Courseiva

CCNA AI Safety Security And Governance Questions

39 questions · AI Safety Security And Governance · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

Your organization needs to ensure that only authorized IAM users can access specific foundation models in Bedrock. Which configuration is required?

A.Attach an IAM policy with bedrock:InvokeModel allowing access to specific model ARNs
B.Enable AWS Organizations SCPs only
C.Use Amazon Cognito user pools
D.Use Resource-Based Policies on the foundation model
AnswerA

Attaching an IAM policy scoped to specific model ARNs satisfies the least-privilege constraint, because Bedrock authorises each InvokeModel call against the resource ARN in the request. Only principals granted bedrock:InvokeModel on those ARNs succeed; other IAM users receive AccessDenied, restricting access to the named foundation models.

Why this answer

Amazon Bedrock integrates with AWS IAM to control access to foundation models. To restrict which IAM users can invoke specific models, you attach an IAM policy that includes the bedrock:InvokeModel action and specifies the ARNs of the allowed foundation models. This policy can be attached to users, groups, or roles, and it enforces least privilege at the model level.

Without such a policy, users either have no access or overly broad access, so this is the required configuration.

Exam trap

AIP-C01 often tests the misconception that SCPs or resource-based policies can grant access to Bedrock models, when in fact identity-based IAM policies with bedrock:InvokeModel and specific model ARNs are required.

How to eliminate wrong answers

Option B is wrong because AWS Organizations SCPs only set maximum permissions for accounts in an organization; they do not grant permissions to IAM users and cannot by themselves allow access to specific models. Option C is wrong because Amazon Cognito user pools are for authenticating end users in applications, not for authorizing IAM users to invoke Bedrock foundation models. Option D is wrong because Bedrock foundation models do not support resource-based policies; access must be granted through identity-based IAM policies.

Practice this question →
2
MCQhard

A firm wants to audit the specific version of a foundation model used for every inference request. How can they achieve this?

A.Query Amazon SageMaker Model Monitor
B.Enable CloudTrail logs
C.Enable Bedrock Model Invocation Logging
D.Use AWS Config to track model changes
AnswerC

Bedrock Model Invocation Logging captures each request and response, including the model ID and version invoked, delivering records to CloudWatch Logs or S3. This provides the per-request audit trail needed to identify the exact foundation model version used for every inference.

Why this answer

Bedrock Model Invocation Logging captures each invocation's request and response metadata — including the model ID and, when applicable, the specific model version or inference profile — and delivers it to CloudWatch Logs or S3. This provides the audit trail needed to prove which foundation model version handled each request.

Exam trap

AIP-C01 often tests the confusion between CloudTrail (control-plane API auditing) and Model Invocation Logging (per-request model and payload auditing), so candidates pick CloudTrail for version attribution.

How to eliminate wrong answers

Option A is wrong because SageMaker Model Monitor tracks data drift and quality for SageMaker endpoints, not Bedrock model versions. Option B is wrong because CloudTrail records control-plane API calls (who called InvokeModel and when) but does not log the model version used for each inference payload. Option D is wrong because AWS Config tracks resource configuration changes over time, not per-request model version attribution.

Practice this question →
3
MCQhard

A company is using RAG with Amazon Bedrock Knowledge Bases. They need to ensure that users can only retrieve documents they are authorized to see. How should this be implemented?

A.Encrypt the documents with different KMS keys
B.Create separate Knowledge Bases for every user
C.Apply IAM policies to the S3 bucket
D.Use the filters attribute in the Retrieve API call based on document metadata
AnswerD

Filtering on document metadata during retrieval enforces per-user authorisation at query time, satisfying the requirement that users only see documents they are permitted to access. Metadata tags such as department or group are matched against the caller's identity, so unauthorised chunks never enter the context passed to the model.

Why this answer

Amazon Bedrock Knowledge Bases support metadata filtering on the Retrieve and RetrieveAndGenerate APIs. By attaching authorization metadata (e.g., department, clearance level) to documents during ingestion and passing a filters attribute in the Retrieve call based on the user's identity, the application ensures users only retrieve documents they are authorized to see. This enforces document-level access control at query time.

Exam trap

AIP-C01 often tests the misconception that IAM policies on S3 or KMS encryption enforce document-level access in RAG, when the correct control is metadata filtering in the Retrieve API call.

How to eliminate wrong answers

Option A is wrong because encrypting documents with different KMS keys controls decryption access, not retrieval filtering; a user with decrypt rights could still retrieve unauthorized documents if the knowledge base returns them. Option B is wrong because creating a separate Knowledge Base per user is operationally infeasible and does not scale. Option C is wrong because IAM policies on the S3 bucket govern access to the bucket, not the knowledge base retrieval results, and the knowledge base service role typically has broad access.

Practice this question →
4
Multi-Selectmedium

Which TWO steps are required to properly secure Bedrock Knowledge Bases?

Select 2 answers
A.Disable all encryption to increase performance
B.Place the Knowledge Base in a public subnet
C.Use IAM roles for the Knowledge Base to access data
D.Grant public read access to the S3 bucket
E.Specify a KMS key for encryption at rest
AnswersC, E

Knowledge Bases assume an IAM service role to read source documents from S3 and invoke embedding models, so permissions are scoped to that role rather than embedded credentials. This satisfies least-privilege access to the underlying data stores.

Why this answer

Enabling encryption and managing IAM access are the primary security configurations.

Practice this question →
5
MCQeasy

A healthcare startup is preparing a generative AI chatbot that answers patient questions using Amazon Bedrock. The security team wants to ensure that protected health information is not inadvertently echoed back in model responses and that the model cannot be prompted to reveal its system instructions. Which AWS feature should they enable first to address both concerns?

A.Amazon VPC endpoints for Bedrock to keep traffic off the public internet.
B.AWS Key Management Service customer managed keys for the Bedrock model customization jobs.
C.AWS Identity and Access Management policies that restrict which Bedrock models the application can invoke.
D.Amazon Bedrock Guardrails with sensitive information filters and prompt attack filters.
AnswerD

Guardrails offers sensitive information filters that detect and mask or block PII and PHI patterns in prompts and responses, plus prompt attack filters that detect jailbreak and prompt-injection attempts aimed at extracting system instructions. Enabling it addresses both concerns at the model boundary without application changes.

Why this answer

Amazon Bedrock Guardrails is the purpose-built control for inspecting model inputs and outputs. Sensitive information filters detect and mask or block PHI and PII, while prompt attack filters identify jailbreak and prompt-injection patterns that try to extract system prompts. Enabling Guardrails directly addresses both the PHI disclosure and system instruction leakage concerns.

Exam trap

The trap here is confusing encryption, networking, or authorization controls with content-level safety controls, which are handled by Bedrock Guardrails.

Practice this question →
6
MCQmedium

A team is storing sensitive documents for RAG. They need to ensure that the document chunks in the vector database are encrypted at rest. How?

A.Configure the vector database (e.g., OpenSearch) with KMS encryption
B.Use TLS for all connections
C.Use Amazon S3-managed encryption
D.Encrypt the source S3 bucket only
AnswerA

Configuring the vector database with KMS encryption applies customer-managed keys to the underlying storage volumes, ensuring chunks are encrypted at rest. This satisfies the encryption-at-rest constraint directly, rather than relying on transport TLS or application-layer tokenisation.

Why this answer

Encryption at rest for a vector database is enforced at the storage layer of that database, so configuring the vector store (e.g., Amazon OpenSearch Serverless or Aurora pgvector) with a KMS customer-managed key ensures the indexed embeddings and metadata are encrypted on disk. This is independent of how the source documents are encrypted in S3. KMS CMKs give the team control over key rotation and access policies.

Exam trap

AIP-C01 often tests the confusion between encryption in transit (TLS) and encryption at rest (KMS), and between the source data store (S3) and the derived data store (vector DB), so candidates who pick TLS or S3 encryption miss the actual at-rest requirement for the vector index.

How to eliminate wrong answers

Option B is wrong because TLS encrypts data in transit between the application and the vector store, not data at rest on disk. Option C is wrong because S3-managed encryption (SSE-S3) protects the source bucket, not the vector database where chunks are actually stored after ingestion. Option D is wrong because encrypting only the source S3 bucket leaves the vector store's indexed chunks unencrypted at rest, which is exactly the data the question asks about.

Practice this question →
7
Multi-Selecthard

When fine-tuning a model on Amazon Bedrock, which THREE security considerations are critical?

Select 3 answers
A.Using a root user account to launch the training job
B.Limiting IAM permissions for the fine-tuning job
C.Encrypting the training dataset in S3 with KMS
D.Making the training dataset publicly readable
E.Ensuring the training dataset is free of PII
AnswersB, C, E

Limiting IAM permissions for the fine-tuning job enforces least privilege, so the job can read only its training data and write only its output model. This constrains blast radius if the job is compromised, satisfying the security requirement for scoped access during customisation.

Why this answer

Option B is correct because fine-tuning jobs on Amazon Bedrock should run under a scoped IAM role/service role that grants only the permissions needed (e.g., s3:GetObject on the specific training bucket and bedrock:CreateModelCustomizationJob), following least privilege to limit blast radius. Option C is correct because training data stored in Amazon S3 should be encrypted at rest with AWS KMS (SSE-KMS), and Bedrock requires access to the KMS key to read the dataset, protecting sensitive training content. Option E is correct because datasets used for fine-tuning must be reviewed and scrubbed of personally identifiable information (PII) to avoid embedding sensitive data into model weights and to comply with privacy regulations.

Option A is wrong because using the root user violates AWS best practices; root should not be used for workloads and lacks granular, auditable permissions. Option D is wrong because making the training dataset publicly readable exposes proprietary or sensitive data to anyone and is a severe security misconfiguration.

Exam trap

AIP-C01 often tests whether candidates confuse 'security best practices' with obvious anti-patterns (root user, public S3), so the trap is picking options that sound operationally convenient but violate least privilege or data protection.

Practice this question →
8
MCQhard

A financial services company runs a generative AI assistant on Amazon Bedrock that summarizes internal reports. Compliance requires that the assistant never produce investment advice and that every response be traceable to the prompts and model version used. The team wants to enforce these controls centrally without modifying each application. Which combination of AWS capabilities should they use?

A.AWS WAF rules that inspect request bodies for financial terms, plus AWS CloudTrail data events on the Bedrock endpoint.
B.Amazon Macie to detect sensitive data in S3 and AWS Config rules to enforce Bedrock model version pinning.
C.Amazon Comprehend toxicity detection on each response and AWS CloudTrail management events for the Bedrock API.
D.Amazon Bedrock Guardrails with a denied topics policy and sensitive information filters, plus model invocation logging to Amazon CloudWatch Logs and Amazon S3.
AnswerD

Guardrails provides a denied topics policy that blocks investment-advice content and sensitive information filters for PII, while model invocation logging captures the full prompt, response, and model ID for traceability. Both are configured at the account or application level and apply without rewriting each application's code.

Why this answer

Amazon Bedrock Guardrails enforces content policies such as denied topics and sensitive information filters independently of application code, and model invocation logging stores prompts, responses, and model identifiers in CloudWatch Logs and S3. Together they deliver centralized policy enforcement plus the audit trail compliance requires, without per-application changes.

Exam trap

The trap here is reaching for network or data-classification services like WAF, Macie, or Config for a problem that is about model input and output content governance.

Practice this question →
9
Multi-Selectmedium

You are designing a secure Generative AI architecture on AWS. Which TWO of the following are recommended practices for securing the data ingestion pipeline for RAG?

Select 2 answers
A.Disable all logging in the pipeline to prevent data exposure
B.Store API keys in plain text within the Lambda code
C.Enforce TLS 1.2+ for all data movement
D.Use AWS KMS to encrypt data at rest in the S3 bucket
E.Store all documents in a public S3 bucket for ease of access
AnswersC, D

TLS 1.2+ encrypts data in transit across every ingestion hop — source systems, S3 uploads, and vector store writes — satisfying the pipeline's transport-encryption requirement. This prevents interception or tampering of documents and embeddings moving between services, complementing at-rest encryption rather than replacing it.

Why this answer

Encrypting data in transit (TLS) and at rest (KMS) are fundamental for data pipeline security.

Practice this question →
10
MCQeasy

To prevent accidental deletion of a Knowledge Base, which feature should be applied?

A.Use AWS Backup
B.Enable MFA Delete on S3
C.Enable S3 Versioning
D.Apply an IAM policy denying DeleteKnowledgeBase
AnswerD

An explicit IAM policy denying the DeleteKnowledgeBase action overrides any allow granted by attached identity policies, directly preventing accidental deletion. This satisfies the stem's constraint of blocking deletion while leaving other Knowledge Base operations unaffected.

Why this answer

The correct answer is D: Apply an IAM policy denying DeleteKnowledgeBase. AWS Identity and Access Management (IAM) policies are the primary mechanism for controlling access to AWS actions, including the DeleteKnowledgeBase action for Amazon Bedrock Knowledge Bases. By explicitly denying this action, you prevent any principal (user, role, or service) from deleting the knowledge base, even if they have other permissions that would otherwise allow it.

This is a direct, preventive control that aligns with the principle of least privilege.

Exam trap

AIP-C01 often tests the difference between preventive and detective controls, and candidates may confuse data protection features like S3 Versioning or MFA Delete with resource-level access control, leading them to choose options that protect data but not the Knowledge Base resource itself.

How to eliminate wrong answers

Option A is wrong because AWS Backup is used to create and restore backups of supported resources, but it does not prevent deletion; it only enables recovery after deletion, and Amazon Bedrock Knowledge Bases are not a supported resource type for AWS Backup. Option B is wrong because MFA Delete on S3 adds an extra layer of authentication for deleting objects in an S3 bucket, but it does not protect the Knowledge Base resource itself; the Knowledge Base is a Bedrock resource, not an S3 object. Option C is wrong because S3 Versioning protects individual objects within a bucket by retaining multiple versions, but it does not prevent the deletion of the Knowledge Base resource, which is managed by Bedrock, not S3.

Practice this question →
11
MCQmedium

You are deploying a Generative AI application using Amazon SageMaker JumpStart. You need to ensure that the model endpoint is protected against prompt injection attacks. Which approach is most effective?

A.Encrypt the model weights with a CMK
B.Enable Amazon Inspector on the endpoint
C.Use a prompt-based filter system that detects malicious intent via a secondary validation model
D.Disable the API Gateway execute-api method
AnswerC

A secondary validation model inspects prompts for malicious intent before inference, catching injection attempts that static keyword filters miss because attackers rephrase payloads. This layered detection satisfies the prompt-injection protection requirement for the SageMaker JumpStart endpoint more effectively than input sanitisation alone.

Why this answer

A prompt-based filter system that uses a secondary validation model to detect malicious intent is the most effective approach because prompt injection is a semantic/behavioral attack that must be detected by analyzing the input and output content, not by infrastructure controls. A dedicated classifier or LLM-as-judge can flag jailbreak patterns, instruction overrides, and data exfiltration attempts before they reach the primary model.

Exam trap

AIP-C01 often tests the confusion between infrastructure security controls (encryption, Inspector, API Gateway) and application-layer AI security — candidates must recognize that prompt injection is a content/semantic attack requiring content-aware defenses, not network or IAM controls.

How to eliminate wrong answers

Option A is wrong because encrypting model weights with a CMK protects data at rest — it does nothing against prompt injection, which is an input-layer attack. Option B is wrong because Amazon Inspector scans compute instances and container images for vulnerabilities (CVEs); it has no capability to detect prompt injection payloads. Option D is wrong because disabling the API Gateway execute-api method simply breaks the endpoint — it is not a security control against injection and would render the application unusable.

Practice this question →
12
Multi-Selectmedium

A developer needs to monitor their Bedrock application for potential abuse. Which TWO features should they utilize?

Select 2 answers
A.Amazon CloudWatch metrics (e.g., 5xx error rates)
B.AWS Cost Explorer to track daily spending
C.Amazon Simple Notification Service
D.AWS Trusted Advisor performance checks
E.AWS CloudTrail to monitor for unusual API calling patterns
AnswersA, E

CloudWatch metrics expose Bedrock's invocation-level telemetry, including 5xx error rates and throttling counts, which surface anomalous request patterns indicative of abuse. Satisfying the monitoring constraint, these native service metrics feed alarms and dashboards without custom instrumentation, enabling prompt detection of volumetric or error-driven misuse.

Why this answer

Option A, Amazon CloudWatch metrics such as 5xx error rates, is correct because CloudWatch provides the runtime observability needed to detect abuse-driven failures and anomalies in a Bedrock application, letting the developer alarm on elevated error rates and other service metrics. Option E, AWS CloudTrail to monitor for unusual API calling patterns, is correct because CloudTrail records Bedrock API activity (e.g., InvokeModel calls) and can be analyzed to spot suspicious invocation volumes, unexpected principals, or anomalous call patterns indicative of abuse. Option B, AWS Cost Explorer, only shows aggregated spending trends and cannot identify abusive request patterns or errors.

Option C, Amazon Simple Notification Service, is merely a notification delivery mechanism and does not itself detect or monitor abuse. Option D, AWS Trusted Advisor performance checks, focuses on general best-practice and service-limit guidance rather than application-level abuse detection.

Exam trap

AIP-C01 often tests the distinction between monitoring services (CloudWatch for metrics, CloudTrail for API audit) and cost/notification/advisory services (Cost Explorer, SNS, Trusted Advisor), so candidates must pick the two that directly provide abuse detection signals.

Practice this question →
13
Multi-Selecthard

Which THREE services/features are essential for establishing a secure perimeter for an Amazon Bedrock deployment?

Select 3 answers
A.Interface VPC Endpoints (PrivateLink)
B.AWS Public Access Block on all buckets
C.AWS Shield Standard
D.Security Groups on the VPC
E.IAM Policies for resource access control
AnswersA, D, E

Interface VPC endpoints (PrivateLink) keep Bedrock traffic on the AWS private network, avoiding public internet exposure entirely. This satisfies the secure perimeter requirement by giving private connectivity from the VPC, with endpoint policies and security groups governing access.

Why this answer

Interface VPC Endpoints (PrivateLink) (A) are essential because they let you access Amazon Bedrock privately from within your VPC over the AWS private network, keeping Bedrock traffic off the public internet and enabling granular endpoint policies. Security Groups on the VPC (D) are essential because they act as stateful virtual firewalls controlling which resources can reach the Bedrock interface endpoint on TCP 443, enforcing least-privilege network access at the perimeter. IAM Policies for resource access control (E) are essential because they authenticate and authorize which principals may invoke Bedrock models and actions, providing the identity-based control layer of the secure perimeter.

AWS Public Access Block on all buckets (B) is not essential here since it governs S3 bucket exposure, not Bedrock access, and AWS Shield Standard (C) is automatically enabled DDoS protection that is not a Bedrock-specific perimeter control.

Exam trap

AIP-C01 often tests whether candidates conflate general AWS security services (Shield, S3 Public Access Block) with the specific network and identity controls (PrivateLink, Security Groups, IAM) that establish a secure perimeter for Bedrock.

Practice this question →
14
Multi-Selecthard

Which THREE strategies should be implemented to ensure responsible AI practices in a production workload?

Select 3 answers
A.Perform regular model evaluation for bias
B.Exclude all logging to protect privacy
C.Maintain comprehensive logs for auditability
D.Implement human-in-the-loop review for critical outputs
E.Allow users to train the model directly
AnswersA, C, D

Regular model evaluation for bias detects disparate performance across demographic groups before and after deployment, enabling remediation. This directly satisfies the stem's responsible AI requirement by providing measurable, recurring evidence that outputs remain fair throughout the production workload's lifecycle.

Why this answer

Option A is correct because regularly evaluating the model for bias (e.g., using fairness metrics such as demographic parity or equalized odds across subgroups) detects and mitigates discriminatory behavior before it harms users, which is a core responsible-AI control. Option C is correct because maintaining comprehensive logs of inputs, outputs, model versions, and decisions provides auditability and traceability, enabling incident investigation, compliance reporting, and accountability in production. Option D is correct because human-in-the-loop review for critical outputs ensures a qualified person validates high-impact decisions, catching harmful or erroneous model results that automation alone should not finalize.

Option B does not belong because excluding all logging destroys auditability and incident forensics rather than protecting privacy; privacy should be handled via data minimization, encryption, and access controls. Option E does not belong because letting users train the model directly in production risks data poisoning, uncontrolled drift, and loss of governance over model behavior.

Practice this question →
15
MCQmedium

You need to ensure that all data sent to an Amazon Bedrock model is encrypted in transit using private connectivity. What is the recommended service?

A.AWS WAF
B.AWS CloudFront
C.AWS PrivateLink (VPC Endpoints)
D.AWS Certificate Manager
AnswerC

AWS PrivateLink (VPC Endpoints) keeps traffic to Amazon Bedrock entirely within the AWS network, satisfying the private connectivity constraint. Interface endpoints use ENIs in your subnets, so requests never traverse the public internet, and TLS encrypts data in transit between your VPC and the service.

Why this answer

AWS PrivateLink (VPC Endpoints) is the recommended service because it creates a private, one-way connection between a VPC and Amazon Bedrock using interface endpoints powered by ENIs, keeping traffic on the AWS backbone and off the public internet. This satisfies the requirement for private connectivity with encryption in transit (TLS) to the Bedrock endpoint. It avoids the need for internet gateways, NAT devices, or public IPs.

Exam trap

AIP-C01 often tests the confusion between encryption in transit (TLS, which is automatic for AWS APIs) and private connectivity (PrivateLink), so candidates pick ACM or WAF thinking they address encryption rather than network path isolation.

How to eliminate wrong answers

Option A is wrong because AWS WAF is a Layer 7 web application firewall that filters HTTP(S) requests to CloudFront, ALB, or API Gateway — it does not provide private network connectivity to Bedrock. Option B is wrong because CloudFront is a CDN that caches and delivers content over the public internet, which is the opposite of private connectivity. Option D is wrong because AWS Certificate Manager only provisions and manages TLS certificates; it does not establish private network paths or encrypt traffic by itself.

Practice this question →
16
MCQhard

A company is using a third-party model via Bedrock and needs to ensure that the model provider does not use their data to train their base models. What must they do?

A.Disable all logging
B.Enable the 'Opt-out' setting in the Bedrock console
C.Understand that AWS does not use customer data to train their foundation models
D.Encrypt all data with a customer-managed key
AnswerC

AWS states that customer inputs and outputs for third-party models on Bedrock are not used to train the underlying foundation models, and are not shared with model providers. Recognising this satisfies the stem's requirement without needing opt-out configuration, since the protection applies by default.

Why this answer

AWS does not use customer data to train its foundation models. When using third-party models via Amazon Bedrock, the model provider also does not have access to customer data for training their base models. This is a fundamental data privacy commitment from AWS.

Therefore, no additional action is required; the correct understanding is that AWS and its model providers do not use customer data for training. Enabling an opt-out setting is not necessary because the default is already no training on customer data.

Exam trap

The trap is assuming that an opt-out setting exists or that additional configuration is needed, but the exam expects candidates to know that AWS's default policy already prohibits using customer data for training.

How to eliminate wrong answers

Option A is wrong because disabling logging does not affect whether data is used for training; logging is for audit and monitoring, and AWS does not train on customer data regardless. Option B is wrong because there is no 'Opt-out' setting in the Bedrock console for this purpose; the default policy already ensures customer data is not used for training. Option D is wrong because encrypting data with a customer-managed key protects data at rest but does not influence the model provider's training practices; encryption is orthogonal to data usage policies.

Practice this question →
17
MCQmedium

A financial services company is deploying a generative AI application that uses Amazon Bedrock to answer employee questions about internal policies. The security team requires that the application automatically redact personally identifiable information (PII) such as account numbers and social security numbers from both user prompts and model responses, without modifying the underlying foundation model. Which AWS service should be integrated into the application's request and response pipeline to meet this requirement?

A.Amazon Macie
B.Amazon Comprehend
C.AWS CloudTrail
D.Amazon GuardDuty
AnswerB

Amazon Comprehend provides real-time PII detection and redaction through its ContainsPiiEntities and DetectPiiEntities APIs. By calling these APIs in the application pipeline before sending prompts to Bedrock and after receiving completions, the team can redact sensitive entities such as SSNs and account numbers without altering the foundation model itself. This satisfies the inline redaction requirement.

Why this answer

Amazon Comprehend offers purpose-built PII detection and redaction APIs that can be invoked synchronously within an application's request and response flow. Integrating it before Bedrock invocation and after completion generation ensures sensitive data is masked without retraining or modifying the foundation model. The other services address storage classification, audit logging, or threat detection, none of which provide inline content redaction for generative AI payloads.

Exam trap

The trap here is assuming that a data classification or audit service can perform inline redaction, when only Amazon Comprehend provides real-time PII detection and masking APIs for application payloads.

Practice this question →
18
MCQeasy

A media company is using Amazon Bedrock to generate marketing copy. The legal team wants to ensure that the foundation model cannot be used to generate defamatory or explicit content, and they want to enforce these restrictions centrally across all applications that invoke the model. Which AWS feature should the company use to apply these content restrictions?

A.AWS Identity and Access Management (IAM) policies
B.Amazon Bedrock Guardrails
C.Amazon Bedrock model customization
D.AWS Key Management Service (AWS KMS) encryption
AnswerB

Amazon Bedrock Guardrails lets you define content filters, denied topics, and word filters that are applied to every invocation of a model. By attaching a guardrail to the model or to the application's inference calls, the company can centrally enforce restrictions against defamatory or explicit content across all applications. This meets the requirement for a centralized, reusable policy.

Why this answer

Amazon Bedrock Guardrails is the AWS-native feature designed to enforce content policies such as blocking defamatory, explicit, or otherwise harmful material. It can be applied centrally to model invocations, ensuring consistent enforcement across applications. IAM, model customization, and AWS KMS address access control, model behavior tuning, and encryption respectively, but none provide semantic content filtering.

Exam trap

The trap here is assuming that access control or encryption can enforce content restrictions, when only a dedicated content moderation feature like Amazon Bedrock Guardrails can inspect and filter the meaning of prompts and responses.

Practice this question →
19
Multi-Selecthard

Which THREE items should be included in an AI application's security documentation for an audit?

Select 3 answers
A.Logging and monitoring policies
B.Encryption methods for training/RAG data
C.Public links to all internal datasets
D.User passwords for all employees
E.Description of safety filters (Guardrails)
AnswersA, B, E

Auditors need evidence that AI activity is continuously recorded and reviewed. Documenting logging and monitoring policies shows how prompt, response and access events are captured, retained and alerted on, satisfying the audit requirement for demonstrable operational oversight.

Why this answer

Option A (Logging and monitoring policies) is correct because auditors need documented evidence of how the AI application records access, inference requests, and anomalous activity, typically via services like CloudWatch, CloudTrail, or Azure Monitor, to demonstrate continuous detection and incident response. Option B (Encryption methods for training/RAG data) is correct because it specifies the cryptographic controls protecting data at rest and in transit — for example AES-256 at rest and TLS 1.2+ in transit — which is essential for verifying confidentiality of sensitive training and retrieval-augmented generation data. Option E (Description of safety filters (Guardrails)) is correct because documenting content moderation, prompt-injection defenses, and output filtering demonstrates that the application enforces responsible-AI and abuse-prevention controls required by audit frameworks.

Option C is incorrect because exposing public links to internal datasets would itself be a security and privacy violation, not an audit artifact. Option D is incorrect because storing or sharing user passwords in documentation violates credential-handling best practices; auditors review password policies and hashing (e.g., bcrypt/Argon2), never actual passwords.

Exam trap

AIP-C01 often tests whether candidates confuse 'documentation for an audit' with 'operational access,' so they pick options that expose credentials or data, which are exactly what auditors prohibit.

Practice this question →
20
Multi-Selectmedium

When implementing a RAG-based application, which TWO of the following ensure document security?

Select 2 answers
A.Apply metadata filters to control document access
B.Use IAM-based connectors to data sources
C.Use a single shared user for all data source connections
D.Make all documents globally readable
E.Disable indexing of sensitive documents
AnswersA, B

Metadata filters restrict retrieval to documents whose tags match the caller's authorisation attributes, so restricted chunks never enter the context window. This satisfies document security by enforcing access control at query time within the vector search itself.

Why this answer

Option A is correct because applying metadata filters at query time restricts retrieval to only the documents a given user is authorized to see, enforcing document-level access control within the RAG pipeline. Option B is correct because IAM-based connectors authenticate to data sources using identity and access management policies, ensuring that only permitted documents are ingested and that access respects existing enterprise permissions. Option C is wrong because a single shared user removes per-user accountability and grants everyone the same access, defeating least privilege.

Option D is wrong because making all documents globally readable exposes sensitive content to every user and query. Option E is wrong because disabling indexing of sensitive documents doesn't secure them within RAG; it merely removes them from retrieval, which is a data-availability decision rather than an access-control mechanism.

Exam trap

AIP-C01 often tests the misconception that RAG security is only about the vector store, when in fact both ingestion-time IAM scoping and retrieval-time metadata filtering are required.

Practice this question →
21
Multi-Selecthard

A healthcare company is building a generative AI assistant on Amazon Bedrock that summarizes patient records. The compliance team requires that the assistant's outputs are traceable and that any harmful or biased content is detected before being shown to clinicians. The company wants to use AWS-native services and features. (Choose two.)

Select 2 answers
A.Use AWS Trusted Advisor to review the Bedrock model for ethical AI compliance.
B.Enable Amazon Macie to automatically redact biased statements from Bedrock responses.
C.Configure AWS WAF to inspect the generative AI responses for biased language.
D.Enable model invocation logging in Amazon Bedrock to capture request and response metadata to Amazon CloudWatch Logs and Amazon S3.
E.Use Amazon Bedrock Guardrails to apply content filters and denied topics to both prompts and responses.
AnswersD, E

Model invocation logging in Amazon Bedrock records the input prompts, output text, and associated metadata for each invocation. This creates an audit trail that supports traceability and post-hoc analysis of model behavior. Storing logs in CloudWatch Logs and S3 enables compliance teams to review what the model generated and when, which directly addresses the traceability requirement for patient record summaries.

Why this answer

Amazon Bedrock Guardrails evaluates prompts and completions against configurable policies to block harmful or biased content before it is presented, while model invocation logging captures detailed request and response data for traceability. Together they provide both preventive content moderation and a durable audit trail. AWS WAF, Amazon Macie, and AWS Trusted Advisor operate at different layers and cannot inspect or record natural language content for bias or harmful material.

Exam trap

The trap here is confusing infrastructure security services like AWS WAF or data classification tools like Amazon Macie with content moderation and traceability features that are specific to Amazon Bedrock Guardrails and model invocation logging.

Practice this question →
22
MCQmedium

To ensure compliance with data residency requirements, you must restrict which AWS regions your Generative AI application can process data. What is the most effective way to enforce this?

A.Service Control Policies (SCPs)
B.VPC Endpoint policies
C.IAM policies for all users
D.CloudFront geographic restrictions
AnswerA

SCPs are AWS Organizations guardrails that deny actions or regions across member accounts, evaluated before IAM policies. Attaching a region-restriction SCP to the relevant OUs enforces data residency at the account boundary, blocking Generative AI workloads from invoking services outside approved regions.

Why this answer

Service Control Policies (SCPs) in AWS Organizations are the most effective way to enforce region restrictions across an entire account or organizational unit. An SCP with a Deny condition on aws:RequestedRegion (excluding approved regions) blocks API calls to non-compliant regions regardless of what IAM permissions individual users hold. This provides a centralized, hard guardrail for data residency.

Exam trap

AIP-C01 often tests the misconception that IAM policies alone can enforce region restrictions — candidates miss that SCPs are the centralized guardrail that even admins cannot bypass.

How to eliminate wrong answers

Option B is wrong because VPC Endpoint policies only control access to specific AWS services through that endpoint — they do not restrict which regions an application can call, and they only apply to traffic using that endpoint. Option C is wrong because IAM policies for all users are per-identity and can be modified or bypassed by users with permission to create new roles; they also do not provide a centralized guardrail and are error-prone at scale. Option D is wrong because CloudFront geographic restrictions block viewer access based on country, not which AWS regions your backend services process data in — it is a content-delivery control, not a data-residency enforcement mechanism.

Practice this question →
23
MCQeasy

A developer needs to share a Bedrock prompt template with another team securely. What is the recommended method?

A.Save the prompt as a text file in S3 with public access
B.Use Amazon Bedrock Prompt Management
C.Send the prompt in an email
D.Store the prompt in a Git repository without encryption
AnswerB

Amazon Bedrock Prompt Management stores prompt templates as versioned, shareable resources, allowing controlled cross-account or cross-team access through IAM rather than manual copying. This satisfies the secure-sharing constraint while preserving version history and centralised updates.

Why this answer

Amazon Bedrock Prompt Management provides a secure, centralized way to create, version, and share prompt templates with other teams. It integrates with IAM for access control, allowing you to grant specific permissions to other teams without exposing the prompt publicly. This is the recommended method for secure sharing.

Exam trap

AIP-C01 often tests whether candidates choose convenient but insecure sharing methods like public S3 or email, instead of the secure, managed Bedrock Prompt Management feature.

How to eliminate wrong answers

Option A is wrong because storing a prompt in S3 with public access exposes it to anyone on the internet, violating security best practices. Option C is wrong because sending a prompt via email is not secure, lacks version control, and is not a managed sharing method. Option D is wrong because storing a prompt in a Git repository without encryption may expose it if the repository is compromised, and it lacks the access control and versioning features of Bedrock Prompt Management.

Practice this question →
24
Multi-Selecthard

When dealing with PII in Generative AI, which THREE practices are recommended?

Select 3 answers
A.Store PII in plain text logs for debugging
B.Implement access policies to restrict PII visibility
C.Share PII freely across all AWS accounts
D.Ensure PII is encrypted at rest using KMS
E.Use Bedrock Guardrails PII redaction
AnswersB, D, E

Access policies enforce least-privilege and role-based controls so only authorised identities can view PII within generative AI workflows, satisfying the stem's requirement for handling personal data responsibly. This limits exposure during prompt processing and output generation, reducing regulatory breach risk under regimes such as UK GDPR.

Why this answer

Option B is correct because implementing least-privilege access policies (e.g., IAM policies and resource-based policies) restricts who can view or process PII, which is a foundational control for protecting sensitive data in Generative AI workloads. Option D is correct because encrypting PII at rest with AWS KMS (using customer managed keys and envelope encryption) ensures that stored data remains unreadable if the underlying storage is compromised, satisfying compliance requirements such as GDPR, HIPAA, and PCI DSS. Option E is correct because Amazon Bedrock Guardrails provides built-in sensitive information filters that can detect and redact PII (such as names, emails, and phone numbers) in both prompts and model responses, preventing PII from leaking into or out of the model.

Option A is not recommended because storing PII in plain text logs exposes sensitive data to anyone with log access and violates data minimization and encryption principles. Option C is not recommended because sharing PII freely across all AWS accounts breaks tenant isolation and least-privilege boundaries, increasing the risk of unauthorized access and data leakage.

Exam trap

AIP-C01 often tests the misconception that debugging convenience justifies storing PII in plain text, or that PII can be freely shared across accounts, when the exam expects defense-in-depth controls like encryption, access policies, and Guardrails redaction.

Practice this question →
25
MCQeasy

Which AWS tool is used to monitor the performance and latency of an application calling Bedrock?

A.Amazon Inspector
B.AWS CloudTrail
C.Amazon CloudWatch
D.AWS Config
AnswerC

Amazon CloudWatch collects Bedrock runtime metrics such as invocation latency, throttling and token counts, plus custom metrics your application publishes. This satisfies the stem's requirement to monitor both application performance and the latency of Bedrock calls, since CloudWatch is the native AWS observability service for these metrics.

Why this answer

Amazon CloudWatch provides metrics for request latency, invocation count, and errors for Bedrock models.

Practice this question →
26
MCQeasy

What is the role of an AWS Service Control Policy (SCP) in an AI governance framework?

A.To store model weights securely
B.To automatically optimize model latency
C.To monitor user chat history
D.To enforce organizational compliance and restrict service access
AnswerD

SCPs define the maximum available permissions for all accounts in an AWS Organization, restricting which services and actions member accounts can use regardless of their IAM policies, thereby enforcing organisational compliance across the AI governance framework.

Why this answer

SCPs provide centralized guardrails to define the maximum permissions that can be granted to IAM roles across all accounts in an organization.

Practice this question →
27
MCQhard

An organization is concerned about 'Model Hallucinations' and needs a way to ground model outputs in trusted company documents. Which service supports this?

A.Amazon Bedrock Knowledge Bases
B.Amazon SageMaker Feature Store
C.AWS Glue Data Catalog
D.Amazon DynamoDB
AnswerA

Amazon Bedrock Knowledge Bases performs retrieval-augmented generation by querying your ingested document store, then passing retrieved passages to the foundation model as context. This grounds responses in trusted company documents, directly addressing the hallucination concern. It satisfies the grounding constraint through managed vector ingestion and citation-backed retrieval, without custom pipeline code.

Why this answer

Amazon Bedrock Knowledge Bases implements Retrieval Augmented Generation (RAG) by connecting foundation models to trusted data sources stored in Amazon S3 or other supported repositories. It chunks, embeds, and indexes documents into a vector store, then retrieves relevant passages at inference time so the model's response is grounded in actual company content rather than parametric memory. This directly reduces hallucinations by supplying factual context in the prompt.

Exam trap

AIP-C01 often tests the confusion between storage/catalog services (Glue, DynamoDB, Feature Store) and the specific RAG-grounding service (Bedrock Knowledge Bases), so candidates must recognize that only Knowledge Bases performs semantic retrieval for grounding.

How to eliminate wrong answers

Option B is wrong because SageMaker Feature Store is a repository for ML feature engineering and training/serving consistency, not a retrieval mechanism for grounding LLM prompts. Option C is wrong because AWS Glue Data Catalog is a metadata catalog for data lakes and ETL jobs; it stores schema information, not embeddings or retrievable document chunks. Option D is wrong because DynamoDB is a key-value/document NoSQL database and does not natively perform semantic vector search or RAG retrieval.

Practice this question →
28
MCQeasy

A company is using Amazon Q Business. How can they restrict access to specific data sources for different groups of users?

A.Create separate Amazon Q applications
B.Manually delete documents for specific users
C.Configure ACLs in the data source connector
D.Apply IAM policies to the user's login
AnswerC

Amazon Q Business honours access control lists retrieved by the connector, so per-user and per-group permissions defined at the source are enforced during retrieval. Configuring ACLs in the connector therefore satisfies the stem's requirement to restrict data source access for different user groups.

Why this answer

Amazon Q Business respects access control lists (ACLs) configured in the data source connector, so documents are only surfaced to users who have permission in the source system. When the connector indexes content, it ingests ACL information and enforces it at query time, ensuring each user sees only authorized data. This is the correct mechanism for restricting access to specific data sources per user group.

Exam trap

AIP-C01 often tests whether candidates reach for IAM policies or app separation to solve document-level access, when the correct answer is ACL configuration within the data source connector.

How to eliminate wrong answers

Option A is wrong because creating separate Amazon Q applications per group is operationally heavy and does not leverage the built-in ACL enforcement; it also fragments the experience and increases cost. Option B is wrong because manually deleting documents for specific users is not a supported or scalable access-control mechanism and would corrupt the index. Option D is wrong because IAM policies control access to AWS APIs and the Q application itself, not fine-grained document-level access within a data source.

Practice this question →
29
Multi-Selectmedium

Which TWO of the following actions can help mitigate the risk of 'prompt injection' in a Generative AI application?

Select 2 answers
A.Disable the chat interface
B.Set the temperature to 0.0
C.Use the most powerful foundation model available
D.Sanitize user input before passing it to the model
E.Use Bedrock Guardrails for input filtering
AnswersD, E

Sanitising user input strips or neutralises injected instructions, delimiters and control tokens before they reach the model, directly reducing the attack surface for prompt injection. This input-layer defence satisfies the mitigation requirement by preventing adversarial payloads from being interpreted as trusted system-level commands.

Why this answer

Option D is correct because sanitizing user input before passing it to the model removes or neutralizes embedded instructions, escape characters, and other adversarial payloads that attackers use to hijack the prompt, directly reducing the attack surface for prompt injection. Option E is correct because Amazon Bedrock Guardrails provides configurable input filtering (including denied topics, content filters, and prompt-attack/word filters) that detects and blocks malicious or manipulative prompts before they reach the foundation model, adding a dedicated defense layer against prompt injection. Option A is not correct because disabling the chat interface eliminates the application's functionality rather than mitigating the risk while preserving legitimate use.

Option B is not correct because temperature 0.0 only makes model output more deterministic; it does not prevent an injected instruction from being followed. Option C is not correct because using a more powerful foundation model does not inherently provide prompt-injection protection and may even increase susceptibility to sophisticated adversarial prompts.

Exam trap

The trap is selecting model-level parameters (temperature) or model choice as security mitigations — candidates must recognize that prompt injection is an input validation and policy enforcement problem, not a generation parameter tuning problem.

Practice this question →
30
MCQmedium

You are building a chat application and notice sensitive internal data is leaking in responses. You have enabled Guardrails. What else should be checked?

A.Change the foundation model provider
B.Increase the temperature setting
C.Check if the model is fine-tuned on public data
D.Review the system prompt and the Knowledge Base document retrieval filters
AnswerD

Guardrails filter model outputs, but leakage often originates upstream: the system prompt may instruct the model to reveal internal context, and Knowledge Base retrieval filters may return documents the user should not see. Reviewing both closes the actual data-exposure path.

Why this answer

Guardrails filter model inputs and outputs, but they do not control what data enters the prompt in the first place. If sensitive internal data is leaking, the likely sources are the system prompt (which may contain secrets or instructions that surface data) or the Knowledge Base retrieval filters (which may be returning documents the user should not see). Reviewing both is the correct next step.

Exam trap

AIP-C01 often tests whether candidates treat Guardrails as a complete data-loss-prevention solution — the trap is forgetting that leakage usually originates upstream in the system prompt or retrieval filters, which Guardrails alone cannot fix.

How to eliminate wrong answers

Option A is wrong because changing the foundation model provider does not fix a data-leakage root cause — the same sensitive data would still be retrieved and injected into any model's prompt. Option B is wrong because increasing temperature makes outputs more random and would if anything worsen leakage and reduce reliability. Option C is wrong because whether the base model was fine-tuned on public data is irrelevant to leakage of your internal data — the leak comes from your prompt/retrieval pipeline, not the model's training corpus.

Practice this question →
31
MCQeasy

Which service should be used to provide secure identity and access management for an application accessing Bedrock?

A.AWS Secrets Manager
B.AWS Directory Service
C.Amazon Cognito
D.AWS IAM
AnswerD

AWS IAM supplies the roles, policies and temporary credentials that govern which principals may invoke Bedrock models, giving least-privilege access control. It satisfies the requirement for secure identity and access management for an application calling Bedrock.

Why this answer

AWS IAM is the correct service for providing secure identity and access management for applications accessing Amazon Bedrock. IAM roles and policies define precisely which Bedrock actions (such as InvokeModel, RetrieveAndGenerate) an application or user can perform, and IAM roles can be assumed by compute resources like Lambda functions or EC2 instances to obtain temporary credentials. This is the foundational AWS access control mechanism that Bedrock integrates with natively for authorization.

Exam trap

The trap is conflating authentication (Cognito, Directory Service) with authorization (IAM) — candidates may pick Cognito because it sounds like 'identity,' but Bedrock API access control is fundamentally an IAM authorization concern.

How to eliminate wrong answers

Option A is wrong because AWS Secrets Manager stores and rotates secrets like API keys and database credentials — it does not provide identity or access management for Bedrock API calls. Option B is wrong because AWS Directory Service provides managed Microsoft Active Directory for user directory services, not authorization for AWS API calls to Bedrock. Option C is wrong because Amazon Cognito handles end-user authentication for web and mobile applications (sign-up, sign-in, federation), but it does not authorize application access to Bedrock APIs — Cognito identities still need IAM roles for AWS service access.

Practice this question →
32
Multi-Selectmedium

Which TWO features of Amazon Bedrock provide governance capabilities?

Select 2 answers
A.Amazon Bedrock API Gateway integration
B.Amazon Bedrock Model Pre-training
C.Amazon Bedrock Prompt Management
D.Amazon Bedrock Auto-scaling
E.Amazon Bedrock Guardrails
AnswersC, E

Prompt Management stores, versions and shares prompts with approval workflows, giving teams traceability over what was deployed. This versioning and lifecycle control delivers the governance capability the question requires, distinct from runtime safety filtering or model hosting features.

Why this answer

Amazon Bedrock Guardrails (E) is a governance feature because it lets you define and enforce content filters, denied topics, word filters, and sensitive-information (PII) redaction policies that are applied consistently across foundation models, which directly supports responsible-AI and compliance controls. Amazon Bedrock Prompt Management (C) provides governance by allowing prompts to be versioned, stored, and reused centrally, so teams can track changes, standardize approved prompts, and maintain an auditable lifecycle. The other options do not provide governance: API Gateway integration (A) is an architectural pattern for exposing Bedrock via REST APIs rather than a Bedrock governance capability, Model Pre-training (B) is not a Bedrock feature for customizing models (Bedrock offers fine-tuning and continued pre-training, not full pre-training), and Auto-scaling (D) is an operational capacity concern, not a governance control.

Practice this question →
33
MCQhard

A company requires that every AI-generated document must include a watermark for traceability. How can this be handled in Bedrock?

A.Use fine-tuning to force the model to watermark
B.Use a custom post-processing Lambda function to inject metadata
C.Enable watermarking in the Bedrock console settings
D.Use AWS KMS to sign the generated text
AnswerB

A post-processing Lambda receives Bedrock's generated output and injects watermark metadata before the document is returned, satisfying the traceability requirement. Because Bedrock offers no native watermarking feature, this custom step is the only mechanism that guarantees every AI-generated document carries the required marker.

Why this answer

Bedrock does not natively support watermarking of generated text, so the correct approach is to intercept the model response and apply a custom post-processing step — typically an AWS Lambda function — that injects a watermark, metadata tag, or traceable identifier into the output. This gives the company full control over the watermark format and ensures every generated document carries the required traceability marker.

Exam trap

AIP-C01 often tests the assumption that Bedrock has a built-in watermarking toggle, when in reality watermarking must be implemented in post-processing outside the model.

How to eliminate wrong answers

Option A is wrong because fine-tuning adjusts model weights for behavior/style, not for reliably embedding watermarks — the model cannot be trusted to consistently emit a watermark. Option C is wrong because Bedrock has no console setting for watermarking generated text; no such native feature exists. Option D is wrong because AWS KMS signs data cryptographically but does not embed a visible or traceable watermark into the generated document content.

Practice this question →
34
MCQeasy

A team wants to track who accessed a model and when. Which service provides this audit log?

A.AWS Config
B.Amazon GuardDuty
C.AWS CloudTrail
D.Amazon CloudWatch
AnswerC

AWS CloudTrail records API activity across the account, capturing the identity, source IP and timestamp of each Bedrock InvokeModel call. That event history answers who accessed a model and when, satisfying the audit-log requirement in the stem.

Why this answer

AWS CloudTrail records API activity in an AWS account, including who made a request, when, from which IP, and which resources were affected. For tracking who accessed a model and when, CloudTrail captures the InvokeModel API calls (and related Bedrock API actions) with the identity of the caller. This makes it the correct service for audit logging of model access.

Exam trap

AIP-C01 often tests the confusion between CloudTrail (audit/API activity), CloudWatch (metrics/logs), Config (configuration compliance), and GuardDuty (threat detection), so candidates must match the service to the specific requirement of tracking who did what.

How to eliminate wrong answers

Option A is wrong because AWS Config evaluates resource configurations against desired rules and tracks configuration changes, not API-level access events. Option B is wrong because Amazon GuardDuty is a threat detection service that analyzes logs (including CloudTrail) for malicious activity, but it does not itself provide the raw audit log of who accessed a model. Option D is wrong because Amazon CloudWatch collects metrics, logs, and alarms for operational monitoring, but it does not natively record API caller identity and timestamps as an audit trail.

Practice this question →
35
Multi-Selecthard

Which THREE of the following are components of a robust AI governance framework in an AWS environment?

Select 3 answers
A.Implement Amazon Bedrock Guardrails
B.Provide all users with AdministratorAccess
C.Publicly host the model endpoint
D.Enable Bedrock Model Invocation Logging
E.Use IAM roles with least privilege access
AnswersA, D, E

Amazon Bedrock Guardrails enforce content filtering, denied topics and PII redaction on model inputs and outputs, forming the policy-enforcement layer of an AI governance framework. It directly satisfies the requirement by operationalising responsible-AI controls within AWS.

Why this answer

Option A is correct because Amazon Bedrock Guardrails provides configurable safeguards such as content filters, denied topics, and PII redaction that enforce responsible-AI policies at inference time, which is a core control of an AI governance framework. Option D is correct because Bedrock Model Invocation Logging captures invocation metadata (and optionally full request/response payloads) to CloudWatch Logs or Amazon S3, delivering the auditability and traceability that governance requires. Option E is correct because IAM roles with least-privilege access restrict who and what can invoke models or manage AI resources, satisfying the access-control and segregation-of-duties principles of governance.

Option B does not belong because granting all users AdministratorAccess violates least privilege and destroys accountability. Option C does not belong because publicly hosting a model endpoint exposes it to unauthorized use and data exfiltration, directly undermining governance and security.

Exam trap

AIP-C01 often tests whether candidates equate 'governance' with broad access or public availability — the trap is choosing AdministratorAccess or public endpoints as if they improve manageability, when they actually undermine the control objectives.

Practice this question →
36
MCQeasy

A company is using Amazon Bedrock to build a customer support chatbot and needs to ensure that PII is masked before the request reaches the foundation model. Which feature should the developer implement?

A.AWS KMS with envelope encryption
B.Amazon Macie
C.AWS WAF with custom regex rules
D.Amazon Bedrock Guardrails
AnswerD

Amazon Bedrock Guardrails apply sensitive-information filters that detect and mask PII in prompts before inference, satisfying the requirement that data be redacted prior to reaching the foundation model. Configured via `sensitiveInformationPolicyConfig`, they intercept the request at the service boundary, so the model never receives raw personal data.

Why this answer

Amazon Bedrock Guardrails is the native feature designed to apply safeguards — including PII detection and masking — to prompts and responses before they reach or return from the foundation model. It lets you define sensitive information filters that identify PII (names, emails, SSNs, credit cards) and either block or mask it, satisfying the requirement that PII never reaches the model.

Exam trap

AIP-C01 often tests whether candidates confuse data-at-rest protection (KMS, Macie) with inline prompt-level PII masking — the trap is selecting a storage or network security service when the requirement is to sanitize content before model inference.

How to eliminate wrong answers

Option A is wrong because AWS KMS with envelope encryption protects data at rest and in transit cryptographically, but it does not detect or mask PII within prompt content — the model would still receive the raw PII. Option B is wrong because Amazon Macie is a data discovery and classification service for S3 buckets; it identifies sensitive data in storage, not inline in Bedrock inference requests. Option C is wrong because AWS WAF with regex rules operates at the HTTP layer to block malicious traffic patterns, not to detect and mask semantic PII in natural-language prompts.

Practice this question →
37
MCQmedium

A retail company wants to fine-tune an Amazon Bedrock foundation model on historical customer support transcripts stored in Amazon S3. Legal requires that the training data remain within a specific AWS Region, that only authorized data scientists can start fine-tuning jobs, and that the resulting custom model be usable only by the production application account. Which set of controls best satisfies these requirements?

A.Keep the transcripts in a Region-specific S3 bucket, restrict the CreateModelCustomizationJob action to the data scientist role, and use a Bedrock custom model resource policy or cross-account IAM role to allow only the production account to invoke the model.
B.Encrypt the transcripts with an AWS KMS key, require multi-factor authentication for all Bedrock API calls, and enable model invocation logging to track production usage.
C.Store the transcripts in an S3 bucket in the required Region, grant fine-tuning permissions only to the data scientist role, and share the custom model with the production account using AWS Resource Access Manager.
D.Replicate the transcripts to multiple Regions for durability, allow any IAM principal with BedrockFullAccess to run fine-tuning, and rely on the model's default access settings for production use.
AnswerA

Keeping data in a Region-bound bucket satisfies residency, scoping the customization action to the data scientist role enforces authorization, and a cross-account IAM role or resource policy limits model invocation to the production account. This combination meets all three legal requirements.

Why this answer

Data residency is met by keeping transcripts in an S3 bucket in the required Region, authorization is met by scoping the model customization action to the data scientist role, and model usage is confined to the production account through a cross-account IAM role or Bedrock resource policy. Together these controls align with the legal constraints.

Exam trap

The trap here is assuming that AWS Resource Access Manager can share any AWS resource, when Bedrock custom models are shared through IAM and Bedrock access mechanisms rather than RAM.

Practice this question →
38
MCQmedium

Your organization wants to evaluate the quality and safety of model outputs using a formal testing framework. Which service is designed for this?

A.AWS CloudWatch Synthetics
B.Amazon SageMaker Pipelines
C.AWS CodePipeline
D.Amazon Bedrock Model Evaluation
AnswerD

Amazon Bedrock Model Evaluation provides managed jobs that score foundation model outputs against built-in or custom metrics for quality, safety and robustness. It directly satisfies the requirement for a formal testing framework, unlike ad-hoc prompt testing or general monitoring tools.

Why this answer

Amazon Bedrock Model Evaluation is purpose-built to assess foundation model outputs for quality, accuracy, robustness, and safety (including toxicity and bias) using either automatic metrics or human/LLM-as-judge workflows. It is the only service in the list designed specifically for evaluating generative AI model outputs.

Exam trap

AIP-C01 often tests the confusion between MLOps pipeline services (SageMaker Pipelines, CodePipeline) and purpose-built generative AI evaluation, tempting candidates to pick a familiar CI/CD or ML orchestration tool.

How to eliminate wrong answers

Option A is wrong because CloudWatch Synthetics runs canary scripts to test endpoint availability and UI flows, not to evaluate model output quality or safety. Option B is wrong because SageMaker Pipelines is an MLOps orchestration tool for building, training, and deploying ML workflows — it does not provide built-in model output quality/safety scoring. Option C is wrong because AWS CodePipeline is a CI/CD service for application deployment, unrelated to model evaluation.

Practice this question →
39
MCQeasy

A developer wants to prevent the Generative AI application from producing content related to hate speech or violence. What is the most efficient configuration in Amazon Bedrock?

A.Create a custom fine-tuned model
B.Implement Amazon Bedrock Guardrails with content filters
C.Use AWS Config rules to monitor the model
D.Add a system prompt to the application code
AnswerB

Bedrock Guardrails content filters evaluate prompts and responses against configurable hate, violence, sexual and insult categories, blocking matching content. This satisfies the requirement centrally at the model invocation layer, without custom prompt engineering or separate moderation infrastructure per application.

Why this answer

Amazon Bedrock Guardrails provides configurable content filters that can block hate speech, violence, sexual content, insults, and misconduct, with adjustable strength levels per category. It is the most efficient configuration because it is a managed, no-code policy layer applied at inference time without retraining or modifying the model. Guardrails also supports denied topics, word filters, and PII redaction.

Exam trap

AIP-C01 often tests whether candidates reach for model-level solutions (fine-tuning, system prompts) when the correct answer is a managed policy layer like Guardrails that enforces safety without retraining.

How to eliminate wrong answers

Option A is wrong because fine-tuning a custom model is expensive, time-consuming, and does not reliably prevent harmful outputs — it changes model behavior but does not enforce a policy boundary. Option C is wrong because AWS Config rules monitor resource configuration compliance, not model output content; they cannot inspect or block generated text. Option D is wrong because a system prompt is a soft, easily bypassed instruction — it is not a reliable or auditable content safety control and can be overridden by prompt injection.

Practice this question →

Ready to test yourself?

Try a timed practice session using only AI Safety Security And Governance questions.

Start 20-question session