Topic 09 Practice Test 3 covers Guardrails, Prompt-Injection Defense, Output Safety, Grounding, and Hallucination Controls in Domain 3 (Task 3.1). For broader exam preparation, review the AIP-C01 Exam Dumps. Every option includes focused technical reasoning tied to the tested decision.
Question 1
A customer portal must detect a proprietary employee identifier that follows the pattern EMP-[0-9]{8} and mask it before the text reaches the model. Which guardrail feature is the closest fit? Choose ONE.
- Amazon Bedrock Guardrails denied topics
- Guardrails sensitive-information custom regex filter
- Deterministic request schema validation
- Amazon Bedrock Guardrails word filters
Correct Answer: B
Correct Answer
Answer B is correct because Guardrails sensitive-information custom regex filter provides the required mechanism because the sensitive-information filter supports custom regular expressions for structured patterns and can block or mask detected values. It solves that objective directly rather than relying on a control whose primary purpose is elsewhere in the safety architecture.
Incorrect Answers
Answer A is incorrect because Amazon Bedrock Guardrails denied topics can strengthen a system through blocking semantically defined subjects that the application is not allowed to discuss, such as investment advice for a retail-banking bot. Because it is not intended to match one literal word or entity name, this choice would address a neighboring risk and leave the central requirement unmet.
Answer C is incorrect because Deterministic request schema validation solves problems involving requiring the incoming payload to match allowed fields, types, sizes, and enum values before any prompt is assembled. Here the exact requirement is pattern-based sensitive identifier detection. Its limitation is that it does not detect adversarial natural-language intent by itself, so the application would still be missing the mechanism the question asks for.
Answer D is incorrect because Amazon Bedrock Guardrails word filters is a reasonable control for blocking exact custom words or phrases, including organization-specific terms that must never appear in an interaction. The mismatch is that it does not reason about a broad topic semantically; therefore the required safety decision would still depend on another component.
Question 2
A workflow expects the model to return an object with exactly action, resource, and confidence fields using approved types. Malformed output must never reach automation. What should enforce this contract? Choose ONE.
- Bedrock Guardrails contextual grounding check
- Deterministic output allowlist validation
- Amazon Bedrock Guardrails output content filters
- JSON Schema constrained output validation
Correct Answer: D
Correct Answer
Answer D is correct because The scenario is best handled by JSON Schema constrained output validation. JSON Schema validation can reject missing fields, wrong types, and unexpected structure before downstream code consumes the output. Its relevance comes from the need for structured response-contract enforcement; the schema protects interface integrity even though factual correctness still requires separate verification.
Incorrect Answers
Answer A is incorrect because Bedrock Guardrails contextual grounding check is appropriate for scoring whether a response is supported by supplied grounding source content and filtering responses below the configured grounding threshold. This requirement instead centers on structured response-contract enforcement. Since the check requires a grounding source, query, and response; it is not merely a generic content filter, it belongs elsewhere in the design and does not meet the scenario’s primary safety objective.
Answer B is incorrect because Deterministic output allowlist validation supports accepting only explicitly permitted values, actions, or categories from model output before downstream execution, which is useful in the right context. Since it is unsuitable for broad free-form safety classification on its own, it addresses a separate concern and is not the control that closes this gap.
Answer C is incorrect because The value of Amazon Bedrock Guardrails output content filters is evaluating generated text against harmful-content categories before the response is delivered. Since it does not prove that every factual claim is supported by a reference source, the design would still need a different control to satisfy the question.
Question 3
A travel assistant must quote today’s approved exchange-rate table, which changes several times per day. The requirement is current authoritative data, not the model’s remembered value. What should the application do? Choose ONE.
- Bedrock Guardrails contextual grounding check
- Amazon Bedrock Knowledge Bases retrieval grounding
- Authoritative runtime data retrieval
- Confidence or uncertainty scoring with a decision threshold
Correct Answer: C
Correct Answer
Answer C is correct because Authoritative runtime data retrieval is the strongest fit because authoritative runtime retrieval obtains the value at request time from the source that owns it, avoiding stale model memory. The deciding requirement is retrieve volatile facts from the current system of record. a model can then format the result without becoming the source of truth.
Incorrect Answers
Answer A is incorrect because Bedrock Guardrails contextual grounding check is a reasonable control for scoring whether a response is supported by supplied grounding source content and filtering responses below the configured grounding threshold. However, this workload specifically calls for retrieve volatile facts from the current system of record.
Answer B is incorrect because Amazon Bedrock Knowledge Bases retrieval grounding is best suited to retrieving relevant enterprise source material and supplying it as context so the model answers from managed evidence. The deciding need here is retrieve volatile facts from the current system of record.
Answer D is incorrect because Confidence or uncertainty scoring with a decision threshold can be valuable when implementing estimating answer reliability and using a calibrated threshold to accept, retry, abstain, or escalate uncertain responses. Because an uncalibrated score can create false assurance, it cannot provide the required behavior without an additional, more directly targeted safeguard.
Question 4
An agent calls a web-search tool and feeds the returned page text back into the model. Security requires the tool response to be validated before it re-enters the prompt context. Which control best addresses that boundary? Choose ONE.
- Retrieved-content isolation and sanitization
- Amazon Bedrock Guardrails prompt attack filter
- Least-privilege tool and action allowlist
- Tool-result validation before model reuse
Correct Answer: D
Correct Answer
Answer D is correct because The required control is Tool-result validation before model reuse. Here, tool results can contain malicious or malformed content, so validating or sanitizing them before reinsertion creates a safety boundary between external data and model context, which matches the need for validation of untrusted tool output before context reuse. the original user-input guardrail does not inspect content that arrives later from a tool.
Incorrect Answers
Answer A is incorrect because Retrieved-content isolation and sanitization has value for treating retrieved documents as untrusted data, stripping active instructions or suspicious control text, and separating evidence from system instructions. In contrast, this scenario depends on validation of untrusted tool output before context reuse.
Answer B is incorrect because The value of Amazon Bedrock Guardrails prompt attack filter is detecting prompt injection and jailbreak attempts intended to override developer instructions, bypass safeguards, or expose protected instructions. That does not match the key requirement, validation of untrusted tool output before context reuse.
Answer C is incorrect because Least-privilege tool and action allowlist can help with permitting only approved agent tools, methods, and parameter ranges so a manipulated prompt cannot invoke arbitrary capabilities, but the question hinges on validation of untrusted tool output before context reuse. Its limitation here is that it limits blast radius but does not detect every prompt attack.
Question 5
A public endpoint is receiving thousands of slightly varied jailbreak probes from the same source in minutes. The content filter blocks many of them, but security also wants to slow automated probing and alert on the pattern. What should be added? Choose ONE.
- Safety telemetry with automated alerting
- Amazon Bedrock Guardrails prompt attack filter
- Automated adversarial testing workflow
- Abuse-aware rate limiting and anomaly detection
Correct Answer: D
Correct Answer
Answer D is correct because Abuse-aware rate limiting and anomaly detection directly satisfies this scenario: abuse-aware rate limiting and anomaly detection reduce the speed of automated exploration while surfacing unusual safety-event patterns for investigation. The application specifically needs throttle and flag repeated adversarial probing. the content classifier still handles the semantics of individual prompts.
Incorrect Answers
Answer A is incorrect because Safety telemetry with automated alerting primarily supports recording guardrail interventions, classifier scores, and blocked attack patterns so operators can detect changing abuse and tune controls. Its shortcoming is that observability detects trends but should not be the only runtime blocking control, so choosing it would leave the requested safety or accuracy mechanism incomplete.
Answer B is incorrect because Amazon Bedrock Guardrails prompt attack filtering detects jailbreak and prompt-injection attempts, so it remains valuable as a content-safety layer. It does not, by itself, throttle a source that sends repeated probes or create source-behavior alerts. Abuse-aware rate limiting and anomaly detection directly address the automation pattern described.
Answer C is incorrect because Automated adversarial testing workflow is best suited to continuously exercising the application with prompt-injection, jailbreak, obfuscation, and policy-evasion cases to expose regressions before release. Its gap is that testing discovers weaknesses but does not replace runtime blocking; consequently, it cannot replace the control that directly addresses this condition.
Question 6
A safety team discovered that attackers bypass a simple lexical filter by mixing Unicode look-alikes and unusual whitespace. What preprocessing step most directly closes this evasion path before classification? Choose ONE.
- Input normalization before safety evaluation
- Human moderation escalation for ambiguous inputs
- Amazon Bedrock Guardrails denied topics
- Amazon Bedrock Guardrails word filters
Correct Answer: A
Correct Answer
Answer A is correct because Choose Input normalization before safety evaluation because normalizing equivalent encodings and formatting gives downstream safety checks a stable representation to inspect. In this workload, the critical constraint is canonicalization before safety evaluation. The control therefore acts at the right point in the request-response path and targets the relevant safety mechanism.
Incorrect Answers
Answer B is incorrect because Human moderation escalation for ambiguous inputs is relevant to routing uncertain or high-impact borderline requests to a qualified reviewer when automated checks cannot confidently decide. Because it is too slow and expensive to be the sole control for every routine request, the option is technically useful but positioned for a different purpose than the control being requested.
Answer C is incorrect because Amazon Bedrock Guardrails denied topics has value for blocking semantically defined subjects that the application is not allowed to discuss, such as investment advice for a retail-banking bot. Because it is not intended to match one literal word or entity name, the choice does not align with the point where the specified risk must be controlled.
Answer D is incorrect because Use Amazon Bedrock Guardrails word filters when the goal is blocking exact custom words or phrases, including organization-specific terms that must never appear in an interaction. That is not the decisive goal in this scenario, which is canonicalization before safety evaluation. Since it does not reason about a broad topic semantically, the option does not provide the required assurance by itself.
Question 7
An AI assistant drafts a final recommendation that can materially affect a patient’s treatment plan. Automated safety filters pass, but policy still requires a qualified clinician to approve the wording before release. Which control is required? Choose ONE.
- Amazon Bedrock Guardrails output content filters
- Human review for high-impact generated output
- Specialized toxicity and content-moderation evaluation
- Fail-closed safety handling
Correct Answer: B
Correct Answer
Answer B is correct because Human review for high-impact generated output matches both the mechanism and placement required here. human review provides domain judgment for a high-impact decision where automated filters cannot alone satisfy the release policy. The scenario calls for mandatory expert review for consequential output; the automated controls remain useful upstream, but they do not replace the required accountable approval.
Incorrect Answers
Answer A is incorrect because Amazon Bedrock Guardrails output content filters is designed around evaluating generated text against harmful-content categories before the response is delivered. Its limitation is that it does not prove that every factual claim is supported by a reference source; as a result, it cannot be the primary answer to this particular scenario.
Answer C is incorrect because Specialized toxicity and content-moderation evaluation helps with measuring or classifying generated outputs for toxic or unsafe language so the application can block, score, or route them. Because it does not enforce relational database semantics, the option would not produce the requested control outcome, though it can remain part of a broader defense strategy.
Answer D is incorrect because Fail-closed safety handling is useful when withholding a response or action when a required safety control errors, times out, or returns an indeterminate result. Because it governs failure behavior rather than detecting a specific unsafe category, it would leave the deciding safety requirement unresolved even though it could still appear elsewhere in a layered design.
Question 8
A generated regulatory summary contains several factual claims. Before release, a second step must check those claims against the retrieved regulations and reject unsupported statements. Which pattern best matches the requirement? Choose ONE.
- Specialized toxicity and content-moderation evaluation
- Post-generation fact-verification step
- Bedrock Guardrails contextual grounding check
- Evidence-backed source citation
Correct Answer: B
Correct Answer
Answer B is correct because The best answer is Post-generation fact-verification step. That directly implements explicit post-generation fact verification, and this separates generation from verification so fluent wording is not mistaken for accuracy. The distinction matters because a control aimed at a different layer could leave the specified exposure unchanged.
Incorrect Answers
Answer A is incorrect because Use Specialized toxicity and content-moderation evaluation when the goal is measuring or classifying generated outputs for toxic or unsafe language so the application can block, score, or route them. Since it does not enforce relational database semantics, the option does not provide the required assurance by itself.
Answer C is incorrect because Bedrock Guardrails contextual grounding check supports scoring whether a response is supported by supplied grounding source content and filtering responses below the configured grounding threshold. That capability does not satisfy explicit post-generation fact verification. Because the check requires a grounding source, query, and response; it is not merely a generic content filter, relying on it would leave the application exposed to the failure mode called out in the question.
Answer D is incorrect because Evidence-backed source citation fits situations involving returning identifiers or references for the retrieved material supporting an answer so users or downstream checks can verify important claims. Its limitation here is that citations are only trustworthy when they are bound to the actual retrieved evidence, making it complementary rather than sufficient for the requested control.
Question 9
A customer-service agent should only call getOrder, cancelOrder, and createReturn, with tightly bounded parameters. Which safety control most directly limits damage if a prompt is manipulated? Choose ONE.
- Schema-constrained tool arguments with allowlisted values
- Amazon Bedrock Guardrails prompt attack filter
- Least-privilege tool and action allowlist
- Deterministic pre- and post-generation validation
Correct Answer: C
Correct Answer
Answer C is correct because Least-privilege tool and action allowlist is appropriate because an allowlist of approved tools and operations ensures manipulated instructions cannot invoke arbitrary capabilities outside the agent’s intended authority. The question is not asking for generic hardening; it asks for least-privilege restriction of agent capabilities. prompt-attack detection remains useful, but capability restriction limits blast radius when detection misses.
Incorrect Answers
Answer A is incorrect because Schema-constrained tool arguments with allowlisted values is intended for validating agent tool parameters against approved schemas, resources, and operations before execution. Since it constrains tool abuse but does not classify harmful prose in the final answer, it would shift attention to a different control objective and leave the stated requirement unsatisfied.
Answer B is incorrect because The normal role of Amazon Bedrock Guardrails prompt attack filter is detecting prompt injection and jailbreak attempts intended to override developer instructions, bypass safeguards, or expose protected instructions. Here the application needs least-privilege restriction of agent capabilities. Because it must be configured at the appropriate strength and applied to the content that should be evaluated, this option solves an adjacent problem rather than the one that determines the answer.
Answer D is incorrect because Deterministic pre- and post-generation validation is designed around validating requests before prompt construction and validating generated values or actions before release or execution. Its limitation is that deterministic rules cannot cover every semantic abuse pattern; as a result, it cannot be the primary answer to this particular scenario.
Question 10
The security team wants a second model dedicated to scoring adversarial intent before requests reach the production generator. Which control does this describe? Choose ONE.
- Jailbreak-focused adversarial detector
- Dedicated adversarial safety classifier
- Amazon Bedrock Guardrails prompt attack filter
- Amazon Comprehend pre-processing filter
Correct Answer: B
Correct Answer
Answer B is correct because This requirement points to Dedicated adversarial safety classifier: a dedicated safety classifier can provide a separate risk score before inference, adding a distinct detection signal beyond the primary model. the classifier must be evaluated and calibrated so its threshold reflects acceptable false positives and misses.
Incorrect Answers
Answer A is incorrect because Jailbreak-focused adversarial detector supports identifying attempts to bypass native model safety through role-play, coercion, or known jailbreak patterns before inference. Because it does not validate factual grounding of otherwise safe responses, relying on it would leave the application exposed to the failure mode called out in the question.
Answer C is incorrect because Amazon Bedrock Guardrails prompt attack filter addresses detecting prompt injection and jailbreak attempts intended to override developer instructions, bypass safeguards, or expose protected instructions. The scenario’s controlling requirement is an independent classifier specialized for adversarial safety, not that function.
Answer D is incorrect because Amazon Comprehend pre-processing filter would make sense for classifying or extracting signals from incoming text before it reaches a generative model as one layer of a safety pipeline. In the stated scenario, the determining constraint is an independent classifier specialized for adversarial safety.
Question 11
A payroll assistant must immediately reject prompts that exceed an approved size, contain disallowed field names, or violate a deterministic request contract. The checks must complete synchronously before inference. Which control is most suitable? Choose ONE.
- Step Functions and Lambda custom moderation workflow
- Human moderation escalation for ambiguous inputs
- Bedrock Guardrails contextual grounding check
- Synchronous application input validator
Correct Answer: D
Correct Answer
Answer D is correct because Synchronous application input validator fits the evidence in the scenario because a synchronous application validator can enforce size, field, and policy rules immediately before the model call. What must be achieved is fast deterministic pre-inference rejection. That is the direct control path, whereas adjacent safeguards address different inputs, outputs, or assurance goals.
Incorrect Answers
Answer A is incorrect because Step Functions and Lambda custom moderation workflow belongs in designs that need orchestrating organization-specific validation, enrichment, approvals, and branching when a single managed filter is insufficient. Because it adds workflow logic rather than serving as a simple managed content-category filter, it would be a supporting layer at best and would not satisfy the stated control objective.
Answer B is incorrect because Human moderation escalation for ambiguous inputs is intended for routing uncertain or high-impact borderline requests to a qualified reviewer when automated checks cannot confidently decide. Since it is too slow and expensive to be the sole control for every routine request, it would shift attention to a different control objective and leave the stated requirement unsatisfied.
Answer C is incorrect because Bedrock Guardrails contextual grounding check serves scoring whether a response is supported by supplied grounding source content and filtering responses below the configured grounding threshold. Since the check requires a grounding source, query, and response; it is not merely a generic content filter, it would not enforce the exact boundary described and therefore is not the best answer.
Question 12
An agent proposes one of five allowed account actions. Any other action name must be rejected before execution even if it is syntactically valid. Which control best constrains the model output? Choose ONE.
- Amazon Bedrock Guardrails output content filters
- JSON Schema constrained output validation
- Bedrock Guardrails sensitive-information masking
- Deterministic output allowlist validation
Correct Answer: D
Correct Answer
Answer D is correct because Use Deterministic output allowlist validation. a deterministic allowlist checks the semantic action value against the only operations the application permits. The decisive phrase in the requirement is allowlist enforcement for executable actions, and schema validation can confirm the field shape yet still allow a disallowed value unless the allowed set is encoded.
Incorrect Answers
Answer A is incorrect because Amazon Bedrock Guardrails output content filters solves problems involving evaluating generated text against harmful-content categories before the response is delivered. Its limitation is that it does not prove that every factual claim is supported by a reference source, so the application would still be missing the mechanism the question asks for.
Answer B is incorrect because JSON Schema constrained output validation can strengthen a system through requiring generated structured output to conform to expected fields, types, and allowed shapes before downstream automation accepts it. Because schema validity cannot prove that a semantically plausible value is factually true, this choice would address a neighboring risk and leave the central requirement unmet.
Answer C is incorrect because Bedrock Guardrails sensitive-information masking addresses detecting supported sensitive entities or configured patterns in a response and replacing them rather than exposing the original value. Since masking sensitive data does not establish factual grounding, selecting it would protect a different boundary and would not close the specific exposure described.
Question 13
A knowledge assistant’s verification score falls below the approved reliability threshold. Policy requires the system to say it cannot answer and route the case to an analyst instead of guessing. Which response policy is appropriate? Choose ONE.
- Low-confidence abstention and escalation
- Fail-closed safety handling
- Human review for high-impact generated output
- Confidence or uncertainty scoring with a decision threshold
Correct Answer: A
Correct Answer
Answer A is correct because Low-confidence abstention and escalation provides the required mechanism because low-confidence abstention turns the verification result into safe behavior by refusing to fabricate certainty and routing the case for review. The operational objective is abstain and escalate when verified confidence is insufficient. the scoring mechanism and the escalation policy are separate parts of the design.
Incorrect Answers
Answer B is incorrect because Fail-closed safety handling supports withholding a response or action when a required safety control errors, times out, or returns an indeterminate result, which is useful in the right context. The deciding requirement here is abstain and escalate when verified confidence is insufficient.
Answer C is incorrect because Human review for high-impact generated output belongs in designs that need placing a qualified reviewer before release when automated safety checks are insufficient for consequential or ambiguous content. The present requirement is narrower: abstain and escalate when verified confidence is insufficient.
Answer D is incorrect because Confidence or uncertainty scoring with a decision threshold is appropriate for estimating answer reliability and using a calibrated threshold to accept, retry, abstain, or escalate uncertain responses. Since an uncalibrated score can create false assurance, it belongs elsewhere in the design and does not meet the scenario’s primary safety objective.
Question 14
A RAG assistant ingests supplier documents that may contain phrases such as ‘ignore previous instructions’. How should the application treat retrieved text as part of defense in depth? Choose ONE.
- Amazon Bedrock Knowledge Bases retrieval grounding
- Indirect prompt-injection defense for retrieved content
- Retrieved-content isolation and sanitization
- Bedrock Guardrails guardContent scoping
Correct Answer: C
Correct Answer
Answer C is correct because The scenario is best handled by Retrieved-content isolation and sanitization. retrieved documents are data from an untrusted boundary and should be separated from trusted instructions, with suspicious directives neutralized or filtered. Its relevance comes from the need for isolate and sanitize retrieved content before it can influence instructions; retrieval alone does not make a document safe to execute as instructions.
Incorrect Answers
Answer A is incorrect because Amazon Bedrock Knowledge Bases retrieval grounding is a reasonable control for retrieving relevant enterprise source material and supplying it as context so the model answers from managed evidence. However, this workload specifically calls for isolate and sanitize retrieved content before it can influence instructions.
Answer B is incorrect because Indirect prompt-injection defense for retrieved content can be valuable when implementing separating retrieved text from instructions and filtering suspicious directives embedded inside documents before they enter the model context. The current scenario is determined by isolate and sanitize retrieved content before it can influence instructions.
Answer D is incorrect because Bedrock Guardrails guardContent scoping can strengthen a system through marking the specific message blocks that should be evaluated by configured guardrail policies when using supported Bedrock APIs. Yet the required outcome here is isolate and sanitize retrieved content before it can influence instructions.
Question 15
A jailbreak that was fixed last month reappeared after a prompt-template change. The team wants that exact attack and related variants to block future releases automatically. Which practice best prevents recurrence? Choose ONE.
- Red-team regression suite in CI/CD
- Safety telemetry with automated alerting
- Automated adversarial testing workflow
- Production canary attack probes and monitoring
Correct Answer: A
Correct Answer
Answer A is correct because Red-team regression suite in CI/CD is the strongest fit because a red-team regression suite in CI/CD preserves previously discovered failures as permanent test cases so prompt or model changes cannot silently reintroduce them. The deciding requirement is turn discovered attacks into release-blocking regression tests. production monitoring remains useful but catches the problem later.
Incorrect Answers
Answer B is incorrect because Safety telemetry with automated alerting is appropriate for recording guardrail interventions, classifier scores, and blocked attack patterns so operators can detect changing abuse and tune controls. Since observability detects trends but should not be the only runtime blocking control, it belongs elsewhere in the design and does not meet the scenario’s primary safety objective.
Answer C is incorrect because Automated adversarial testing workflow can help with continuously exercising the application with prompt-injection, jailbreak, obfuscation, and policy-evasion cases to expose regressions before release, but the question hinges on turn discovered attacks into release-blocking regression tests. It may complement the correct control, yet it cannot serve as the primary mechanism for this requirement.
Answer D is incorrect because The value of Production canary attack probes and monitoring is sending controlled adversarial probes and watching safety metrics after deployment to catch environment-specific regressions early. Since canary probes detect failures but should not expose real users to unsafe output, the design would still need a different control to satisfy the question.
Question 16
A legal-assistance workflow has rare borderline requests where automated filters disagree and a wrong decision could expose privileged information. What is the safest handling for those ambiguous inputs? Choose ONE.
- Amazon Bedrock Guardrails input content filters
- Deterministic request schema validation
- Human moderation escalation for ambiguous inputs
- Amazon Bedrock Guardrails word filters
Correct Answer: C
Correct Answer
Answer C is correct because The required control is Human moderation escalation for ambiguous inputs. Here, human escalation is appropriate when automated signals conflict and the consequence of an incorrect allow decision is unusually high, which matches the need for qualified review of ambiguous high-impact inputs. routine traffic can still use automated controls while only uncertain cases incur review latency.
Incorrect Answers
Answer A is incorrect because Amazon Bedrock Guardrails input content filters primarily supports classifying and blocking harmful categories such as hate, violence, sexual content, insults, misconduct, or prompt attacks before a supported model processes the request. This question instead asks for qualified review of ambiguous high-impact inputs.
Answer B is incorrect because Deterministic request schema validation is best suited to requiring the incoming payload to match allowed fields, types, sizes, and enum values before any prompt is assembled. Its gap is that it does not detect adversarial natural-language intent by itself; consequently, it cannot replace the control that directly addresses this condition.
Answer D is incorrect because Amazon Bedrock Guardrails word filters can be valuable when implementing blocking exact custom words or phrases, including organization-specific terms that must never appear in an interaction. Because it does not reason about a broad topic semantically, it cannot provide the required behavior without an additional, more directly targeted safeguard.
Question 17
A mandatory output-safety service becomes unavailable. The product requirement states that no unreviewed model response may be delivered during that outage. Which failure policy should the application use? Choose ONE.
- API Gateway response filtering layer
- Fail-closed safety handling
- Specialized toxicity and content-moderation evaluation
- Human review for high-impact generated output
Correct Answer: B
Correct Answer
Answer B is correct because Fail-closed safety handling directly satisfies this scenario: fail-closed handling treats an unavailable or indeterminate required safety control as a block rather than silently bypassing it. The application specifically needs withhold responses when mandatory safety checks fail. this preserves the safety boundary during faults even though availability is temporarily reduced.
Incorrect Answers
Answer A is incorrect because API Gateway response filtering layer has value for enforcing a final API-edge response policy or transformation after application processing and before data leaves the service boundary. Because it is not a model-aware hallucination detector by itself, the choice does not align with the point where the specified risk must be controlled.
Answer C is incorrect because Specialized toxicity and content-moderation evaluation can help with measuring or classifying generated outputs for toxic or unsafe language so the application can block, score, or route them, but the question hinges on withhold responses when mandatory safety checks fail. Its limitation here is that it does not enforce relational database semantics.
Answer D is incorrect because Human review for high-impact generated output is relevant to placing a qualified reviewer before release when automated safety checks are insufficient for consequential or ambiguous content. Because it introduces latency and is not the first-line automated filter for routine traffic, the option is technically useful but positioned for a different purpose than the control being requested.
Question 18
A RAG index contains superseded manuals alongside current approved versions. Retrieval must exclude obsolete documents before the model receives context. Which change most directly improves grounding quality? Choose ONE.
- Metadata-constrained retrieval
- Evidence-backed source citation
- Semantic-similarity evidence verification
- Amazon Bedrock Knowledge Bases retrieval grounding
Correct Answer: A
Correct Answer
Answer A is correct because Choose Metadata-constrained retrieval because metadata-constrained retrieval can filter by version, approval state, date, or source classification so obsolete chunks do not enter the grounding context. In this workload, the critical constraint is retrieve only authoritative current evidence. this improves the evidence set before generation rather than trying to repair stale context afterward.
Incorrect Answers
Answer B is incorrect because Evidence-backed source citation is useful when returning identifiers or references for the retrieved material supporting an answer so users or downstream checks can verify important claims. This case instead requires retrieve only authoritative current evidence. Because citations are only trustworthy when they are bound to the actual retrieved evidence, it would leave the deciding safety requirement unresolved even though it could still appear elsewhere in a layered design.
Answer C is incorrect because Semantic-similarity evidence verification primarily supports comparing generated claims or answer content with authoritative retrieved evidence and rejecting material mismatches. This question instead asks for retrieve only authoritative current evidence. Its shortcoming is that similarity is a verification signal and should not be treated as a replacement for source governance, so choosing it would leave the requested safety or accuracy mechanism incomplete.
Answer D is incorrect because Amazon Bedrock Knowledge Bases retrieval grounding helps with retrieving relevant enterprise source material and supplying it as context so the model answers from managed evidence. The requirement being tested is retrieve only authoritative current evidence. Because retrieval can improve grounding but still benefits from an explicit verification or grounding check, the option would not produce the requested control outcome, though it can remain part of a broader defense strategy.
Question 19
Operations wants to know when attackers change tactics, which guardrail policies are firing, and whether block rates suddenly spike. Which layer should be added without removing runtime controls? Choose ONE.
- Abuse-aware rate limiting and anomaly detection
- Automated adversarial testing workflow
- Safety telemetry with automated alerting
- Comprehend → Guardrails → Lambda → API Gateway layered safety path
Correct Answer: C
Correct Answer
Answer C is correct because Safety telemetry with automated alerting matches both the mechanism and placement required here. logging guardrail interventions, classifier scores, and attack indicators enables trend detection and tuning after deployment. The scenario calls for observable safety events and automated alerting; telemetry strengthens defense in depth by revealing change, while runtime filters still provide the immediate enforcement.
Incorrect Answers
Answer A is incorrect because Abuse-aware rate limiting and anomaly detection fits situations involving throttling repeated probing or high-volume adversarial traffic and flagging unusual safety-event patterns for investigation. Its limitation here is that rate controls reduce automated abuse but do not understand a single sophisticated prompt, making it complementary rather than sufficient for the requested control.
Answer B is incorrect because Automated adversarial testing workflow is relevant to continuously exercising the application with prompt-injection, jailbreak, obfuscation, and policy-evasion cases to expose regressions before release. Because testing discovers weaknesses but does not replace runtime blocking, the option is technically useful but positioned for a different purpose than the control being requested.
Answer D is incorrect because Use Comprehend → Guardrails → Lambda → API Gateway layered safety path when the goal is using distinct pre-processing, managed guardrails, custom post-processing, and API-edge controls so one failure does not become the only barrier. That is not the decisive goal in this scenario, which is observable safety events and automated alerting.
Question 20
A new model version passes staging tests, but the team worries production routing or configuration could weaken prompt-attack defenses. Which technique provides controlled post-deployment verification? Choose ONE.
- Production canary attack probes and monitoring
- Amazon Bedrock Guardrails prompt attack filter
- Red-team regression suite in CI/CD
- Abuse-aware rate limiting and anomaly detection
Correct Answer: A
Correct Answer
Answer A is correct because The best answer is Production canary attack probes and monitoring. production canary probes exercise known attack paths through the real deployed stack and monitor safety outcomes, revealing environment-specific regressions early. That directly implements controlled adversarial canary validation after deployment, and canaries supplement runtime blocking and pre-release tests rather than replacing either.
Incorrect Answers
Answer B is incorrect because Amazon Bedrock Guardrails prompt attack filtering can block or detect jailbreak and prompt-injection content during requests. The requirement here is controlled verification after deployment that production routing and configuration still preserve those defenses. Canary attack probes with monitoring test the deployed path; the filter alone does not perform that validation.
Answer C is incorrect because The normal role of Red-team regression suite in CI/CD is rerunning known successful attacks and edge cases on every release so safety regressions block promotion. Because CI testing is preventive validation rather than runtime enforcement, this option solves an adjacent problem rather than the one that determines the answer.
Answer D is incorrect because Abuse-aware rate limiting and anomaly detection is designed around throttling repeated probing or high-volume adversarial traffic and flagging unusual safety-event patterns for investigation. Its limitation is that rate controls reduce automated abuse but do not understand a single sophisticated prompt; as a result, it cannot be the primary answer to this particular scenario.
