS capabilities should they use?

You are designing a secure Generative AI architecture on AWS. Which TWO of the following are recommended practices for securing the data ingestion pipeline for RAG?

To prevent accidental deletion of a Knowledge Base, which feature should be applied?

You are deploying a Generative AI application using Amazon SageMaker JumpStart. You need to ensure that the model endpoint is protected against prompt injection attacks. Which approach is most effective?

A developer needs to monitor their Bedrock application for potential abuse. Which TWO features should they utilize?

Which THREE services/features are essential for establishing a secure perimeter for an Amazon Bedrock deployment?

Which THREE strategies should be implemented to ensure responsible AI practices in a production workload?

You need to ensure that all data sent to an Amazon Bedrock model is encrypted in transit using private connectivity. What is the recommended service?

A company is using a third-party model via Bedrock and needs to ensure that the model provider does not use their data to train their base models. What must they do?

A financial services company is deploying a generative AI application that uses Amazon Bedrock to answer employee questions about internal policies. The security team requires that the application automatically redact personally identifiable information (PII) such as account numbers and social security numbers from both user prompts and model responses, without modifying the underlying foundation model. Which AWS service should be integrated into the application's request and response pipeline to meet this requirement?

A media company is using Amazon Bedrock to generate marketing copy. The legal team wants to ensure that the foundation model cannot be used to generate defamatory or explicit content, and they want to enforce these restrictions centrally across all applications that invoke the model. Which AWS feature should the company use to apply these content restrictions?

Which THREE items should be included in an AI application's security documentation for an audit?

When implementing a RAG-based application, which TWO of the following ensure document security?

A healthcare company is building a generative AI assistant on Amazon Bedrock that summarizes patient records. The compliance team requires that the assistant's outputs are traceable and that any harmful or biased content is detected before being shown to clinicians. The company wants to use AWS-native services and features. (Choose two.)

To ensure compliance with data residency requirements, you must restrict which AWS regions your Generative AI application can process data. What is the most effective way to enforce this?

A developer needs to share a Bedrock prompt template with another team securely. What is the recommended method?

When dealing with PII in Generative AI, which THREE practices are recommended?

Which AWS tool is used to monitor the performance and latency of an application calling Bedrock?

What is the role of an AWS Service Control Policy (SCP) in an AI governance framework?

An organization is concerned about 'Model Hallucinations' and needs a way to ground model outputs in trusted company documents. Which service supports this?

A company is using Amazon Q Business. How can they restrict access to specific data sources for different groups of users?

Which TWO of the following actions can help mitigate the risk of 'prompt injection' in a Generative AI application?

You are building a chat application and notice sensitive internal data is leaking in responses. You have enabled Guardrails. What else should be checked?

Which service should be used to provide secure identity and access management for an application accessing Bedrock?

Which TWO features of Amazon Bedrock provide governance capabilities?

A company requires that every AI-generated document must include a watermark for traceability. How can this be handled in Bedrock?

A team wants to track who accessed a model and when. Which service provides this audit log?

Which THREE of the following are components of a robust AI governance framework in an AWS environment?

A company is using Amazon Bedrock to build a customer support chatbot and needs to ensure that PII is masked before the request reaches the foundation model. Which feature should the developer implement?

A retail company wants to fine-tune an Amazon Bedrock foundation model on historical customer support transcripts stored in Amazon S3. Legal requires that the training data remain within a specific AWS Region, that only authorized data scientists can start fine-tuning jobs, and that the resulting custom model be usable only by the production application account. Which set of controls best satisfies these requirements?

Your organization wants to evaluate the quality and safety of model outputs using a formal testing framework. Which service is designed for this?

A developer wants to prevent the Generative AI application from producing content related to hate speech or violence. What is the most efficient configuration in Amazon Bedrock?