📘 Free AIP-C01 Sample Questions
A retail company has a generative AI (GenAI) product recommendation application that uses Amazon Bedrock. The
application suggests products to customers based on browsing history and demographics. The company needs to
implement fairness evaluation across multiple demographic groups to detect and measure bias in
recommendations between two prompt approaches. The company wants to collect and monitor fairness metrics in
real time. The company must receive an alert if the fairness metrics show a discrepancy of more than 15% between
demographic groups. The company must receive weekly reports that compare the performance of the two prompt
approaches.
Which solution will meet these requirements with the LEAST custom development effort?
A
Configure an Amazon CloudWatch dashboard to display default metrics from Amazon Bedrock API calls.
Create custom metrics based on model outputs. Set up Amazon EventBridge rules to invoke AWS lambda
functions that perform post-processing analysis on model responses and publish custom fairness metrics.
B
Create the two prompt variants in Amazon Bedrock Prompt Management. Use Amazon Bedrock Flows to
deploy the prompt variants with defined traffic allocation. Configure Amazon Bedrock guardrails that have
content filters to monitor demographic fairness. Set up Amazon CloudWatch alarms on the
GuardrailContentSource dimension that use InvocationsIntervened metrics to detect recommendation
discrepancy threshold violations.
C
Set up Amazon SageMaker Clarify to analyze model outputs. Publish fairness metrics to Amazon
CloudWatch. Create CloudWatch composite alarms that combine SageMaker Clarify bias metrics with Amazon
Bedrock latency metrics to provide a comprehensive fairness evaluation dashboard.
D
Create an Amazon Bedrock model evaluation job to compare fairness between the two prompt variants.
Enable model invocation logging in Amazon CloudWatch. Set up CloudWatch alarms for InvocationsIntervened
metrics with a dimension for each demographic group.
Correct Answer:
C. Set up Amazon SageMaker Clarify to analyze model outputs. Publish fairness metrics to Amazon
CloudWatch. Create CloudWatch composite alarms that combine SageMaker Clarify bias metrics with Amazon
Bedrock latency metrics to provide a comprehensive fairness evaluation dashboard.
Explanation:
C.Set up Amazon SageMaker Clarify to analyze model outputs. Publish fairness metrics to Amazon
CloudWatch. Create CloudWatch composite alarms that combine SageMaker Clarify bias metrics with
Amazon Bedrock latency metrics to provide a comprehensive fairness evaluation dashboard
.Using Amazon SageMaker Clarify is specifically designed for bias detection and fairness evaluation across
demographic groups. It already provides:
Built-in fairness metrics (e.g., disparate impact, bias across groups)
Direct integration with model outputs
Ability to publish metrics to Amazon CloudWatch
Minimal custom logic compared to building your own fairness pipeline
A finance company is developing an Al assistant to help clients plan investments and manage their portfolios. The
company identifies several high-risk conversation patterns such as requests for specific stock recommendations
or guaranteed returns. High-risk conversation patterns could lead to regulatory violations if the company cannot
implement appropriate controls.
The company must ensure that the Al assistant does not provide inappropriate financial advice, generate content about
competitors, or make claims that are not factually grounded in the company's approved financial guidance. The
company wants to use Amazon Bedrock Guardrails to implement a solution.
Which combination of steps will meet these requirements? (Choose three.)
A
Add the high-risk conversation patterns to a denied topics guardrail.
B
Configure a content filter guardrail to filter prompts that contain the high-risk conversation patterns.
C
Configure a content filter guardrail to filter prompts that contain competitor names.
D
Add the names of competitors as custom word filters. Set the input and output actions to block.
E
Set a low grounding score threshold.
F
Set a high grounding score threshold.
Correct Answer:
A. Add the high-risk conversation patterns to a denied topics guardrail.
Explanation:
Justification
Add the high-risk conversation patterns to a denied-topic guardrail (A).
This explicitly tells the model to refuse any input that matches the prohibited financial-advice prompts (e.g.,
“suggest a specific stock to buy” or “guarantee a return”). The deny action prevents the model from ever
generating a response for those patterns, directly addressing the regulatory-risk requirement.
Configure a content-filter guardrail to filter prompts that contain competitor names (D).
By listing competitor names in a custom word filter and setting both input and output actions to block, every
request mentioning a rival brand is intercepted before the model can produce any reference to it. This
protects the company from generating competitive or market-comparative statements that could be
inaccurate or non-compliant.
Set a high grounding-score threshold (F).
A high grounding score (e.g.,=0.9) ensures that any generated answer must be tightly tethered to the
company’s approved financial guidance or known knowledge base. By forcing the model to meet a strict
grounding criterion, only responses grounded in vetted material are allowed to proceed, mitigating
hallucinations and unsupported claims.
Why the other options are less suitable
B (filter prompts for high-risk patterns only) – Insufficient on its own because it does not block competitor
mentions or enforce grounding; the model could still generate competitive content or unsubstantiated advice
if the pattern-matching logic is bypassed.
not address the broader need to enforce grounded, approved responses.
compliant advice.
References
C (filter prompts that contain competitor names) – While useful, it only blocks explicit competitor references
and does not protect against indirect references or advice that indirectly promotes a competitor. It also does
E (set a low grounding-score threshold) – A low threshold would relax the grounding requirement, increasing
the chance of hallucinated or unverified statements, which directly opposes the goal of ensuring fact-based,
G (set a high grounding-score threshold) – The wording “high grounding score threshold” is ambiguous;
without context it could refer to raising the minimum score required, which is essentially the same effect as
optionF. However, by itself it does not solve the competitor-mention issue, nor does it explicitly block
high-risk topics, making it incomplete without the other two actions.
Conclusion
Only the combination ADF simultaneously (1) denies high-risk financial-advice topics, (2) blocks
competitor-related prompts, and (3) enforces a stringent grounding requirement on all remaining outputs,
thereby delivering a compliant, regulator-safe AI assistant.
Amazon Bedrock Guardrails documentation:
https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html
A company has deployed an AI assistant as a React application that uses AWS Amplify, an AWS AppSync GraphQL
API, and Amazon Bedrock Knowledge Bases. The application uses the GraphQL API to call the Amazon Bedrock
RetrieveAndGenerate API for knowledge base interactions. The company configures an AWS Lambda resolver to
use the RequestResponse invocation type.
Application users report frequent timeouts and slow response times. Users report these problems more frequently
for complex questions that require longer processing.
The company needs a solution to fix these performance issues and enhance the user experience.
Which solution will meet these requirements?
A
Use AWS Amplify AI Kit to implement streaming responses from the GraphQL API and to optimize client-side
rendering.
B
. Increase the timeout value of the Lambda resolver. Implement retry logic with exponential backoff.
C
Update the application to send an API request to an Amazon SQS queue. Update the AWS AppSync resolver to poll and process the queue.
D
. Change the RetrieveAndGenerate API to the InvokeModelWithResponseStream API. Update the application
to use an Amazon API Gateway WebSocket API to support the streaming response.
Correct Answer:
A. Use AWS Amplify AI Kit to implement streaming responses from the GraphQL API and to optimize client-side
rendering.
Explanation:
Solution justification
OptionA – Adopt AWS Amplify AI Kit with streaming responses
Amplify AIKit provides built-in support for streaming GraphQL responses, allowing the client to receive partial
results as they are generated. This reduces perceived latency for complex queries that involve
RetrieveAndGenerate calls.
for the entire response, which directly mitigates timeout and slowdown experiences.
long-running RetrieveAndGenerate calls.
cost and may hit other limits (e.g., memory).
response speed for real-time user interactions.
Streaming enables the front-end to render UI updates incrementally (e.g., token-by-token) instead of waiting
No changes to the existing Lambda or GraphQL resolver are required, preserving existing security models and
simplifying deployment.
OptionB – Raise Lambda timeout
Only prolongs the maximum allowed execution time; it does not address the underlying bottleneck caused by
If the knowledge-base retrieval exceeds the new timeout, the request still fails, and increased timeouts raise
Adding retry logic with exponential back-off can increase load on downstream services without improving
OptionC – Route through SQS and poll
Introduces asynchronous decoupling but shifts the latency problem to polling intervals and message-queue
processing, which adds complexity and does not provide immediate feedback to the UI.
Polling can increase overall system latency for users and requires additional orchestration logic in the
AppSync resolver, contrary to the goal of enhancing interactive UI responsiveness.
OptionD – Switch to InvokeModelWithResponseStream and use APIGateway WebSocket
While streaming the model response is beneficial, implementing a WebSocket endpoint adds significant
architectural overhead (authentication, connection management, client-side hand-off) that is unnecessary
when Amplify AIKit already supplies a streaming GraphQL interface.
This option requires major code rewrites and introduces extra infrastructure, making it less optimal compared
with the incremental solution offered by Amplify AI Kit.
Conclusion – OptionA directly tackles the user-perceived latency through built-in streaming support and
incremental rendering, making it the most appropriate answer.
References
https://docs.aws.amazon.com/amplify/latest/userguide/ai-kit-streaming.html
https://docs.aws.amazon.com/bedrock/latest/userguide/runtime-apis.html#retrieve-and-generate-streaming
An ecommerce company operates a global product recommendation system that needs to switch between
multiple foundation models (FM) in Amazon Bedrock based on regulations, cost optimization, and performance
requirements. The company must apply custom controls based on proprietary business logic, including dynamic
cost thresholds, AWS Region-specific compliance rules, and real-time A/B testing across multiple FMs. The
system must be able to switch between FMs without deploying new code. The system must route user requests
based on complex rules including user tier, transaction value, regulatory zone, and real-time cost metrics that
change hourly and require immediate propagation across thousands of concurrent requests.
Which solution will meet these requirements?
A
Deploy an AWS Lambda function that uses environment variables to store routing rules and Amazon Bedrock
FM IDs. Use the Lambda console to update the environment variables when business requirements change.
Configure an Amazon API Gateway REST API to read request parameters to make routing decisions.
B
Deploy Amazon API Gateway REST API request transformation templates to implement routing logic based
on request attributes. Store Amazon Bedrock FM endpoints as REST API stage variables. Update the variables
when the system switches between models.
C
Configure an AWS Lambda function to fetch routing configurations from the AWS AppConfig Agent for each
user request. Run business logic in the Lambda function to select the appropriate FM for each request. Expose
the FM through a single Amazon API Gateway REST API endpoint.
D
Use AWS Lambda authorizers for an Amazon API Gateway REST API to evaluate routing rules that are stored
in AWS AppConfig. Return authorization contexts based on business logic. Route requests to model-specific
Lambda functions for each Amazon Bedrock FM.
Correct Answer:
C. Configure an AWS Lambda function to fetch routing configurations from the AWS AppConfig Agent for each
user request. Run business logic in the Lambda function to select the appropriate FM for each request. Expose
the FM through a single Amazon API Gateway REST API endpoint.
Explanation:
Why option C is the optimal choice
Dynamic, per-request configuration – The Lambda function pulls its routing rules from AWSAppConfig using
the AppConfig Agent. This means the configuration can be updated in real time (e.g., new cost thresholds,
compliance zones) and the change is instantly visible to every concurrent request without redeploying code or
restarting services.
Single entry point – All incoming requests are funneled through one Amazon API Gateway REST API
endpoint. The Lambda inspects the request attributes (user tier, transaction value, region, etc.), evaluates the
current AppConfig payload, and forwards the request to the appropriate Bedrock foundation model. This
satisfies the “no-code redeploy” requirement and simplifies API management.
Why the other options fall short
Scalable and low-latency routing – AppConfig delivers configuration via a push-based model to the Lambda
runtime, ensuring that thousands of simultaneous requests receive the latest rules with minimal overhead.
Lambda’s built-in concurrency handles the traffic spikes typical of an ecommerce recommendation engine.
Option A relies on Lambda environment variables to store routing information. Environment variables are
immutable at deployment time; updating them requires a new deployment or a configuration-change Lambda,
which cannot meet the “immediate propagation” and “real-time hourly changes” demands. Limits on variable
size and the lack of a push-based update mechanism make this approach unsuitable for high-velocity rule
changes.
Option B uses APIGateway request-transformation templates and stage variables for routing. Stage variables
are static per stage and cannot be altered on a per-request basis; they require a new deployment to change
routing logic. This prevents the rapid, granular adjustments needed for regulatory or cost-based switches.
Option D applies Lambda authorizers to evaluate routing rules stored in AppConfig, then routes to
model-specific Lambda functions. While authorizers can read AppConfig, they are primarily designed for
authentication/authorization, not for business-logic routing. Maintaining separate Lambda functions per
model introduces additional cold-start latency, operational complexity, and does not provide a single unified
endpoint, making it less efficient for a globally-scaled recommendation system.
Conclusion – Option C delivers a single, highly-scalable API gateway endpoint that dynamically routes each
References
request to the appropriate Bedrock foundation model based on continuously refreshed configuration from
AppConfig, directly addressing the regulatory, cost-optimization, and real-time A/B-testing requirements.
AWSAppConfig – Configurations that can be pushed to applications
https://docs.aws.amazon.com/appconfig/latest/userguide/intro.html
AWS Lambda – Invocation model and configuration management
https://docs.aws.amazon.com/lambda/latest/dg/invocation-requirements.html
A company is developing an internal generative AI (GenAI) assistant that uses Amazon Bedrock to summarize
corporate documents for multiple business units. The GenAI assistant must generate responses in a consistent
format that includes a document summary, classification of business risks, and terms that are flagged for review.
The GenAI assistant must adapt the tone of responses for each user's business unit, such as legal, human
resources, or finance. The GenAI assistant must block hate speech, inappropriate topics, and sensitive information
such as personal health information.
The company needs a solution to centrally manage prompt variants across business units and teams. The company
wants to minimize ongoing orchestration efforts and maintenance for post-processing logic. The company also
wants to have the ability to adjust content moderation criteria for the GenAI assistant over time.
Which solution will meet these requirements with the LEAST maintenance overhead?
A
Use Amazon Bedrock Prompt Management to configure reusable templates and business unit-specific
prompt variants. Apply Amazon Bedrock guardrails that have category filters and sensitive term lists to block
prohibited content.
tuning. Manage the guardrails by using an internal administration API.
content filters after the GenAI assistant generates responses.
B
Use Amazon Bedrock Prompt Management to define base templates. Enforce business unit-specific tone by
using system prompt variables. Configure Amazon Bedrock guardrails to apply audience-based threshold
C
Use Amazon Bedrock with business unit-based instruction injection in API calls. Store response formatting
rules in Amazon DynamoDB. Use AWS Step functions to validate responses. Use Amazon Comprehend to apply
D
Use Amazon Bedrock with custom prompt templates that are stored in Amazon DynamoDB. Create one AWS Lambda function to select business unit-specific prompts. Create a second Lambda function to call Amazon Comprehend to filter prohibited content from responses.
Correct Answer:
D. Use Amazon Bedrock with custom prompt templates that are stored in Amazon DynamoDB. Create one AWS Lambda function to select business unit-specific prompts. Create a second Lambda function to call Amazon Comprehend to filter prohibited content from responses.
Explanation:
Why option A is the best fit
Centralised prompt management – Amazon Bedrock Prompt Management lets you store reusable base
templates and create business-unit-specific variants in a single catalogue, eliminating the need to maintain
separate artefact stores.
Integrated guardrails – Built-in guardrails provide category filters (e.g., Hate Speech, PII) and allow you to
adjust moderation thresholds centrally; no additional post-processing services are required.
Minimal orchestration – All control-plane functions (template selection, variant injection, guardrail activation)
are handled by Bedrock itself, so there is no extra workflow engine, Lambda code, or DynamoDB tables to
operate and monitor.
Low ops overhead – Changes to tone or moderation rules are applied by updating the prompt or guardrail
configuration, which is a single-click operation in the AWS console or API, reducing ongoing maintenance effort.
Why the other options are less suitable
Option B requires an internal administration API to manage guardrails, adding custom development and
operational burden; the API must be built, secured, and kept in sync with guardrail changes.
Option C introduces Step Functions and Amazon Comprehend as separate services for response validation
and filtering, creating extra orchestration layers and latency while increasing the number of components to
monitor.
References
Option D relies on custom Lambda functions and DynamoDB storage to drive prompt selection and content
filtering; this spreads the logic across multiple services, demanding more code, testing, and infrastructure
maintenance.
Amazon Bedrock Prompt Management: https://docs.aws.amazon.com/bedrock/latest/userguide/prompt
management.html
Amazon Bedrock Guardrails (content filtering):
https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html
A financial services company is building a customer support application that retrieves relevant financial regulation
documents from a database based on semantic similarities to user queries. The application must integrate with
Amazon Bedrock to generate responses. The application must be able to search documents that are in English,
Spanish, and Portuguese. The application must filter documents by metadata such as publication date, regulatory
agency, and document type.
The database stores approximately 10 million document embeddings. To minimize operational overhead, the
company wants a solution that minimizes management and maintenance effort. The application must provide low
latency responses for real-time customer interactions.
Which solution will meet these requirements?
A
Use Amazon OpenSearch Serverless to provide vector search capabilities and metadata filtering. Connect to
Amazon Bedrock Knowledge Bases to enable Retrieval Augmented Generation (RAG) capabilities that use an
Anthropic Claude foundation model (FM).
generate responses.
B
Deploy an Amazon Aurora PostgreSQL database with the pgvector extension. Define tables to store
embeddings and metadata. Use SQL queries to perform similarity searches. Send retrieved documents to
Amazon Bedrock to generate responses.
C
Use Amazon S3 Vectors to configure a vector index and non-filterable metadata fields. Integrate S3 Vectors
with Amazon Bedrock to enable Retrieval Augmented Generation (RAG) capabilities.
D
Set up an Amazon Neptune Analytics graph database. Configure a vector index that has appropriate
dimensionality to store document embeddings. Use Amazon Bedrock to perform graph-based retrieval and togenerate responses.
Correct Answer:
A. Use Amazon OpenSearch Serverless to provide vector search capabilities and metadata filtering. Connect to
Amazon Bedrock Knowledge Bases to enable Retrieval Augmented Generation (RAG) capabilities that use an
Anthropic Claude foundation model (FM).
generate responses.
Explanation:
Justification
Option A is the only solution that simultaneously delivers high-performance vector search with rich
metadata filtering, low-latency retrieval, and a fully managed, low-overhead service.
Amazon OpenSearch Serverless automatically scales vector indexes to store the ~10million embeddings and
supports filtered queries on metadata (publication date, regulatory agency, document type).
It integrates natively with Amazon Bedrock Knowledge Bases, enabling Retrieval-Augmented Generation
(RAG) where the retrieved documents are passed to an Anthropic Claude FM for question generation without
additional infrastructure.
As a serverless offering, OpenSearch Serverless eliminates the need for cluster provisioning, patching, or
capacity planning, directly satisfying the requirement for minimal operational overhead.
Vector search in OpenSearch is optimized for low-latency responses, aligning with the real-time
customer-interaction latency target.
Option B requires operational management of an Amazon Aurora PostgreSQL cluster and custom SQL-based
similarity logic. While it can store embeddings and metadata, the need to maintain the database, tune index
parameters, and orchestrate the pipeline adds significant overhead. Moreover, Aurora does not provide
built-in vector acceleration comparable to dedicated vector engines, resulting in potentially higher latency.
retrieval.
Conclusion
Bedrock connectivity.
References
Option C uses Amazon S3 Vectors, which is currently limited to non-filterable metadata and lacks native
integration with Bedrock Knowledge Bases for RAG. The inability to filter on regulatory metadata makes it
unsuitable for the described use case, and S3 Vectors offers no managed query engine for low-latency
Option D relies on Amazon Neptune Analytics, which is primarily a graph-analytics service. Although it can
store vectors, Neptune is not optimized for large-scale vector similarity searches nor for metadata filtering in
the same way as OpenSearch. Setting up a graph-based retrieval workflow would introduce extra complexity
and does not guarantee the low-latency behavior required for real-time customer interactions.
Option A best meets all functional requirements—semantic search across three languages, metadata
filtering, low-latency RAG integration with Bedrock, and minimal operational maintenance—by leveraging a
fully managed vector search service that directly supports the necessary filtering capabilities and seamless
Amazon OpenSearch Serverless – Vector Search and Filters: https://docs.aws.amazon.com/opensearch
serverless/latest/developerguide/vectors.html
Amazon Bedrock Knowledge Bases – Retrieval-Augmented Generation:
https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-bases.html
A medical company is building a generative Al (GenAl) application that uses RAG to provide evidence-based
medical information. The application uses Amazon OpenSearch Service to retrieve vector embeddings. Users
report that searches frequently miss results that contain exact medical terms and acronyms and return too many
semantically similar but irrelevant documents. The company needs to improve retrieval quality and maintain low
end user latency, even as the document collection grows to millions of documents.
Which solution will meet these requirements with the LEAST operational overhead?
A
Configure hybrid search by combining vector similarity with keyword matching to improve semantic
understanding and exact term and acronym matching.
B
Increase the dimensions of the vector embeddings from 384 to 1536. Use a post-processing AWS Lambda
function to filter out irrelevant results after retrieval.
C
Replace OpenSearch Service with Amazon Kendra. Use query expansion to handle medical acronyms and
terminology variants during pre-processing.
D
Implement a two-stage retrieval architecture in which initial vector search results are re-ranked by an ML
model that is hosted on Amazon SageMaker Al.
Correct Answer:
A. Configure hybrid search by combining vector similarity with keyword matching to improve semantic
understanding and exact term and acronym matching.
Explanation:
Why optionA is correct
OpenSearchService already supports hybrid queries that combine vector (semantic) similarity with classic
keyword (exact term) matching.
By adding a keyword clause for medical terms and acronyms, the system can retrieve documents that contain
the precise token while still ranking semantically relevant results higher.
Hybrid search improves precision for medical vocabularies without altering the underlying embedding model
or requiring additional compute resources, keeping latency low even as the index scales to millions of
documents.
It leverages existing OpenSearch capabilities, so the operational overhead is minimal—no new services to
manage, no model training, and no extra data pipelines.
Why the other options are less suitable
step, increasing end-to-end latency and operational complexity.
References
OptionB: Increasing embedding dimensionality expands index size and memory consumption, leading to
higher storage cost and longer index rebuild times. A post-processing Lambda adds another asynchronous
OptionC: Replacing OpenSearch with AmazonKendra introduces a migration effort, new service quotas, and a
different query model. Kendra’s built-in query-expansion is limited for custom medical terminology and does
not integrate with your existing vector pipeline, adding substantial operational overhead.
OptionD: A two-stage re-ranking workflow requires hosting an ML model on SageMaker, managing model
updates, scaling endpoints, and incurring additional inference latency. This approach adds significant
operational burden compared to the built-in hybrid search feature.
OpenSearch hybrid search documentation: https://docs.aws.amazon.com/opensearch
service/latest/developerguide/hybrid-search.html
Keyword and term queries in OpenSearch: https://opensearch.org/docs/latest/query-dsl/keyword-search/
A company runs a generative Al (GenAl)-powered summarization application in an application AWS account that
uses Amazon Bedrock. The application architecture includes an Amazon API Gateway REST API that forwards
requests to AWS Lambda functions that are attached to private VPC subnets. The application summarizes
sensitive customer records that the company stores in a governed data lake in a centralized data storage account.
The company has enabled Amazon S3, Amazon Athena, and AWS Glue in the data storage account.
The company must ensure that calls that the application makes to Amazon Bedrock use only private connectivity
between the company's application VPC and Amazon Bedrock. The company's data lake must provide fine-grained
column-level access across the company's AWS accounts.
Which solution will meet these requirements?
A
In the application account, create interface VPC endpoints for Amazon Bedrock runtimes. Run Lambda
functions in private subnets. Use IAM conditions on inference and data-plane policies to allow calls only to
approved endpoints and roles. In the data storage account, use AWS Lake Formation LF-tag-based access
control to create table and column-level cross-account grants.
B
Run Lambda functions in private subnets. Configure a NAT gateway to provide access to Amazon Bedrock
and the data lake. Use S3 bucket policies and ACLs to manage permissions. Export AWS CloudTrail logs to
Amazon S3 to perform weekly reviews.
C
Create a gateway endpoint only for Amazon S3 in the application account. Invoke Amazon Bedrock through
public endpoints. Use database-level grants in AWS Lake Formation to manage data access. Stream AWS
CloudTrail logs to Amazon CloudWatch Logs. Do not set up metric filters or alarms.
D
Use VPC endpoints to provide access to Amazon Bedrock and Amazon S3 in the application account. Use only
IAM path-based policies to manage data lake access. Send AWS CloudTrail logs to Amazon CloudWatch Logs.
Periodically create dashboards and allow public fallback for cross-Region reads to reduce setup time.
Correct Answer:
A. In the application account, create interface VPC endpoints for Amazon Bedrock runtimes. Run Lambda
functions in private subnets. Use IAM conditions on inference and data-plane policies to allow calls only to
approved endpoints and roles. In the data storage account, use AWS Lake Formation LF-tag-based access
control to create table and column-level cross-account grants.
Explanation:
Why optionA is the only solution that satisfies all requirements
Private connectivity to Amazon Bedrock – Creates interface VPC endpoints in the application account,
ensuring all Bedrock API calls stay inside the VPC and never traverse the public internet. Lambda functions
can invoke Bedrock through these endpoints while remaining in private subnets.
Fine-grained column-level access across accounts – Leverages AWS Lake Formation with LF-tag-based
access control. Tags can be attached to columns (e.g., pii, financial) and policies can grant or deny access on a
per-tag basis, enabling cross-account, column-level permissions without broad S3 bucket policies.
Secure data-lake integration – By using Lake Formation tags together with IAM conditions on inference and
data-plane operations, the solution enforces that only approved roles and validated requests can read/write
governed tables, satisfying the govern-ance requirement.
Least-privilege networking – Lambda runs in private subnets with no NAT or Internet-gateway exposure;
traffic to Bedrock and S3 stays within the VPC.
Auditability – IAM conditions can be tied to CloudTrail logging; no additional routing (NAT) is needed, keeping
the architecture simple and compliant.
Why the alternative options fail
column-level confidentiality across accounts.
Conclusion
secure, auditable manner.
References
OptionB routes Bedrock traffic through a NAT gateway and keeps the service publicly reachable, violating
the “private connectivity only” mandate. It also relies on S3 bucket policies and ACLs, which cannot enforce
OptionC uses only a gateway endpoint for S3 and accesses Bedrock through public endpoints, directly
contradicting the private-connectivity requirement. It applies coarse-grained database-level grants instead of
the needed column-level controls and lacks any enforcement of secure cross-account access.
OptionD proposes IAM path-based policies for data-lake access, which are insufficient for fine-grained
column permissions and do not integrate with Lake Formation’s tag-based model. It also suggests allowing
public fallback for cross-Region reads, compromising data security and governance.
OptionA uniquely combines private VPC endpoints for Bedrock, Lambda execution in private subnets, and
Lake Formation LF-tag governance to meet both the connectivity and fine-grained access requirements in a
Amazon VPC Endpoints for Amazon Bedrock –
https://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-vpc-endpoints.html
Lake Formation LF-Tag-Based Access Control – https://docs.aws.amazon.com/lakeformation/latest/dg/ lgfed
access-control.html
A media company must use Amazon Bedrock to implement a robust governance process for AI-generated content.
The company needs to manage hundreds of prompt templates. Multiple teams use the templates across multiple
AWS Regions to generate content. The solution must provide version control with approval workflows that include
notifications for pending reviews. The solution must also provide detailed audit trails that document prompt
activities and consistent prompt parameterization to enforce quality standards.
Which solution will meet these requirements?
A
Configure Amazon Bedrock Studio prompt templates. Use Amazon CloudWatch to create dashboards that
display prompt usage metrics. Store the approval status of content in Amazon DynamoDB. Use AWS Lambda
functions to enforce approvals.
B
Use Amazon Bedrock Prompt Management to implement version control. Configure AWS CloudTrail for audit
logging. Use IAM policies to control approval permissions. Create parameterized prompt templates by
specifying variables.
C
Use AWS Step Functions to create an approval workflow. Store prompts as documents in Amazon S3. Use tags to implement version control. Use Amazon EventBridge to send notifications.
D
Deploy Amazon SageMaker Canvas with prompt templates that are stored in Amazon S3. Use AWS
CloudFormation to implement version control. Use AWS Config to enforce approval policies.
Correct Answer:
B. Use Amazon Bedrock Prompt Management to implement version control. Configure AWS CloudTrail for audit
logging. Use IAM policies to control approval permissions. Create parameterized prompt templates by
specifying variables.
Explanation:
Why optionB is the optimal choice
Prompt version control & approval workflow – Amazon BedrockPrompt Management directly supports
versioned prompt libraries, change histories, and mandatory approval gates, which satisfies the requirement
to manage hundreds of templates across teams and regions.
Auditability – CloudTrail records every call to Bedrock services (including prompt creation, update, and
execution), giving an immutable trail that can be analyzed for compliance and forensic purposes.
Permission enforcement – IAM policies can be scoped to specific prompt versions or tags, allowing
fine-grained control over who may edit, approve, or publish prompts, ensuring that only vetted content
proceeds to generation.
Parameter-driven templates – By defining placeholders (e.g., $ region , $ tone ) within Bedrock prompts,
teams can reuse the same logical structure while supplying region-specific or team-specific variables,
guaranteeing consistent parameterization and quality standards.
Scalable multi-region deployment – Bedrock is a regional service; prompts managed in one region are
automatically replicated or can be shared via cross-region configuration, meeting the distributed usage
pattern without additional glue code.
Why the alternative options fall short
Bedrock’s native capabilities.
References
OptionA relies on CloudWatch metrics and DynamoDB to store approval status. While functional, it does not
provide native prompt versioning or built-in approval workflows; implementing those would require custom
Lambda orchestration, increasing operational complexity and reducing audit granularity compared with
OptionC uses Step Functions for approval sequencing and S3 for storage. This approach can enforce
workflows but lacks a purpose-built prompt-versioning schema and does not integrate tightly with Bedrock’s
prompt-parameter system, resulting in fragmented governance and weaker audit trails.
OptionD involves SageMaker Canvas, which is oriented toward low-code data science rather than prompt
lifecycle management. CloudFormation versioning and AWS Config are not designed for fine-grained prompt
approvals, leading to over-provisioned resources and limited support for multi-region prompt sharing.
Amazon BedrockPrompt Management: https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-
AWS CloudTrail Logging for Bedrock: https://docs.aws.amazon.com/bedrock/latest/userguide/cloudtrai
A company is developing a customer support application that uses Amazon Bedrock foundation models (FMs) to
provide real-time AI assistance to the company's employees. The application must display AI-generated responses
character by character as the responses are generated. The application needs to support thousands of concurrent
users with minimal latency. The responses typically take 15 to 45 seconds to finish.
Which solution will meet these requirements?
A
Configure an Amazon API Gateway WebSocket API with an AWS Lambda integration. Configure the
WebSocket API to invoke the Amazon Bedrock InvokeModelWithResponseStream API and stream partial
responses through WebSocket connections.
B
Configure an Amazon API Gateway REST API with an AWS Lambda integration. Configure the REST API to
invoke the Amazon Bedrock standard InvokeModel API and implement frontend client-side polling every 100 ms
for complete response chunks.
C
Implement direct frontend client connections to Amazon Bedrock by using IAM user credentials and the
InvokeModelWithResponseStream API without any intermediate gateway or proxy layer.
D
Configure an Amazon API Gateway HTTP API with an AWS Lambda integration. Configure the HTTP API to
cache complete responses in an Amazon DynamoDB table and serve the responses through multiple paginated GET requests to frontend clients.
Correct Answer:
A. Configure an Amazon API Gateway WebSocket API with an AWS Lambda integration. Configure the
WebSocket API to invoke the Amazon Bedrock InvokeModelWithResponseStream API and stream partial
responses through WebSocket connections.
Explanation:
Why optionA is the optimal solution
WebSocket streaming delivers data to the client as soon as it is generated, eliminating the need for periodic
polling and reducing round-trip latency to near-zero. This matches the requirement for
client logic from the model endpoint.
simultaneous users with minimal operational overhead.
request processing and stream handling.
Why the other options fall short
“character-by-character” display and sub-second response times.
InvokeModelWithResponseStream is purpose-built for low-latency, incremental output from Bedrock
models; integrating it directly through a WebSocket API preserves the streaming semantics while decoupling
AWS Lambda scales automatically to thousands of concurrent connections, handling connection
management, authentication, and back-pressure without provisioning servers.
API Gateway WebSocket can broadcast messages to many connected clients, supporting thousands of
quotas or monitor concurrent streams.
The architecture isolates compute (Lambda) from storage and networking, allowing independent scaling of
OptionB (REST+polling) introduces fixed 100ms client-side intervals, adding artificial latency and increasing
load on both client and backend; it cannot guarantee true real-time character streaming.
OptionC (direct IAM-authenticated connections) bypasses API Gateway’s scaling, throttling, and
authorisation controls, exposing Bedrock to unmanaged client traffic and making it difficult to enforce usage
OptionD (HTTP API + DynamoDB caching + pagination) stores full responses rather than streaming
incremental text, requiring pagination that introduces additional latency and complexity; it does not provide
the character-by-character experience needed.
References
https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api.html
Bedrock InvokeModelWithResponseStream–https://docs.aws.amazon.com/bedrock/latest/userguide/invoke
models-streaming.html
Questions: 1-10 out of 97
Continue Full Practice..
GET ALL 97 QUESTIONS