Amazon AIP-C01 Practice Exam Questions & Answers

: The errors described indicate missing permissions at both the application orchestration and data access levels. The 400 Bad Authorization from BedrockAgentRuntime indicates the Lambda execution role lacks the identity permission to invoke the agent; adding bedrock:InvokeAgent and aoss:APIAccessAll (which allows the principal to interact with OpenSearch Serverless APIs) is necessary. The 403 Forbidden error from OpenSearch Serverless specifically relates to data-plane permissions. Unlike traditional OpenSearch, Serverless uses data access policies. To 'manage collections at scale' automatically, a policy must be created that uses pattern-based resource rules (e.g., matching a prefix), ensuring that as new collections or indexes are created, the required principals (the Lambda role and the Bedrock service role) are granted the necessary access without manual policy updates for every new resource.

Option C best satisfies the requirement for rapid, correlated detection of model-related performance degradation. Amazon CloudWatch Application Insights provides automated observability across application components running on Amazon EC2, identifying abnormal behavior patterns without requiring extensive manual configuration.

Using custom metrics for recommendation quality, token usage, and response latency allows the company to directly monitor FM behavior, not just infrastructure health. Applying dimensions such as request type and user segment enables fine-grained correlation between performance issues and specific customer interactions or workloads.

CloudWatch anomaly detection is critical because it establishes dynamic baselines from historical data and detects deviations automatically. This enables alerts to be generated within minutes when FM behavior changes unexpectedly, satisfying the 10-minute alerting requirement without static thresholds that can miss subtle degradations.

CloudWatch Logs Insights complements metrics by enabling rapid analysis of log patterns, error messages, or unusual request flows associated with degraded recommendations. Because all data remains within CloudWatch, correlation between metrics, logs, and alerts is straightforward and operationally efficient.

Option A focuses on infrastructure metrics and lacks behavioral baselining. Option B provides tracing but not automated anomaly detection. Option D adds significant operational overhead and ingestion complexity for a use case already well supported by CloudWatch-native features.

Therefore, Option C delivers the most effective, scalable, and low-overhead observability solution for detecting FM-related performance deviations.

Option D best satisfies all functional, performance, and governance requirements while minimizing architectural complexity. The requirement explicitly states that all filtering must complete before content reaches the foundation model, which rules out asynchronous or streaming-based approaches that could delay enforcement.

Amazon Comprehend supports toxicity detection, prompt safety classification, and PII detection with entity redaction as managed capabilities. Running these filters in parallel ensures low end-to-end latency, which is essential for customer-facing communication platforms. Parallel execution avoids the cumulative latency that would be introduced by sequential pipelines.

Toxicity detection identifies offensive or abusive content early. Prompt safety classification detects requests for unethical, harmful, or manipulative advice, which directly addresses inappropriate advice solicitation requirements. PII detection with entity redaction ensures that customer privacy is preserved before data is sent to the FM, preventing sensitive information from being processed or echoed in generated responses.

Configuring thresholds allows fine-grained control over sensitivity while maintaining acceptable false-positive rates. Using CloudWatch metrics and alarms enables continuous monitoring of filtering behavior and intervention rates without adding custom routing or human review pipelines that would slow responses.

Option A lacks PII redaction. Option B introduces unnecessary model-building complexity and delayed PII checks. Option C adds sequential latency and introduces human review routing, which violates the response-time requirement.

Therefore, Option D provides the most robust, performant, and AWS-aligned layered content filtering solution.

Option B is the correct solution because Amazon Bedrock evaluation jobs are purpose-built to assess prompt effectiveness, model behavior, and response quality in a repeatable and automated manner. Evaluation jobs support both quantitative metrics and LLM-based judgment, making them suitable for detecting subtle response quality regressions that simple sentiment or latency metrics cannot capture.

By using custom prompt datasets, the company can consistently test multiple prompt templates and model configurations against the same inputs. This enables accurate comparison across updates and eliminates variability introduced by live traffic sampling. Amazon Bedrock evaluation jobs also support structured scoring outputs, which can be used to enforce objective quality thresholds.

Integrating evaluation jobs directly into AWS CodePipeline ensures that quality checks are automatically triggered whenever prompt templates or configurations change. This creates a gated deployment workflow in which only configurations that meet or exceed the predefined quality threshold are promoted. This directly satisfies the requirement to prevent low-quality configurations from being deployed.

Human reviewers can be incorporated by reviewing evaluation results and scores produced by the jobs, enabling informed feedback without manual data collection. Option A and D rely on custom frameworks and indirect quality signals, increasing complexity and reducing reliability. Option C focuses on operational health rather than response quality.

Therefore, Option B provides the most robust, scalable, and AWS-aligned quality assurance process for Amazon Bedrock--based applications.

Option A is the correct answer because Amazon Bedrock Flows is purpose-built to orchestrate generative AI workflows that combine data access, deterministic transformations, and model invocation with minimal operational overhead. The requirements explicitly state that the workflow must retrieve content from Amazon S3, extract a specific portion of a predefined template, send that portion to an Amazon Bedrock model, and store the model's response back into the same S3 bucket. Amazon Bedrock Flows natively supports all of these steps.

By configuring S3 action nodes at the beginning and end of the flow, the workflow can retrieve the original communications and persist the reviewed output without custom code. The expression step allows deterministic parsing of a specific portion of the template, which is essential when only part of the message should be reviewed. This avoids relying on generative logic for parsing, which would be less predictable and harder to audit. The agent step is then used specifically for the review task, where the foundation model evaluates or modifies the extracted content.

Option B uses AWS Step Functions, which can achieve similar outcomes but requires more explicit orchestration logic and does not provide GenAI-native constructs such as expressions and agent steps in a single managed experience. Options C and D rely on Amazon Bedrock agents and AWS Lambda functions to handle parsing and data movement, which increases complexity, operational overhead, and maintenance burden.

Because Amazon Bedrock Flows directly integrates S3 actions, parsing expressions, and model review steps in a single managed workflow, Option A best meets the requirements with the least development and operational effort.

Option B is the correct solution because Amazon Bedrock provisioned throughput is only used when the application explicitly invokes the provisioned model ARN, not the base foundation model ID. In the provided code, the application is calling the standard model identifier (anthropic.claude-v2), which routes requests to on-demand capacity instead of the purchased provisioned throughput.

When the CreateProvisionedModelThroughput API is used, Amazon Bedrock returns a provisioned model ARN that represents the reserved capacity. Applications must reference this ARN in the modelId parameter when invoking the model. If the base model ID is used instead, Bedrock treats the request as on-demand traffic, which explains why CloudWatch metrics show unused provisioned capacity alongside throttled on-demand requests.

Option A would increase capacity but would not fix the root cause because the application is not using the provisioned resource at all. Option C adds resiliency but does not ensure usage of provisioned throughput and would still incur throttling. Option D changes the response delivery mechanism but does not affect capacity routing.

Therefore, Option B directly resolves the throttling issue by correctly routing traffic to the reserved capacity and ensures that the company benefits from the provisioned throughput it has purchased.

Option A is the most complete solution because it provides a fully automated canary strategy with staged traffic shifts, metric-based decisioning, and automatic rollback, all using managed AWS services. The requirement emphasizes automation, health-based traffic progression, and zero manual intervention to revert if performance degrades.

AWS Step Functions is well suited for orchestrating controlled deployment workflows with deterministic stages, waits, and conditional branches. By shifting traffic in stages and pausing for observation windows, the system can evaluate real-time inference latency and error rates before promoting more traffic to the new model version. Amazon CloudWatch provides the necessary real-time metrics and alarms for latency and error monitoring.

Invoking a Lambda function to evaluate CloudWatch metrics enables dynamic logic: increase traffic if thresholds remain healthy, reduce traffic or roll back if error rates rise or latency exceeds limits. Step Functions can halt the deployment by stopping progression or triggering rollback steps immediately, meeting the requirement for automated revert without human action.

Amazon EventBridge provides reliable automation triggers when a new model version is released, ensuring the deployment process is event-driven and repeatable.

Option B depends on ''external logic,'' which introduces operational risk and does not guarantee automatic rollback without custom systems. Option C incorrectly uses SageMaker endpoint variants to represent Bedrock model versions, which is not the intended integration model. Option D is overly indirect and operationally complex, using log pipelines and automation runbooks instead of direct metric-based traffic control.

Therefore, Option A best meets the requirements for automated gradual traffic shifting, real-time monitoring, and automatic rollback for Amazon Bedrock model deployments in a canary strategy.