Amazon AWS Certified Generative AI Developer - Professional AIP-C01 Practice Test 27

Question 260

A model response reaches the configured output-token limit while generating a structured invoice update. The partial object is syntactically incomplete and the application is about to apply it to an authoritative finance record. What commit-time gate must the caller enforce?

Accept the partial JSON prefix as valid because it begins with a curly brace.
Reject truncated or incomplete output based on stop reason and schema/business validation before any financial write, and retry within supported output limits only when safe.
Assume the model can always resume the exact token stream if a second request is issued.
Increase network timeout only while leaving max output token cap unchanged.

Explanation

Correct Answer

A max-token stop can leave a partial JSON or business command. An incomplete model response must not become an authoritative transaction merely because it contains plausible fields.

Incorrect Answers

The response may be syntactically/semantically incomplete.

A separate generation is not guaranteed to be an exact continuation.

Time limits do not repair a generation stopped by token exhaustion.

Question 261

A tool call requires user-specific secret. Which API-level change or validation correctly resolves the condition?

Insert the user's API token in the system prompt so the model can call the third-party service directly.
Store one global administrator credential in an unprotected chat memory for all users.
Retrieve authorized scoped credential in tool layer, not put secret into prompt.
Return the secret to the client in the generated answer before tool execution.

Explanation

Correct Answer

Retrieve actor-scoped short-lived credentials in the protected tool layer, enforcing target secret access; never serialize secrets in model prompts.

Incorrect Answers

Prompt tokens can leak and are not a controlled credential boundary.

Shared credentials bypass actor-specific rights and retention controls.

Secret disclosure does not implement authorized backend access.

Question 262

Multiple model providers return different usage token fields. Which specific action is required by this Bedrock API behavior?

Normalize measured usage into a provider-neutral response metadata schema.
Assume every provider names input and output token counters identically.
Estimate usage from character counts and call that the billable token amount.
Discard the model ID and deployment profile when normalizing usage.

Explanation

Correct Answer

Map per-provider usage and generation metadata into a typed response contract while preserving raw measured values and unit semantics.

Incorrect Answers

Provider-specific response fields and units can differ.

Character counts cannot reproduce model tokenization/billing counters.

Without model identity, quota and price attribution can become inaccurate.

Question 263

An organization invokes a non-Bedrock third-party model and needs Bedrock Guardrails to assess user input independently before sending it to that model. Which operation and permission enforce the standalone moderation check?

Run InvokeModel just to perform a standalone text moderation call even when independent moderation is required.
Treat a prompt substring filter as equivalent to a tested configured Bedrock Guardrail.
Call the standalone ApplyGuardrail API with an authorized guardrail ID/version and bedrock:ApplyGuardrail permission, then enforce its assessment before forwarding content.
Skip output validation because the input had already passed moderation.

Explanation

Correct Answer

ApplyGuardrail can assess text independently from Bedrock model inference. Grant the application the scoped bedrock:ApplyGuardrail permission and enforce its block/filter result; an FM invoke permission alone is not equivalent.

Incorrect Answers

The unnecessary generation has different semantics and cost.

Literal matching lacks policy, version and evaluation controls.

Generated output may violate policy even when input was allowed.

Question 264

A service call uses an invalid guardrail version. Which API-level change or validation correctly resolves the condition?

Set guardrailVersion to any positive integer and assume the service uses the newest one.
Change only the model ID while leaving the nonexistent guardrail reference unchanged.
Disable the guardrail to bypass the validation error and claim equivalent protection.
Supply an existing allowed guardrail identifier/version and verify deployment policy.

Explanation

Correct Answer

Pass an existing authorized guardrailIdentifier and guardrailVersion with required scope; verify the deployed version rather than a guessed number.

Incorrect Answers

Versions must exist and be authorized; values are not just ordinals to guess.

Model selection cannot fix a bad guardrail identifier/version.

Omitting the guardrail removes the required moderation check.

Question 265

An invocation logs full documents into CloudWatch unexpectedly. Which specific action is required by this Bedrock API behavior?

Treat CloudWatch as automatically safe for all confidential prompts with default broad viewers.
Disable UI telemetry only, leaving runtime invocation logging unchanged.
Base64-encode the log body and treat it as non-sensitive.
Configure sensitive logging modes and destination access/retention before processing.

Explanation

Correct Answer

Restrict invocation-log payload and destination IAM/retention before enabling the sensitive workload; a logged invocation can contain source text.

Incorrect Answers

Log access and content retention are separate responsibilities.

Server-side logging can still store entire documents.

Encoding is reversible and offers no confidentiality protection.

Question 266

An API gateway exposes a GenAI app to enterprise consumers. Which development or release-control change meets this requirement?

Return a different unstructured JSON shape each time the model changes without client contract tests.
Define OpenAPI request, error and authentication contracts for the model service.
Expose the model's raw provider-native inference body as a public enterprise API with no auth schema.
Use the generated answer text as the only success/error status while discarding HTTP failure types.

Explanation

Correct Answer

Define a versioned OpenAPI contract with typed requests/errors and identity requirements for the Bedrock-facing integration API.

Incorrect Answers

Consumers need stable request and response semantics independent of model behavior.

Native model fields do not constitute a governed consumer contract.

Client retry and recovery logic needs machine-readable errors and status meanings.

Question 267

A browser frontend must keep AI calls authenticated. Which integration fix is appropriate for this failure?

Include long-lived IAM keys in the compiled JavaScript bundle and rely on minification.
Give unauthenticated browsers permission to invoke any model through a shared gateway role.
Use a backend auth boundary and never embed Bedrock IAM secrets in JavaScript.
Use cross-origin request headers as the only authentication boundary.

Explanation

Correct Answer

Keep Bedrock invocation behind an authenticated backend, using IAM roles and per-user authorization instead of browser-exposed cloud secrets.

Incorrect Answers

Browser code and secrets can be recovered by clients.

Backend role possession does not prove which end user should be authorized.

CORS is not an authorization system for API calls.

Question 268

A UI displays partial stream tokens without acknowledging failure. What must the application pipeline enforce before promotion?

Treat the first received token as a complete accepted response for status UI.
Discard terminal error frames and silently keep the partial text under a success icon.
Auto-commit downstream actions triggered by an incomplete textual sentence.
Handle terminal stream errors and avoid showing incomplete responses as final.

Explanation

Correct Answer

Represent streaming, terminal errors, cancellations and verified completion as distinct client states so a partial output is never presented as final.

Incorrect Answers

The stream could still fail or omit essential information.

A failed stream is not a completed answer.

Partial generation is not approved structured data or tool authorization.

Question 269

An event-driven document processor receives a new S3 object. Which development or release-control change meets this requirement?

Rely on a model prompt polling the bucket and assume it notices each new object.
Use only the object filename as deduplication identity, ignoring versions.
Start a transaction with full S3 admin privileges for every upload irrespective of identity.
Trigger controlled Lambda/Step Functions processing with object-version ID.

Explanation

Correct Answer

Trigger processing from an S3 object event and carry bucket/key/version into an idempotent Lambda or Step Functions execution.

Incorrect Answers

A model invocation is not a durable S3 event subscription.

Overwrites can represent distinct source artifacts and need lineage.

Event execution roles must be scoped to intended resources.

Question 270

A document-processing state machine needs human escalation. Which integration fix is appropriate for this failure?

Mark the document validated before a required human reviewer examines the exceptions.
Delete the parsed source/decision evidence after sending a human notification.
Let the model impersonate an approver by filling the manager username in output JSON.
Model explicit exception state and preserve parsed evidence for review.

Explanation

Correct Answer

Model a real human-review exception state, retaining parsed evidence and workflow identity for authenticated escalation and resumption.

Incorrect Answers

A pending exception is not an approval.

The reviewer needs the evidence to adjudicate the case.

A generated name does not supply independent human authorization.

Pass Your Amazon AWS Certified Generative AI Developer - Professional AIP-C01 Exam Easy!

Question 260

Explanation

Correct Answer

Incorrect Answers

Question 261

Explanation

Correct Answer

Incorrect Answers

Question 262

Explanation

Correct Answer

Incorrect Answers

Question 263

Explanation

Correct Answer

Incorrect Answers

Question 264

Explanation

Correct Answer

Incorrect Answers

Question 265

Explanation

Correct Answer

Incorrect Answers

Question 266

Explanation

Correct Answer

Incorrect Answers

Question 267

Explanation

Correct Answer

Incorrect Answers

Question 268

Explanation

Correct Answer

Incorrect Answers

Question 269

Explanation

Correct Answer

Incorrect Answers

Question 270

Explanation

Correct Answer

Incorrect Answers

AWS Certified Generative AI Developer - Professional AIP-C01 Practice Tests