Amazon AWS Certified Generative AI Developer - Professional AIP-C01 Practice Test 24

Question 230

A private GenAI API lacks request authentication. Which change satisfies the specified security or reliability requirement?

Leave the endpoint public because Bedrock later checks IAM on the gateway's service role.
Store shared bearer tokens in browser JavaScript and skip expiry or audience validation.
Only filter model output for policy violations after processing anonymous private requests.
Enforce API Gateway or service-side authentication and caller-specific authorization.

Explanation

Correct Answer

Enforce authenticated invocation and resource/tenant-scoped authorization at API Gateway or backend before calling the FM or tools.

Incorrect Answers

Service IAM does not identify or authorize the original human caller.

Exposed tokens can be replayed by unauthorized clients.

Content moderation is separate from request authentication and data rights.

Question 231

An integration service emits a sensitive payload to EventBridge. What should the engineer implement at the enterprise service boundary?

Publish complete confidential customer documents on a broadly shared event bus.
Minimize event fields and enforce bus/resource policies and encryption.
Use only TLS and ignore subscriber/resource permissions once events reach AWS.
Encode private fields with base64 and classify that as encryption.

Explanation

Correct Answer

Minimize event payloads and use scoped EventBridge bus policies, encryption, TTL/retention and approved destinations for sensitive data.

Incorrect Answers

Any subscriber with access could receive unnecessary personal data.

Transport security does not enforce event distribution rights.

Encoding does not protect confidentiality against consumers.

Question 232

An AI gateway needs throttling per tenant. Which integration architecture change best addresses this failure?

Put all customers under one unlimited shared quota with no per-tenant tracking.
Use an output toxicity filter as the only control against usage spikes.
Apply tenant-aware rate limits and monitored quotas before Bedrock invocation.
Block every request permanently after a single throttling event.

Explanation

Correct Answer

Apply authenticated tenant-specific quotas/rate limits with observability before Bedrock calls, including retry/backpressure policy.

Incorrect Answers

One tenant can exhaust capacity or costs for everyone else.

Content filtering does not limit request volume or token consumption.

A bounded backoff and measured quota policy is needed, not an irreversible blanket lockout.

Question 233

An application uses shared keys in deployed Lambda environment variables. Which change satisfies the specified security or reliability requirement?

Embed the administrator API secret in Lambda deployment source and rotate only during annual release.
Give Lambda a wildcard IAM policy to avoid any secret configuration changes.
Pass an unencrypted secret as a model prompt variable to invoke the backend.
Prefer workload IAM roles and managed secret storage with key rotation.

Explanation

Correct Answer

Use workload IAM roles and managed secrets/rotation for real service-to-service access; never distribute long-lived shared keys in Lambda config/client code.

Incorrect Answers

Static secrets can leak through repository/artifact access and violate least privilege.

Broad role permissions increase attack surface rather than solving safe credential use.

Model input is not an approved secret transport or scoped credential vault.

Question 234

A multi-account organization shares central model services. What should the engineer implement at the enterprise service boundary?

Use an unrestricted wildcard trust policy for every AWS account in the organization.
Share a single long-lived administrator access key across all account applications.
Design cross-account role trust and resource policies with explicit principals.
Assume an IAM permission in the calling account always overrides the target resource's policy.

Explanation

Correct Answer

Define explicit cross-account role trust, resource ARNs and invocation conditions that preserve source-account identity and service resource policy.

Incorrect Answers

Organization membership alone does not establish a specific workload's least privilege.

Static shared credentials obscure accountable principals and expand blast radius.

Cross-account access may require compatible trust and resource-side authorization.

Question 235

A GenAI document-processing workflow ingests protected material from an external data center into an AWS service. Select THREE independent protections for transport, data minimization, and permitted inference geography.

Encrypt the hybrid document transport.
Send all raw confidential document fields because the model's provider is an AWS service.
Minimize sensitive fields before FM invocation.
Verify permitted inference region and processing path.
Store source files on approved premises but select a global cross-Region inference profile without inspecting destinations.
Use a self-signed TLS connection with certificate validation disabled to avoid connection failures.

Explanation

Correct Answer

Encrypt the document transport across the external link and verify endpoint identity.

Strip or pseudonymize nonessential sensitive fields before invoking the model.

Check permitted processing Regions and actual inference-profile destinations, not just the location of source storage.

Incorrect Answers

Provider infrastructure does not remove minimization or purpose limits.

Storage residency does not establish where prompts are processed.

Encryption without endpoint authentication permits interception.

Question 236

A CI/CD pipeline can push new production prompts with no approval and cannot return to a known-good version. Select TWO release controls that provide genuine promotion approval and rehearsed rollback.

Publish every new prompt directly from a developer draft without mandatory checks.
Verify only that the prompt template compiles, without testing factual answers.
Require named promotion approval after prompt regression and security checks.
Delete prior prompt versions at deployment so there is only one current state.
Maintain a tested rollback path to earlier prompt version.

Explanation

Correct Answer

Require an authorized promotion decision supported by prompt-version regression and security scan results.

Maintain a tested previous approved prompt artifact and deterministic rollback to stop a bad release.

Incorrect Answers

A mutable draft can introduce factual or unsafe regressions to all users.

Template syntax does not prove content safety or business correctness.

Removing approved historical artifacts destroys rollback and reproducibility.

Question 237

An API version change breaks mobile clients. What should the engineer implement at the enterprise service boundary?

Maintain backward-compatible request/response schemas through a gateway.
Change response field names in place without versioning and assume old apps will adapt.
Hide contract failures inside a generic model-generated apology instead of returning typed API errors.
Force all client apps to update instantly at server deployment time.

Explanation

Correct Answer

Version the API boundary with backward-compatible request/response schemas and contract tests for old and new mobile clients.

Incorrect Answers

Already-deployed mobile clients may parse or depend on prior fields.

A fluent response cannot restore broken client parsing.

Mobile release distribution is not atomic with backend changes.

Question 238

A real-time user app relies on eventually consistent employee permissions. Which integration architecture change best addresses this failure?

Authorize a money transfer solely from the employee role cached during a prior login.
Use a model-generated user label as the latest role assertion.
Return the protected record before checking the new entitlement because the user was once signed in.
Reevaluate authorization at action execution, not only cached login state.

Explanation

Correct Answer

Recheck effective employee rights at the actual business action; a login snapshot may become stale after role revocation.

Incorrect Answers

Permissions may have been revoked since sign-in.

Text cannot replace the identity provider's current authorization state.

Disclosure prior to authorization cannot be undone.

Question 239

A regional service failure blocks model access. Which change satisfies the specified security or reliability requirement?

Fail over to any global model endpoint without checking data processing geography.
Invent a successful completion after both primary and backup backends fail.
Switch model IDs dynamically without testing response schema and quality behavior.
Use preverified alternate Region/model route within policy and graceful fallback.

Explanation

Correct Answer

Prequalify fallback model/Region routes within legal and IAM policy, and return an explicit degraded result if neither is available.

Incorrect Answers

Availability remediation cannot override residency obligations.

No verified inference result exists to support success.

An unqualified fallback may return unusable or unsafe outputs.

Question 240

A third-party analytics service wants raw model traces. What should the engineer implement at the enterprise service boundary?

Export complete prompts and sensitive tool responses because the vendor promises analytics accuracy.
Redact and minimize logged data according to sharing/purpose agreements.
Hash only user IDs while leaving confidential documents in trace attributes.
Allow the analytics service indefinite copies without expiry or deletion controls.

Explanation

Correct Answer

Redact and minimize traces before approved analytics sharing, enforcing retention, destination and contractual processing scope.

Incorrect Answers

Third-party purpose/rights restrictions still govern what data may leave the system.

The main protected content remains disclosed.

Unbounded retention violates data governance and increases risk.

Pass Your Amazon AWS Certified Generative AI Developer - Professional AIP-C01 Exam Easy!

Question 230

Explanation

Correct Answer

Incorrect Answers

Question 231

Explanation

Correct Answer

Incorrect Answers

Question 232

Explanation

Correct Answer

Incorrect Answers

Question 233

Explanation

Correct Answer

Incorrect Answers

Question 234

Explanation

Correct Answer

Incorrect Answers

Question 235

Explanation

Correct Answer

Incorrect Answers

Question 236

Explanation

Correct Answer

Incorrect Answers

Question 237

Explanation

Correct Answer

Incorrect Answers

Question 238

Explanation

Correct Answer

Incorrect Answers

Question 239

Explanation

Correct Answer

Incorrect Answers

Question 240

Explanation

Correct Answer

Incorrect Answers

AWS Certified Generative AI Developer - Professional AIP-C01 Practice Tests