Question 1

An e-commerce company uses an Amazon Bedrock Agent to handle product returns. The agent has access to two tools: GetOrderDetails and ProcessRefund.During testing, the agent fails to process refunds for orders older than 30 days. Instead of calling the ProcessRefund tool, the agent simply apologizes to the user.The developer suspects the agent is correctly identifying the return policy date limit but needs to verify the specific logic used by the agent to reach this decision.Which troubleshooting step provides the necessary visibility?

Options :

A : Check CloudWatch Metrics. Look at the Invocations and Errors metrics for the ProcessRefund Lambda function. If the count is zero, it confirms the tool was never called.

B : Review CloudTrail Logs. Search for the InvokeModel events. Download the raw request payload to see if the system prompt includes the "30-day return policy" instruction.

C : Analyze the Agent Trace. Invoke the agent with enableTrace=true. Inspect the orchestrationTrace to view the "Observation" step where the agent received the order date from GetOrderDetails and the subsequent "Rationale" step where it reasoned that the date exceeded the 30-day policy.

D : Use Amazon Bedrock Model Evaluation. Run an evaluation job using the "Tool Usage Accuracy" metric to see a statistical percentage of how often the agent fails to call the tool.

Answer: C

Question 2

A smart-home device manufacturer wants to use a Large Language Model (LLM) to identify usage trends from millions of daily device logs. Each log contains a specific device ID, the user's exact GPS coordinates, and a timestamped list of voice commands. Privacy regulations require that the manufacturer must not share granular location data or linkable user IDs with the analytics model, but the model still needs to understand regional usage patterns (e.g., "users in Northern Europe use heating more often").Which data pipeline architecture effectively prepares this data for the model while maintaining regulatory compliance?

Options :

A : Ingest the raw logs into an Amazon S3 bucket and use Amazon Athena to create a view that filters out columns containing Device IDs. Point the foundation model to the S3 bucket backing the Athena view and trust the model's system prompt to ignore any remaining location data.

B : Store the raw logs in Amazon S3 and enable S3 Object Lock in compliance mode to prevent modification. Use Amazon SageMaker Data Wrangler to feed the raw data directly into the model for fine-tuning, ensuring that the training job is run within a VPC without internet access.

C : Create an AWS Lambda function that hashes the Device ID and generalizes the GPS coordinates to a city or region level. Write these transformed logs to a separate "Analytics" S3 bucket and grant the foundation model access only to this secondary bucket for ingestion.

D : Implement a sidecar container in the ingestion pipeline that encrypts the GPS coordinates using asymmetric encryption. Pass the encrypted logs to the foundation model and provide the private key only within the RAG retrieval logic so the model can decrypt locations on-the-fly for regional analysis.

Answer: C

Question 3

A company has a centralized AI team managing Bedrock models in Account A. Three development teams in Accounts B, C, and D need access to a specific Claude Sonnet model with provisioned throughput for their applications. The solution must ensure that these accounts can ONLY invoke this specific model and cannot access any other Bedrock models or features in Account A. The solution must also allow the central AI team to monitor usage and apply guardrails centrally without requiring changes in the development accounts.Which solution meets ALL these requirements?

Options :

A : Enable Bedrock model access in Accounts B, C, and D. Use AWS Organizations service control policies (SCPs) to deny access to all Bedrock models except the Claude Sonnet model. Configure each account to invoke the model directly using their own IAM permissions.

B : Create a cross-region inference profile for the Claude Sonnet model in Account A. Share the inference profile ARN with Accounts B, C, and D. Create IAM roles in each development account with permissions to bedrock:InvokeModel on the specific inference profile ARN only.

C : Create IAM roles in Account A that trust Accounts B, C, and D. Grant these roles permissions to bedrock:InvokeModel with a resource condition limiting access to the specific Claude Sonnet model ARN. Configure applications in development accounts to assume these roles.

D : Create a cross-account inference profile for the Claude Sonnet model in Account A. Use AWS RAM (Resource Access Manager) to share the inference profile with Accounts B, C, and D. Create resource-based policies on the inference profile that allow bedrock:InvokeModel action only from the specified account principals.

Answer: D

Question 4

A development team is building a serverless application where AWS Lambda functions need to invoke Amazon Bedrock foundation models to generate product descriptions. The security team requires that the Lambda functions follow the principle of least privilege when accessing AWS services.Which approach should the developer implement to grant the Lambda function access to Amazon Bedrock?

Options :

A : Embed AWS access keys and secret keys as environment variables in the Lambda function configuration

B : Grant the Lambda function's IAM role full Administrator access to ensure it can call all AWS services

C : Attach an IAM role to the Lambda function with the bedrock:InvokeModel permission for the specific models being used

D : Store IAM credentials in the Lambda function code and rotate them manually every 90 days

Answer: C

Question 5

An online gaming platform is launching a GenAI-powered support assistant using multiple Foundation Models (FMs) available in Amazon Bedrock (including Amazon Titan and Anthropic Claude). The security team has issued strict requirements for the assistant's input handling:PII Protection: Users must be prevented from submitting email addresses or phone numbers.Toxicity: Hate speech and insults must be blocked immediately.Custom Blocking: A specific list of known "cheat codes" and "exploit keywords" must be blocked from entering the model context.Consistency: These rules must apply uniformly across all used FMs without rewriting application logic for each model.Which solution should you implement to meet these requirements with the LEAST operational overhead?

Options :

A : Develop a pre-processing AWS Lambda function using the Python re library to detect PII patterns and cheat codes. Use Amazon Comprehend DetectSentiment API to identify hate speech. Configure the application to call this Lambda function and verify the result before calling InvokeModel on Amazon Bedrock.

B : Implement a standardized system prompt across all FMs that instructs the models to refuse to answer if the input contains emails, phone numbers, hate speech, or words from the cheat code list. Use the Amazon Bedrock Converse API to ensure the system prompt is strictly enforced by the model’s reasoning engine.

C : Use AWS WAF (Web Application Firewall) attached to the application load balancer handling the chat traffic. Create custom regex rules to block PII patterns and cheat codes. Enable the AWS Managed Rules for Anonymous IP List to reduce toxicity risks from bad actors.

D : Create an Amazon Bedrock Guardrail. Configure PII filters to block emails and phone numbers, and enable Content filters for hate speech. Use the Word filters feature to upload the list of cheat codes and exploit keywords. Associate the Guardrail with the InvokeModel API calls for all used FMs.

Answer: D

Free AIP-C01 Mock Exam – Practice Online Confidently

Buying Options: