Amazon AWS Certified AI Practitioner AIF-C01 Practice Test 99

Question 980

A media publishing design uses AWS Secrets Manager in order to store and rotate third-party API credentials used by an AI agent. Which technical description is accurate?

  1. IAM permissions authorize specific service actions and resources for a principal.
  2. AgentCore Policy supports policy-based enforcement of agent actions.
  3. Separate roles and approval responsibilities reduce unilateral unauthorized changes.
  4. Secrets Manager provides managed secret storage and rotation integration.

Explanation

Correct Answer

D:

For the proposed media publishing use, the key operating principle is that secrets Manager provides managed secret storage and rotation integration; that mechanism is what enables AWS Secrets Manager to store and rotate third-party API credentials used by an AI agent. The technical limitation—placing credentials in a prompt or document risks their exposure to the model context—needs a separate check.

Incorrect Answers

A:

In this media publishing question about AWS Secrets Manager, the statement instead characterizes IAM least privilege: IAM permissions authorize specific service actions and resources for a principal. That can support a goal to limit an application's Bedrock model calls to only necessary AWS permissions, but does not explain the operation required for AWS Secrets Manager to store and rotate third-party API credentials used by an AI agent.

B:

In this media publishing question about AWS Secrets Manager, the statement instead characterizes AgentCore Policy: AgentCore Policy supports policy-based enforcement of agent actions. That can support a goal to limit tool actions that an AI agent is allowed to perform, but does not explain the operation required for AWS Secrets Manager to store and rotate third-party API credentials used by an AI agent.

C:

In this media publishing question about AWS Secrets Manager, the statement instead characterizes Separation of duties: separate roles and approval responsibilities reduce unilateral unauthorized changes. That can support a goal to require a different employee to approve a high-risk AI production deployment, but does not explain the operation required for AWS Secrets Manager to store and rotate third-party API credentials used by an AI agent.

Question 981

In a professional-services review, AWS PrivateLink was proposed to establish private connectivity from an application VPC to supported AWS services. Which account of its underlying behavior is correct?

  1. VPC networking controls subnets, routing and network exposure for workloads.
  2. PrivateLink uses private endpoint connectivity without requiring public internet traversal.
  3. Secrets Manager provides managed secret storage and rotation integration.
  4. Macie analyzes S3 data to identify sensitive information and related risks.

Explanation

Correct Answer

B:

For the proposed professional-services use, the key operating principle is that privateLink uses private endpoint connectivity without requiring public internet traversal; that mechanism is what enables AWS PrivateLink to establish private connectivity from an application VPC to supported AWS services. The technical limitation—private transport does not replace service-level IAM authorization—needs a separate check.

Incorrect Answers

A:

In this professional-services question about AWS PrivateLink, the statement instead characterizes Amazon VPC network isolation: vPC networking controls subnets, routing and network exposure for workloads. That can support a goal to segregate compute resources used by an internal AI system, but does not explain the operation required for AWS PrivateLink to establish private connectivity from an application VPC to supported AWS services.

C:

In this professional-services question about AWS PrivateLink, the statement instead characterizes AWS Secrets Manager: secrets Manager provides managed secret storage and rotation integration. That can support a goal to store and rotate third-party API credentials used by an AI agent, but does not explain the operation required for AWS PrivateLink to establish private connectivity from an application VPC to supported AWS services.

D:

In this professional-services question about AWS PrivateLink, the statement instead characterizes Amazon Macie: Macie analyzes S3 data to identify sensitive information and related risks. That can support a goal to discover potentially sensitive customer information stored in Amazon S3, but does not explain the operation required for AWS PrivateLink to establish private connectivity from an application VPC to supported AWS services.

Question 982

A human-resources support prototype calls for Document provenance checks to confirm that evidence used in an answer comes from an approved current policy source. Which description would accurately document the method?

  1. Provenance metadata identifies author, revision and authorized origin of documents.
  2. Confidence thresholds and escalation rules reduce unattended decisions under uncertainty.
  3. Lineage records the path from original data through processing to model use.
  4. Grounding gives the model retrieved evidence relevant to the question.

Explanation

Correct Answer

A:

For the proposed human-resources support use, the key operating principle is that provenance metadata identifies author, revision and authorized origin of documents; that mechanism is what enables Document provenance checks to confirm that evidence used in an answer comes from an approved current policy source. The technical limitation—the most semantically similar paragraph might be an obsolete or unauthorized copy—needs a separate check.

Incorrect Answers

B:

In this human-resources support question about Document provenance checks, the statement instead characterizes Confidence-based escalation: confidence thresholds and escalation rules reduce unattended decisions under uncertainty. That can support a goal to send uncertain model recommendations to review instead of acting automatically, but does not explain the operation required for Document provenance checks to confirm that evidence used in an answer comes from an approved current policy source.

C:

In this human-resources support question about Document provenance checks, the statement instead characterizes Dataset lineage: lineage records the path from original data through processing to model use. That can support a goal to explain which source and transformation produced a feature used in evaluation, but does not explain the operation required for Document provenance checks to confirm that evidence used in an answer comes from an approved current policy source.

D:

In this human-resources support question about Document provenance checks, the statement instead characterizes RAG factual grounding: grounding gives the model retrieved evidence relevant to the question. That can support a goal to reduce unsupported answers by providing approved source documents at inference, but does not explain the operation required for Document provenance checks to confirm that evidence used in an answer comes from an approved current policy source.

Question 983

To assess supported workloads for software vulnerabilities and exposure, a professional-services project considers Amazon Inspector. Which statement correctly describes its role?

  1. Inspector continually scans eligible compute and container artifacts for security findings.
  2. Vulnerability assessments and patching reduce exposure in software dependencies.
  3. Treat retrieved text as untrusted data and constrain tool actions with external checks.
  4. CloudWatch collects metrics and operational logs for supported services and applications.

Explanation

Correct Answer

A:

For the proposed professional-services use, the key operating principle is that inspector continually scans eligible compute and container artifacts for security findings; that mechanism is what enables Amazon Inspector to assess supported workloads for software vulnerabilities and exposure. The technical limitation—it does not score whether an FM response is factually grounded—needs a separate check.

Incorrect Answers

B:

In this professional-services question about Amazon Inspector, the statement instead characterizes Vulnerability management: vulnerability assessments and patching reduce exposure in software dependencies. That can support a goal to detect software flaws in infrastructure hosting an AI application, but does not explain the operation required for Amazon Inspector to assess supported workloads for software vulnerabilities and exposure.

C:

In this professional-services question about Amazon Inspector, the statement instead characterizes Prompt injection defense: treat retrieved text as untrusted data and constrain tool actions with external checks. That can support a goal to keep a retrieved page from issuing unauthorized instructions to an assistant, but does not explain the operation required for Amazon Inspector to assess supported workloads for software vulnerabilities and exposure.

D:

In this professional-services question about Amazon Inspector, the statement instead characterizes Amazon CloudWatch monitoring: CloudWatch collects metrics and operational logs for supported services and applications. That can support a goal to observe model-backed application errors, latency and operating metrics, but does not explain the operation required for Amazon Inspector to assess supported workloads for software vulnerabilities and exposure.

Question 984

The professional-services team is reviewing how RAG factual grounding works in a plan to reduce unsupported answers by providing approved source documents at inference. Which statement gives the correct mechanism?

  1. A catalog records metadata, ownership and classification of data assets.
  2. Confidence thresholds and escalation rules reduce unattended decisions under uncertainty.
  3. Grounding gives the model retrieved evidence relevant to the question.
  4. Checksums provide an integrity signal when expected hashes match the received object.
  5. Provenance metadata identifies author, revision and authorized origin of documents.

Explanation

Correct Answer

C:

For the proposed professional-services use, the key operating principle is that grounding gives the model retrieved evidence relevant to the question; that mechanism is what enables RAG factual grounding to reduce unsupported answers by providing approved source documents at inference. The technical limitation—retrieving a passage does not assure that every sentence in the response is correct—needs a separate check.

Incorrect Answers

A:

In this professional-services question about RAG factual grounding, the statement instead characterizes Data cataloging: a catalog records metadata, ownership and classification of data assets. That can support a goal to help data owners find the approved source and owner of each dataset, but does not explain the operation required for RAG factual grounding to reduce unsupported answers by providing approved source documents at inference.

B:

In this professional-services question about RAG factual grounding, the statement instead characterizes Confidence-based escalation: confidence thresholds and escalation rules reduce unattended decisions under uncertainty. That can support a goal to send uncertain model recommendations to review instead of acting automatically, but does not explain the operation required for RAG factual grounding to reduce unsupported answers by providing approved source documents at inference.

D:

In this professional-services question about RAG factual grounding, the statement instead characterizes Data checksum verification: checksums provide an integrity signal when expected hashes match the received object. That can support a goal to detect unexpected changes to model-training objects during transfer, but does not explain the operation required for RAG factual grounding to reduce unsupported answers by providing approved source documents at inference.

E:

In this professional-services question about RAG factual grounding, the statement instead characterizes Document provenance checks: provenance metadata identifies author, revision and authorized origin of documents. That can support a goal to confirm that evidence used in an answer comes from an approved current policy source, but does not explain the operation required for RAG factual grounding to reduce unsupported answers by providing approved source documents at inference.

Question 985

Which explanation correctly describes Confidence-based escalation when a logistics project needs to send uncertain model recommendations to review instead of acting automatically?

  1. Confidence thresholds and escalation rules reduce unattended decisions under uncertainty.
  2. A catalog records metadata, ownership and classification of data assets.
  3. Grounding gives the model retrieved evidence relevant to the question.
  4. Checksums provide an integrity signal when expected hashes match the received object.

Explanation

Correct Answer

A:

For the proposed logistics use, the key operating principle is that confidence thresholds and escalation rules reduce unattended decisions under uncertainty; that mechanism is what enables Confidence-based escalation to send uncertain model recommendations to review instead of acting automatically. The technical limitation—a self-reported confidence number needs calibration and does not prove accuracy—needs a separate check.

Incorrect Answers

B:

In this logistics question about Confidence-based escalation, the statement instead characterizes Data cataloging: a catalog records metadata, ownership and classification of data assets. That can support a goal to help data owners find the approved source and owner of each dataset, but does not explain the operation required for Confidence-based escalation to send uncertain model recommendations to review instead of acting automatically.

C:

In this logistics question about Confidence-based escalation, the statement instead characterizes RAG factual grounding: grounding gives the model retrieved evidence relevant to the question. That can support a goal to reduce unsupported answers by providing approved source documents at inference, but does not explain the operation required for Confidence-based escalation to send uncertain model recommendations to review instead of acting automatically.

D:

In this logistics question about Confidence-based escalation, the statement instead characterizes Data checksum verification: checksums provide an integrity signal when expected hashes match the received object. That can support a goal to detect unexpected changes to model-training objects during transfer, but does not explain the operation required for Confidence-based escalation to send uncertain model recommendations to review instead of acting automatically.

Question 986

A logistics team is checking claims made about Amazon Bedrock Guardrails for a proposal to apply managed safety filters to inputs and outputs in a GenAI application. Which TWO claims can be defended? (Choose TWO.)

  1. Guardrails can help filter harmful content and sensitive information under configured policies.
  2. They supplement but do not replace identity, permission or network security.
  3. Amazon Bedrock Guardrails operates according to this purported mechanism: macie analyzes S3 data to identify sensitive information and related risks.
  4. The main purpose of Amazon Bedrock Guardrails is to avoid sending unneeded customer identifiers to a third-party tool instead of to apply managed safety filters to inputs and outputs in a GenAI application.
  5. The described method removes the need to consider the stated limitation because output validation checks generated data against field rules before downstream use.

Explanation

Correct Answers

A:

Configured Bedrock Guardrails can evaluate incoming or generated content against defined safety policies, including supported content and sensitive-information filtering. Test the configured thresholds on real examples.

B:

A content-safety control does not grant or restrict IAM permissions by itself. Identity authorization, network boundaries and other security controls must still be enforced around any model call.

Incorrect Answers

C:

The stated behavior is for Amazon Macie, not for Amazon Bedrock Guardrails in a logistics requirement to apply managed safety filters to inputs and outputs in a GenAI application. Macie analyzes S3 data to identify sensitive information and related risks is a real capability of the alternative, whereas the concept under review works because guardrails can help filter harmful content and sensitive information under configured policies.

D:

The stated behavior is for PII minimization, not for Amazon Bedrock Guardrails in a logistics requirement to apply managed safety filters to inputs and outputs in a GenAI application. Data minimization removes unnecessary personal information before processing is a real capability of the alternative, whereas the concept under review works because guardrails can help filter harmful content and sensitive information under configured policies.

E:

This assertion incorrectly waives the limitation of Amazon Bedrock Guardrails in the logistics context. The relevant boundary is that they supplement but do not replace identity, permission or network security; selecting a technology to apply managed safety filters to inputs and outputs in a GenAI application does not remove that underlying requirement.

Question 987

In a telecommunications review, Vulnerability management was proposed to detect software flaws in infrastructure hosting an AI application. Which account of its underlying behavior is correct?

  1. CloudWatch collects metrics and operational logs for supported services and applications.
  2. Treat retrieved text as untrusted data and constrain tool actions with external checks.
  3. Audit logs retain identity, time, operation and relevant trace information under privacy rules.
  4. Vulnerability assessments and patching reduce exposure in software dependencies.

Explanation

Correct Answer

D:

For the proposed telecommunications use, the key operating principle is that vulnerability assessments and patching reduce exposure in software dependencies; that mechanism is what enables Vulnerability management to detect software flaws in infrastructure hosting an AI application. The technical limitation—model guardrails do not remediate exploitable container or host packages—needs a separate check.

Incorrect Answers

A:

In this telecommunications question about Vulnerability management, the statement instead characterizes Amazon CloudWatch monitoring: CloudWatch collects metrics and operational logs for supported services and applications. That can support a goal to observe model-backed application errors, latency and operating metrics, but does not explain the operation required for Vulnerability management to detect software flaws in infrastructure hosting an AI application.

B:

In this telecommunications question about Vulnerability management, the statement instead characterizes Prompt injection defense: treat retrieved text as untrusted data and constrain tool actions with external checks. That can support a goal to keep a retrieved page from issuing unauthorized instructions to an assistant, but does not explain the operation required for Vulnerability management to detect software flaws in infrastructure hosting an AI application.

C:

In this telecommunications question about Vulnerability management, the statement instead characterizes Prompt and response audit trail: audit logs retain identity, time, operation and relevant trace information under privacy rules. That can support a goal to reconstruct which AI request and authorized tool call caused a disputed action, but does not explain the operation required for Vulnerability management to detect software flaws in infrastructure hosting an AI application.

Question 988

A public-sector support prototype calls for AWS KMS encryption to manage encryption keys protecting customer documents stored for an AI workflow. Which description would accurately document the method?

  1. At-rest encryption protects persisted data with managed cryptographic controls.
  2. TLS encrypts network communications and helps prevent interception in transit.
  3. AWS KMS helps create and control cryptographic keys used by AWS encryption features.
  4. A resource policy can specify allowed principals and access conditions.

Explanation

Correct Answer

C:

For the proposed public-sector support use, the key operating principle is that AWS KMS helps create and control cryptographic keys used by AWS encryption features; that mechanism is what enables AWS KMS encryption to manage encryption keys protecting customer documents stored for an AI workflow. The technical limitation—encryption does not determine whether a principal is authorized to retrieve decrypted data—needs a separate check.

Incorrect Answers

A:

In this public-sector support question about AWS KMS encryption, the statement instead characterizes Encryption at rest: at-rest encryption protects persisted data with managed cryptographic controls. That can support a goal to protect stored embeddings and documents against exposure of underlying storage media, but does not explain the operation required for AWS KMS encryption to manage encryption keys protecting customer documents stored for an AI workflow.

B:

In this public-sector support question about AWS KMS encryption, the statement instead characterizes Encryption in transit: tLS encrypts network communications and helps prevent interception in transit. That can support a goal to protect a customer's prompt while it travels between client and service, but does not explain the operation required for AWS KMS encryption to manage encryption keys protecting customer documents stored for an AI workflow.

D:

In this public-sector support question about AWS KMS encryption, the statement instead characterizes Resource-based policy: a resource policy can specify allowed principals and access conditions. That can support a goal to control which AWS principals can read a sensitive data bucket used for retrieval, but does not explain the operation required for AWS KMS encryption to manage encryption keys protecting customer documents stored for an AI workflow.

Question 989

To segregate compute resources used by an internal AI system, a manufacturing quality project considers Amazon VPC network isolation. Which statement correctly describes its role?

  1. VPC networking controls subnets, routing and network exposure for workloads.
  2. CloudWatch collects metrics and operational logs for supported services and applications.
  3. PrivateLink uses private endpoint connectivity without requiring public internet traversal.
  4. An IAM role provides temporary credentials to trusted AWS service workloads.

Explanation

Correct Answer

A:

For the proposed manufacturing quality use, the key operating principle is that vPC networking controls subnets, routing and network exposure for workloads; that mechanism is what enables Amazon VPC network isolation to segregate compute resources used by an internal AI system. The technical limitation—a private subnet does not itself make a foundation-model output safe—needs a separate check.

Incorrect Answers

B:

In this manufacturing quality question about Amazon VPC network isolation, the statement instead characterizes Amazon CloudWatch monitoring: CloudWatch collects metrics and operational logs for supported services and applications. That can support a goal to observe model-backed application errors, latency and operating metrics, but does not explain the operation required for Amazon VPC network isolation to segregate compute resources used by an internal AI system.

C:

In this manufacturing quality question about Amazon VPC network isolation, the statement instead characterizes AWS PrivateLink: privateLink uses private endpoint connectivity without requiring public internet traversal. That can support a goal to establish private connectivity from an application VPC to supported AWS services, but does not explain the operation required for Amazon VPC network isolation to segregate compute resources used by an internal AI system.

D:

In this manufacturing quality question about Amazon VPC network isolation, the statement instead characterizes IAM role for workloads: an IAM role provides temporary credentials to trusted AWS service workloads. That can support a goal to let a managed workload access AI-related AWS resources without embedded long-term keys, but does not explain the operation required for Amazon VPC network isolation to segregate compute resources used by an internal AI system.

Question 990

The logistics team is reviewing how Amazon Bedrock AgentCore Identity works in a plan to manage agent authentication and delegated access to external resources. Which statement gives the correct mechanism?

  1. AgentCore Policy supports policy-based enforcement of agent actions.
  2. AgentCore Identity helps agents use managed identity and credentials for authorized connections.
  3. An IAM role provides temporary credentials to trusted AWS service workloads.
  4. Secrets Manager provides managed secret storage and rotation integration.

Explanation

Correct Answer

B:

For the proposed logistics use, the key operating principle is that AgentCore Identity helps agents use managed identity and credentials for authorized connections; that mechanism is what enables Amazon Bedrock AgentCore Identity to manage agent authentication and delegated access to external resources. The technical limitation—an authenticated tool call still needs scoped permissions and action-level checks—needs a separate check.

Incorrect Answers

A:

In this logistics question about Amazon Bedrock AgentCore Identity, the statement instead characterizes AgentCore Policy: AgentCore Policy supports policy-based enforcement of agent actions. That can support a goal to limit tool actions that an AI agent is allowed to perform, but does not explain the operation required for Amazon Bedrock AgentCore Identity to manage agent authentication and delegated access to external resources.

C:

In this logistics question about Amazon Bedrock AgentCore Identity, the statement instead characterizes IAM role for workloads: an IAM role provides temporary credentials to trusted AWS service workloads. That can support a goal to let a managed workload access AI-related AWS resources without embedded long-term keys, but does not explain the operation required for Amazon Bedrock AgentCore Identity to manage agent authentication and delegated access to external resources.

D:

In this logistics question about Amazon Bedrock AgentCore Identity, the statement instead characterizes AWS Secrets Manager: secrets Manager provides managed secret storage and rotation integration. That can support a goal to store and rotate third-party API credentials used by an AI agent, but does not explain the operation required for Amazon Bedrock AgentCore Identity to manage agent authentication and delegated access to external resources.

AWS Certified AI Practitioner AIF-C01 Practice Tests