Amazon AWS Certified AI Practitioner AIF-C01 Practice Test 102

Question 1010

The online retail team assesses Amazon CloudWatch monitoring as part of an effort to observe model-backed application errors, latency and operating metrics. Which important boundary still applies?

  1. Operational telemetry is not a replacement for AWS API audit history.
  2. An unstructured screenshot alone is not a complete tamper-resistant activity record.
  3. Placing raw web content into a model prompt does not make it a trusted command.
  4. It does not score whether an FM response is factually grounded.

Explanation

Correct Answer

A:

An online retail rollout should account for this boundary: operational telemetry is not a replacement for AWS API audit history. The chosen approach works because CloudWatch collects metrics and operational logs for supported services and applications, but it is not evidence that every circumstance arising when trying to observe model-backed application errors, latency and operating metrics has been addressed.

Incorrect Answers

B:

In the online retail review, this qualification belongs to Prompt and response audit trail, which serves a different need to reconstruct which AI request and authorized tool call caused a disputed action; it should not be confused with the restriction on Amazon CloudWatch monitoring when attempting to observe model-backed application errors, latency and operating metrics, namely that operational telemetry is not a replacement for AWS API audit history.

C:

In the online retail review, this qualification belongs to Prompt injection defense, which serves a different need to keep a retrieved page from issuing unauthorized instructions to an assistant; it should not be confused with the restriction on Amazon CloudWatch monitoring when attempting to observe model-backed application errors, latency and operating metrics, namely that operational telemetry is not a replacement for AWS API audit history.

D:

In the online retail review, this qualification belongs to Amazon Inspector, which serves a different need to assess supported workloads for software vulnerabilities and exposure; it should not be confused with the restriction on Amazon CloudWatch monitoring when attempting to observe model-backed application errors, latency and operating metrics, namely that operational telemetry is not a replacement for AWS API audit history.

Question 1011

A banking operations design discussion focuses on Dataset lineage and a requirement to explain which source and transformation produced a feature used in evaluation. Which caveat is specifically tied to this idea?

  1. Matching hashes alone do not determine the trustworthiness or legality of the data.
  2. Retrieving a passage does not assure that every sentence in the response is correct.
  3. A self-reported confidence number needs calibration and does not prove accuracy.
  4. A dataset filename is insufficient evidence of origin and transformation history.

Explanation

Correct Answer

D:

A banking operations rollout should account for this boundary: a dataset filename is insufficient evidence of origin and transformation history. The chosen approach works because lineage records the path from original data through processing to model use, but it is not evidence that every circumstance arising when trying to explain which source and transformation produced a feature used in evaluation has been addressed.

Incorrect Answers

A:

In the banking operations review, this qualification belongs to Data checksum verification, which serves a different need to detect unexpected changes to model-training objects during transfer; it should not be confused with the restriction on Dataset lineage when attempting to explain which source and transformation produced a feature used in evaluation, namely that a dataset filename is insufficient evidence of origin and transformation history.

B:

In the banking operations review, this qualification belongs to RAG factual grounding, which serves a different need to reduce unsupported answers by providing approved source documents at inference; it should not be confused with the restriction on Dataset lineage when attempting to explain which source and transformation produced a feature used in evaluation, namely that a dataset filename is insufficient evidence of origin and transformation history.

C:

In the banking operations review, this qualification belongs to Confidence-based escalation, which serves a different need to send uncertain model recommendations to review instead of acting automatically; it should not be confused with the restriction on Dataset lineage when attempting to explain which source and transformation produced a feature used in evaluation, namely that a dataset filename is insufficient evidence of origin and transformation history.

Question 1012

The online retail project is considering Resource-based policy to control which AWS principals can read a sensitive data bucket used for retrieval. Which limitation could invalidate an overly broad claim about it?

  1. Instructions in a prompt are not an enforceable substitute for tool authorization.
  2. One all-powerful operator defeats independent review even with detailed logging.
  3. Allowing an application role does not automatically open a resource to everyone.
  4. An authenticated tool call still needs scoped permissions and action-level checks.

Explanation

Correct Answer

C:

An online retail rollout should account for this boundary: allowing an application role does not automatically open a resource to everyone. The chosen approach works because a resource policy can specify allowed principals and access conditions, but it is not evidence that every circumstance arising when trying to control which AWS principals can read a sensitive data bucket used for retrieval has been addressed.

Incorrect Answers

A:

In the online retail review, this qualification belongs to AgentCore Policy, which serves a different need to limit tool actions that an AI agent is allowed to perform; it should not be confused with the restriction on Resource-based policy when attempting to control which AWS principals can read a sensitive data bucket used for retrieval, namely that allowing an application role does not automatically open a resource to everyone.

B:

In the online retail review, this qualification belongs to Separation of duties, which serves a different need to require a different employee to approve a high-risk AI production deployment; it should not be confused with the restriction on Resource-based policy when attempting to control which AWS principals can read a sensitive data bucket used for retrieval, namely that allowing an application role does not automatically open a resource to everyone.

D:

In the online retail review, this qualification belongs to Amazon Bedrock AgentCore Identity, which serves a different need to manage agent authentication and delegated access to external resources; it should not be confused with the restriction on Resource-based policy when attempting to control which AWS principals can read a sensitive data bucket used for retrieval, namely that allowing an application role does not automatically open a resource to everyone.

Question 1013

For banking operations, using Amazon Bedrock AgentCore Identity might help to manage agent authentication and delegated access to external resources. Which risk remains despite that capability?

  1. A broad administrator policy grants unnecessary authority that a prompt cannot restrict.
  2. Placing credentials in a prompt or document risks their exposure to the model context.
  3. An authenticated tool call still needs scoped permissions and action-level checks.
  4. Instructions in a prompt are not an enforceable substitute for tool authorization.

Explanation

Correct Answer

C:

A banking operations rollout should account for this boundary: an authenticated tool call still needs scoped permissions and action-level checks. The chosen approach works because AgentCore Identity helps agents use managed identity and credentials for authorized connections, but it is not evidence that every circumstance arising when trying to manage agent authentication and delegated access to external resources has been addressed.

Incorrect Answers

A:

In the banking operations review, this qualification belongs to IAM least privilege, which serves a different need to limit an application's Bedrock model calls to only necessary AWS permissions; it should not be confused with the restriction on Amazon Bedrock AgentCore Identity when attempting to manage agent authentication and delegated access to external resources, namely that an authenticated tool call still needs scoped permissions and action-level checks.

B:

In the banking operations review, this qualification belongs to AWS Secrets Manager, which serves a different need to store and rotate third-party API credentials used by an AI agent; it should not be confused with the restriction on Amazon Bedrock AgentCore Identity when attempting to manage agent authentication and delegated access to external resources, namely that an authenticated tool call still needs scoped permissions and action-level checks.

D:

In the banking operations review, this qualification belongs to AgentCore Policy, which serves a different need to limit tool actions that an AI agent is allowed to perform; it should not be confused with the restriction on Amazon Bedrock AgentCore Identity when attempting to manage agent authentication and delegated access to external resources, namely that an authenticated tool call still needs scoped permissions and action-level checks.

Question 1014

A banking operations team proposes Encryption at rest for a goal to protect stored embeddings and documents against exposure of underlying storage media. Which limitation should appear in its risk assessment?

  1. A dataset filename is insufficient evidence of origin and transformation history.
  2. Encrypted storage cannot prevent data leakage by an already-authorized application.
  3. At-rest disk encryption addresses a different stage of the data lifecycle.
  4. Encryption does not determine whether a principal is authorized to retrieve decrypted data.

Explanation

Correct Answer

B:

A banking operations rollout should account for this boundary: encrypted storage cannot prevent data leakage by an already-authorized application. The chosen approach works because at-rest encryption protects persisted data with managed cryptographic controls, but it is not evidence that every circumstance arising when trying to protect stored embeddings and documents against exposure of underlying storage media has been addressed.

Incorrect Answers

A:

In the banking operations review, this qualification belongs to Dataset lineage, which serves a different need to explain which source and transformation produced a feature used in evaluation; it should not be confused with the restriction on Encryption at rest when attempting to protect stored embeddings and documents against exposure of underlying storage media, namely that encrypted storage cannot prevent data leakage by an already-authorized application.

C:

In the banking operations review, this qualification belongs to Encryption in transit, which serves a different need to protect a customer's prompt while it travels between client and service; it should not be confused with the restriction on Encryption at rest when attempting to protect stored embeddings and documents against exposure of underlying storage media, namely that encrypted storage cannot prevent data leakage by an already-authorized application.

D:

In the banking operations review, this qualification belongs to AWS KMS encryption, which serves a different need to manage encryption keys protecting customer documents stored for an AI workflow; it should not be confused with the restriction on Encryption at rest when attempting to protect stored embeddings and documents against exposure of underlying storage media, namely that encrypted storage cannot prevent data leakage by an already-authorized application.

Question 1015

What is the most relevant caveat in a manufacturing quality plan involving Confidence-based escalation and the need to send uncertain model recommendations to review instead of acting automatically?

  1. A self-reported confidence number needs calibration and does not prove accuracy.
  2. Cataloging alone does not enforce row-level access to underlying records.
  3. Matching hashes alone do not determine the trustworthiness or legality of the data.
  4. Retrieving a passage does not assure that every sentence in the response is correct.

Explanation

Correct Answer

A:

A manufacturing quality rollout should account for this boundary: a self-reported confidence number needs calibration and does not prove accuracy. The chosen approach works because confidence thresholds and escalation rules reduce unattended decisions under uncertainty, but it is not evidence that every circumstance arising when trying to send uncertain model recommendations to review instead of acting automatically has been addressed.

Incorrect Answers

B:

In the manufacturing quality review, this qualification belongs to Data cataloging, which serves a different need to help data owners find the approved source and owner of each dataset; it should not be confused with the restriction on Confidence-based escalation when attempting to send uncertain model recommendations to review instead of acting automatically, namely that a self-reported confidence number needs calibration and does not prove accuracy.

C:

In the manufacturing quality review, this qualification belongs to Data checksum verification, which serves a different need to detect unexpected changes to model-training objects during transfer; it should not be confused with the restriction on Confidence-based escalation when attempting to send uncertain model recommendations to review instead of acting automatically, namely that a self-reported confidence number needs calibration and does not prove accuracy.

D:

In the manufacturing quality review, this qualification belongs to RAG factual grounding, which serves a different need to reduce unsupported answers by providing approved source documents at inference; it should not be confused with the restriction on Confidence-based escalation when attempting to send uncertain model recommendations to review instead of acting automatically, namely that a self-reported confidence number needs calibration and does not prove accuracy.

Question 1016

A subscription services team is checking claims made about Prompt injection defense for a proposal to keep a retrieved page from issuing unauthorized instructions to an assistant. Which TWO claims can be defended? (Choose TWO.)

  1. Prompt injection defense operates according to this purported mechanism: audit logs retain identity, time, operation and relevant trace information under privacy rules.
  2. Placing raw web content into a model prompt does not make it a trusted command.
  3. The described method removes the need to consider the stated limitation because inspector continually scans eligible compute and container artifacts for security findings.
  4. Treat retrieved text as untrusted data and constrain tool actions with external checks.
  5. The main purpose of Prompt injection defense is to require a person to confirm that an assistant may transfer funds or delete records instead of to keep a retrieved page from issuing unauthorized instructions to an assistant.

Explanation

Correct Answers

B:

A retrieved web page is lower-trust input even if it appears inside the model context. Instructions embedded in that page have no inherent authority to override the user's task or tool permissions.

D:

Treat external retrieval results as evidence rather than executable instructions, and independently authorize tool actions. This limits the ability of malicious page text to redirect an agent.

Incorrect Answers

A:

The stated behavior is for Prompt and response audit trail, not for Prompt injection defense in a subscription services requirement to keep a retrieved page from issuing unauthorized instructions to an assistant. Audit logs retain identity, time, operation and relevant trace information under privacy rules is a real capability of the alternative, whereas the concept under review works because treat retrieved text as untrusted data and constrain tool actions with external checks.

C:

This assertion incorrectly waives the limitation of Prompt injection defense in the subscription services context. The relevant boundary is that placing raw web content into a model prompt does not make it a trusted command; selecting a technology to keep a retrieved page from issuing unauthorized instructions to an assistant does not remove that underlying requirement.

E:

The stated behavior is for Tool-action approval gate, not for Prompt injection defense in a subscription services requirement to keep a retrieved page from issuing unauthorized instructions to an assistant. An approval checkpoint prevents high-impact tool invocations without explicit authorization is a real capability of the alternative, whereas the concept under review works because treat retrieved text as untrusted data and constrain tool actions with external checks.

Question 1017

A professional-services design discussion focuses on AgentCore Policy and a requirement to limit tool actions that an AI agent is allowed to perform. Which caveat is specifically tied to this idea?

  1. Allowing an application role does not automatically open a resource to everyone.
  2. Instructions in a prompt are not an enforceable substitute for tool authorization.
  3. An authenticated tool call still needs scoped permissions and action-level checks.
  4. A broad administrator policy grants unnecessary authority that a prompt cannot restrict.
  5. One all-powerful operator defeats independent review even with detailed logging.

Explanation

Correct Answer

B:

A professional-services rollout should account for this boundary: instructions in a prompt are not an enforceable substitute for tool authorization. The chosen approach works because AgentCore Policy supports policy-based enforcement of agent actions, but it is not evidence that every circumstance arising when trying to limit tool actions that an AI agent is allowed to perform has been addressed.

Incorrect Answers

A:

In the professional-services review, this qualification belongs to Resource-based policy, which serves a different need to control which AWS principals can read a sensitive data bucket used for retrieval; it should not be confused with the restriction on AgentCore Policy when attempting to limit tool actions that an AI agent is allowed to perform, namely that instructions in a prompt are not an enforceable substitute for tool authorization.

C:

In the professional-services review, this qualification belongs to Amazon Bedrock AgentCore Identity, which serves a different need to manage agent authentication and delegated access to external resources; it should not be confused with the restriction on AgentCore Policy when attempting to limit tool actions that an AI agent is allowed to perform, namely that instructions in a prompt are not an enforceable substitute for tool authorization.

D:

In the professional-services review, this qualification belongs to IAM least privilege, which serves a different need to limit an application's Bedrock model calls to only necessary AWS permissions; it should not be confused with the restriction on AgentCore Policy when attempting to limit tool actions that an AI agent is allowed to perform, namely that instructions in a prompt are not an enforceable substitute for tool authorization.

E:

In the professional-services review, this qualification belongs to Separation of duties, which serves a different need to require a different employee to approve a high-risk AI production deployment; it should not be confused with the restriction on AgentCore Policy when attempting to limit tool actions that an AI agent is allowed to perform, namely that instructions in a prompt are not an enforceable substitute for tool authorization.

Question 1018

The customer operations project is considering Data leakage prevention to prevent a helpdesk assistant from disclosing restricted customer records. Which limitation could invalidate an overly broad claim about it?

  1. A friendly instruction to be discreet cannot reliably enforce confidentiality.
  2. They supplement but do not replace identity, permission or network security.
  3. A well-formed output can still contain an unsupported claim requiring factual review.
  4. Masking user-facing results alone cannot undo excess data transmitted upstream.

Explanation

Correct Answer

A:

A customer operations rollout should account for this boundary: a friendly instruction to be discreet cannot reliably enforce confidentiality. The chosen approach works because combine permission-scoped retrieval, output checking and monitored tool access, but it is not evidence that every circumstance arising when trying to prevent a helpdesk assistant from disclosing restricted customer records has been addressed.

Incorrect Answers

B:

In the customer operations review, this qualification belongs to Amazon Bedrock Guardrails, which serves a different need to apply managed safety filters to inputs and outputs in a GenAI application; it should not be confused with the restriction on Data leakage prevention when attempting to prevent a helpdesk assistant from disclosing restricted customer records, namely that a friendly instruction to be discreet cannot reliably enforce confidentiality.

C:

In the customer operations review, this qualification belongs to Output validation, which serves a different need to block model-generated fields that break a permitted-data schema; it should not be confused with the restriction on Data leakage prevention when attempting to prevent a helpdesk assistant from disclosing restricted customer records, namely that a friendly instruction to be discreet cannot reliably enforce confidentiality.

D:

In the customer operations review, this qualification belongs to PII minimization, which serves a different need to avoid sending unneeded customer identifiers to a third-party tool; it should not be confused with the restriction on Data leakage prevention when attempting to prevent a helpdesk assistant from disclosing restricted customer records, namely that a friendly instruction to be discreet cannot reliably enforce confidentiality.

Question 1019

For university services, using Tool-action approval gate might help to require a person to confirm that an assistant may transfer funds or delete records. Which risk remains despite that capability?

  1. Operational telemetry is not a replacement for AWS API audit history.
  2. Placing raw web content into a model prompt does not make it a trusted command.
  3. Successful intent recognition is not proof of permission to execute a transaction.
  4. An unstructured screenshot alone is not a complete tamper-resistant activity record.

Explanation

Correct Answer

C:

A university services rollout should account for this boundary: successful intent recognition is not proof of permission to execute a transaction. The chosen approach works because an approval checkpoint prevents high-impact tool invocations without explicit authorization, but it is not evidence that every circumstance arising when trying to require a person to confirm that an assistant may transfer funds or delete records has been addressed.

Incorrect Answers

A:

In the university services review, this qualification belongs to Amazon CloudWatch monitoring, which serves a different need to observe model-backed application errors, latency and operating metrics; it should not be confused with the restriction on Tool-action approval gate when attempting to require a person to confirm that an assistant may transfer funds or delete records, namely that successful intent recognition is not proof of permission to execute a transaction.

B:

In the university services review, this qualification belongs to Prompt injection defense, which serves a different need to keep a retrieved page from issuing unauthorized instructions to an assistant; it should not be confused with the restriction on Tool-action approval gate when attempting to require a person to confirm that an assistant may transfer funds or delete records, namely that successful intent recognition is not proof of permission to execute a transaction.

D:

In the university services review, this qualification belongs to Prompt and response audit trail, which serves a different need to reconstruct which AI request and authorized tool call caused a disputed action; it should not be confused with the restriction on Tool-action approval gate when attempting to require a person to confirm that an assistant may transfer funds or delete records, namely that successful intent recognition is not proof of permission to execute a transaction.

Question 1020

A travel services team proposes Amazon Macie for a goal to discover potentially sensitive customer information stored in Amazon S3. Which limitation should appear in its risk assessment?

  1. Discovery reports do not automatically rewrite prompts or grant consent for processing.
  2. Masking user-facing results alone cannot undo excess data transmitted upstream.
  3. A friendly instruction to be discreet cannot reliably enforce confidentiality.
  4. They supplement but do not replace identity, permission or network security.

Explanation

Correct Answer

A:

A travel services rollout should account for this boundary: discovery reports do not automatically rewrite prompts or grant consent for processing. The chosen approach works because Macie analyzes S3 data to identify sensitive information and related risks, but it is not evidence that every circumstance arising when trying to discover potentially sensitive customer information stored in Amazon S3 has been addressed.

Incorrect Answers

B:

In the travel services review, this qualification belongs to PII minimization, which serves a different need to avoid sending unneeded customer identifiers to a third-party tool; it should not be confused with the restriction on Amazon Macie when attempting to discover potentially sensitive customer information stored in Amazon S3, namely that discovery reports do not automatically rewrite prompts or grant consent for processing.

C:

In the travel services review, this qualification belongs to Data leakage prevention, which serves a different need to prevent a helpdesk assistant from disclosing restricted customer records; it should not be confused with the restriction on Amazon Macie when attempting to discover potentially sensitive customer information stored in Amazon S3, namely that discovery reports do not automatically rewrite prompts or grant consent for processing.

D:

In the travel services review, this qualification belongs to Amazon Bedrock Guardrails, which serves a different need to apply managed safety filters to inputs and outputs in a GenAI application; it should not be confused with the restriction on Amazon Macie when attempting to discover potentially sensitive customer information stored in Amazon S3, namely that discovery reports do not automatically rewrite prompts or grant consent for processing.

AWS Certified AI Practitioner AIF-C01 Practice Tests