Topic 11 Practice Test 1 covers AI Governance, Compliance, Lineage, Auditability, Fairness, and Responsible AI in Domain 3 (Tasks 3.3-3.4). For broader exam preparation, review the AIP-C01 Exam Dumps. Every option includes focused technical reasoning tied to the tested decision.
Question 1
An internal FM is approved for employee document summarization but prohibited from making customer credit decisions. Auditors need that boundary recorded with model risk and evaluation evidence. Which approach best satisfies the requirement? Choose ONE.
- SageMaker Model Card intended-use record
- Tamper-resistant audit archive
- Output policy filter
- Human evaluation for subjective harm review
Correct Answer: A
Correct Answer
Answer A is correct because SageMaker Model Card intended-use record: documents a model’s purpose, intended and disallowed uses, risk rating, evaluation evidence, and other governance details in a structured lifecycle artifact. T11P1Q01 needs document approved and prohibited use cases in a model-governance artifact; it directly fits because it will capture the restrictions and supporting evidence in a SageMaker Model Card.
Incorrect Answers
Answer B is incorrect because Tamper-resistant audit archive: stores finalized audit evidence under retention controls that prevent ordinary modification or premature deletion. Best used when regulators require retained AI decision records to resist alteration during the mandated period; T11P1Q01 instead needs document approved and prohibited use cases in a model-governance artifact, so it misses the deciding constraint.
Answer C is incorrect because Output policy filter: evaluates generated content against explicit organizational rules before it reaches the user or downstream system. Best used when the organization must enforce a policy beyond the base model’s default behavior; T11P1Q01 instead needs document approved and prohibited use cases in a model-governance artifact, so it misses the deciding constraint.
Answer D is incorrect because Human evaluation for subjective harm review: uses qualified reviewers when nuanced, contextual, or high-impact judgments are not adequately captured by automated metrics. Best used when governance needs defensible review of ambiguous outputs where machine scoring is insufficient; T11P1Q01 instead needs document approved and prohibited use cases in a model-governance artifact, so it misses the deciding constraint.
Question 2
A model’s risk rating changes after a new evaluation, and compliance must preserve the card that was approved last quarter. What should the developer implement? Choose ONE.
- Governance exception register
- Versioned SageMaker Model Card update
- Governance owner and approval metadata
- Longitudinal fairness baseline
Correct Answer: B
Correct Answer
Answer B is correct because Versioned SageMaker Model Card update: creates a new model-card version when governed details change, preserving prior versions as an immutable audit history. T11P1Q02 needs record the new governance assessment without destroying the prior approved record; it directly fits because it will update the SageMaker Model Card so the change is stored as a new version.
Incorrect Answers
Answer A is incorrect because Governance exception register: records approved deviations from standard policy with scope, justification, owner, expiration, and compensating controls. Best used when temporary exceptions must remain visible and automatically come back for review; T11P1Q02 instead needs record the new governance assessment without destroying the prior approved record, so it misses the deciding constraint.
Answer C is incorrect because Governance owner and approval metadata: assigns accountable owners, reviewers, and approval state to AI assets so policy exceptions and lifecycle decisions have clear responsibility. Best used when an organization needs a named decision-maker for each production GenAI system; T11P1Q02 instead needs record the new governance assessment without destroying the prior approved record, so it misses the deciding constraint.
Answer D is incorrect because Longitudinal fairness baseline: compares current fairness measurements with an approved baseline so governance can detect drift rather than evaluate each snapshot in isolation. Best used when the organization needs to know whether disparity is worsening over time; T11P1Q02 instead needs record the new governance assessment without destroying the prior approved record, so it misses the deciding constraint.
Question 3
A reviewer needs to determine exactly which training data URI and training job produced a model currently deployed to an endpoint. Which design most directly addresses the constraint? Choose ONE.
- Policy-as-code deployment gate
- SageMaker lineage graph
- Representative fairness dataset
- Evidence-backed source citations
Correct Answer: B
Correct Answer
Answer B is correct because SageMaker lineage graph: tracks relationships among datasets, processing or training activities, models, and deployments so model provenance can be reconstructed. T11P1Q03 needs reconstruct technical model provenance from deployment back to source artifacts; it directly fits because it will use SageMaker AI lineage tracking and its lineage graph.
Incorrect Answers
Answer A is incorrect because Policy-as-code deployment gate: evaluates machine-readable governance requirements in the delivery path and blocks releases that violate mandatory controls. Best used when organizational policy must be enforced consistently before production deployment; T11P1Q03 instead needs reconstruct technical model provenance from deployment back to source artifacts, so it misses the deciding constraint.
Answer C is incorrect because Representative fairness dataset: includes realistic cases from relevant user groups so fairness evaluation measures the populations and scenarios the system will actually encounter. Best used when a balanced synthetic set that omits important user groups can give false assurance; T11P1Q03 instead needs reconstruct technical model provenance from deployment back to source artifacts, so it misses the deciding constraint.
Answer D is incorrect because Evidence-backed source citations: presents the evidence or source attribution supporting a generated answer so users can verify important claims. Best used when transparency requires users to see where a factual answer came from; T11P1Q03 instead needs reconstruct technical model provenance from deployment back to source artifacts, so it misses the deciding constraint.
Question 4
A RAG service uses dozens of S3 datasets, and compliance wants each approved source registered with owner, classification, and business description. What is the most appropriate implementation? Choose ONE.
- AWS Glue Data Catalog source registration
- Central model inventory
- Bedrock Guardrail policy enforcement
- Confidence and uncertainty telemetry
Correct Answer: A
Correct Answer
Answer A is correct because AWS Glue Data Catalog source registration: registers governed datasets and metadata in a searchable catalog so data sources have stable identities and descriptions. T11P1Q04 needs maintain a cataloged inventory of approved source datasets; it directly fits because it will register and govern the sources in the AWS Glue Data Catalog.
Incorrect Answers
Answer B is incorrect because Central model inventory: maintains a governed inventory of deployed or approved AI assets with owners, versions, risk classifications, and lifecycle state. Best used when oversight teams need to know what AI systems actually exist across the organization; T11P1Q04 instead needs maintain a cataloged inventory of approved source datasets, so it misses the deciding constraint.
Answer C is incorrect because Bedrock Guardrail policy enforcement: applies configured content, denied-topic, sensitive-information, prompt-attack, and related safeguards consistently during supported model interactions. Best used when responsible-AI policy requires a reusable runtime control around model inputs and outputs; T11P1Q04 instead needs maintain a cataloged inventory of approved source datasets, so it misses the deciding constraint.
Answer D is incorrect because Confidence and uncertainty telemetry: captures calibrated confidence or uncertainty indicators so downstream logic and operators can distinguish strong evidence from uncertain output. Best used when the system must expose uncertainty rather than present every response with equal certainty; T11P1Q04 instead needs maintain a cataloged inventory of approved source datasets, so it misses the deciding constraint.
Question 5
A policy assistant retrieves passages from several repositories, and every answer must identify the authoritative document IDs used as evidence. Which solution best fits this production requirement? Choose ONE.
- Risk-tiered approval workflow
- Source-attribution metadata tags
- IAM-enforced guardrail requirement
- Bedrock agent trace
Correct Answer: B
Correct Answer
Answer B is correct because Source-attribution metadata tags: carries source identifiers or provenance metadata with content so downstream retrieval and generation can report where evidence originated. T11P1Q05 needs preserve document-level source identity through retrieval and generation; it directly fits because it will attach source-attribution metadata to indexed content and propagate it with retrieved evidence.
Incorrect Answers
Answer A is incorrect because Risk-tiered approval workflow: applies stronger review requirements to higher-impact AI uses instead of treating every use case identically. Best used when governance effort should reflect the consequence of the proposed AI decision; T11P1Q05 instead needs preserve document-level source identity through retrieval and generation, so it misses the deciding constraint.
Answer C is incorrect because IAM-enforced guardrail requirement: uses the Bedrock guardrail condition key in IAM so specified inference calls are denied if the required guardrail identifier is omitted. Best used when developers must not be able to bypass the organization’s mandatory guardrail accidentally; T11P1Q05 instead needs preserve document-level source identity through retrieval and generation, so it misses the deciding constraint.
Answer D is incorrect because Bedrock agent trace: captures agent orchestration details such as tool selection and intermediate execution steps for supported troubleshooting and transparency workflows. Best used when developers or reviewers need trace evidence of how an agent executed its workflow; T11P1Q05 instead needs preserve document-level source identity through retrieval and generation, so it misses the deciding constraint.
Question 6
A guardrail configuration was altered before an incident, and auditors need to identify which AWS principal made the control-plane change. Which approach best satisfies the requirement? Choose ONE.
- Automated misuse detection
- User-facing rationale summary
- AWS CloudTrail API audit history
- Model limitations in model card
Correct Answer: C
Correct Answer
Answer C is correct because AWS CloudTrail API audit history: records supported AWS API activity with caller, time, source, request context, and affected resources for security and compliance review. T11P1Q06 needs trace governance-related AWS API changes to the acting identity; it directly fits because it will use AWS CloudTrail event history or trails for the relevant service actions.
Incorrect Answers
Answer A is incorrect because Automated misuse detection: continuously analyzes usage or outputs for patterns that indicate prohibited behavior, abuse, or policy violations. Best used when governance requires ongoing detection after deployment rather than a one-time prelaunch review; T11P1Q06 instead needs trace governance-related AWS API changes to the acting identity, so it misses the deciding constraint.
Answer B is incorrect because User-facing rationale summary: provides a concise explanation of the factors or evidence behind an AI result without exposing protected implementation secrets or raw internal reasoning. Best used when users need understandable transparency about a consequential recommendation; T11P1Q06 instead needs trace governance-related AWS API changes to the acting identity, so it misses the deciding constraint.
Answer D is incorrect because Model limitations in model card: documents known limitations, excluded uses, assumptions, risks, and evaluation findings so consumers understand where the model should not be trusted. Best used when responsible deployment requires communicating boundaries, not only benchmark strengths; T11P1Q06 instead needs trace governance-related AWS API changes to the acting identity, so it misses the deciding constraint.
Question 7
A regulated assistant routes requests through custom policy checks, and compliance requires a timestamped record of each allow, block, and escalation outcome. What should the developer implement? Choose ONE.
- Uncertainty disclosure with escalation
- Automated Lambda compliance check
- Bias drift monitoring
- CloudWatch decision logging
Correct Answer: D
Correct Answer
Answer D is correct because CloudWatch decision logging: collects application decision records and operational evidence that can be queried for review, alerts, and compliance reporting. T11P1Q07 needs retain searchable runtime decision evidence for later audit; it directly fits because it will emit structured governance decisions to CloudWatch Logs with correlation identifiers.
Incorrect Answers
Answer A is incorrect because Uncertainty disclosure with escalation: tells the user when evidence is insufficient and routes the case to a safer fallback instead of presenting speculation as fact. Best used when responsible behavior requires acknowledging when the system cannot support a reliable answer; T11P1Q07 instead needs retain searchable runtime decision evidence for later audit, so it misses the deciding constraint.
Answer B is incorrect because Automated Lambda compliance check: runs custom deterministic policy logic when an organization needs a control not natively represented by the model service. Best used when a deployment rule can be expressed programmatically and must be checked before AI output proceeds; T11P1Q07 instead needs retain searchable runtime decision evidence for later audit, so it misses the deciding constraint.
Answer C is incorrect because Bias drift monitoring: tracks fairness-related measurements over time so changing traffic, data, or model behavior can reveal emerging disparities. Best used when a system passed fairness evaluation initially but its population mix and prompts change over months; T11P1Q07 instead needs retain searchable runtime decision evidence for later audit, so it misses the deciding constraint.
Question 8
A bank must keep completed model decision logs for seven years and demonstrate that application operators cannot rewrite historical records. Which design most directly addresses the constraint? Choose ONE.
- Versioned guardrail promotion
- Evidence snippet presentation
- Tamper-resistant audit archive
- Automated governance alert and remediation
Correct Answer: C
Correct Answer
Answer C is correct because Tamper-resistant audit archive: stores finalized audit evidence under retention controls that prevent ordinary modification or premature deletion. T11P1Q08 needs protect finalized audit evidence from routine alteration or early deletion; it directly fits because it will archive the logs in storage configured with appropriate immutable retention controls.
Incorrect Answers
Answer A is incorrect because Versioned guardrail promotion: creates a stable guardrail version from a tested draft so production applications can reference an approved configuration snapshot. Best used when policy changes must be tested before they affect live traffic; T11P1Q08 instead needs protect finalized audit evidence from routine alteration or early deletion, so it misses the deciding constraint.
Answer B is incorrect because Evidence snippet presentation: shows the relevant source excerpts that support an answer so reviewers can compare the generated claim with underlying material. Best used when citations alone are too opaque for a high-stakes review workflow; T11P1Q08 instead needs protect finalized audit evidence from routine alteration or early deletion, so it misses the deciding constraint.
Answer D is incorrect because Automated governance alert and remediation: connects detected violations to notifications, containment, rollback, or human review so governance findings produce timely action. Best used when a policy breach must trigger an operational response rather than only create a dashboard entry; T11P1Q08 instead needs protect finalized audit evidence from routine alteration or early deletion, so it misses the deciding constraint.
Question 9
Several teams share one model, but nobody is accountable for approving risky use-case changes or accepting residual risk. What is the most appropriate implementation? Choose ONE.
- Governance owner and approval metadata
- Human review for high-impact exception
- Fairness metric by protected cohort
- Token-level sensitive-data redaction
Correct Answer: A
Correct Answer
Answer A is correct because Governance owner and approval metadata: assigns accountable owners, reviewers, and approval state to AI assets so policy exceptions and lifecycle decisions have clear responsibility. T11P1Q09 needs establish explicit accountability for governance decisions; it directly fits because it will record an owner, required approvers, and lifecycle approval state for the AI asset.
Incorrect Answers
Answer B is incorrect because Human review for high-impact exception: routes cases beyond automated policy confidence or authority to an accountable human reviewer before a consequential action is taken. Best used when the AI system must not autonomously decide certain high-risk exceptions; T11P1Q09 instead needs establish explicit accountability for governance decisions, so it misses the deciding constraint.
Answer C is incorrect because Fairness metric by protected cohort: measures outcome or quality differences across relevant groups instead of averaging all users together. Best used when bias can be hidden by a strong overall score; T11P1Q09 instead needs establish explicit accountability for governance decisions, so it misses the deciding constraint.
Answer D is incorrect because Token-level sensitive-data redaction: removes or masks sensitive spans before they are persisted or exposed, reducing the amount of regulated content in governance logs and outputs. Best used when compliance requires detailed logs without retaining raw secrets or personal identifiers; T11P1Q09 instead needs establish explicit accountability for governance decisions, so it misses the deciding constraint.
Question 10
Every GenAI release must prove that logging, approved model IDs, and required guardrails are configured before promotion. Which solution best fits this production requirement? Choose ONE.
- Policy version correlation
- Fairness slice intersection analysis
- AI response logging with correlation IDs
- Policy-as-code deployment gate
Correct Answer: D
Correct Answer
Answer D is correct because Policy-as-code deployment gate: evaluates machine-readable governance requirements in the delivery path and blocks releases that violate mandatory controls. T11P1Q10 needs prevent noncompliant deployments rather than discover them after release; it directly fits because it will run automated policy checks in CI/CD and fail promotion when required controls are absent.
Incorrect Answers
Answer A is incorrect because Policy version correlation: records the exact policy or guardrail version alongside each decision so later audits can reproduce which rules were active. Best used when governance controls change over time and a generic resource name is insufficient for reconstruction; T11P1Q10 instead needs prevent noncompliant deployments rather than discover them after release, so it misses the deciding constraint.
Answer B is incorrect because Fairness slice intersection analysis: evaluates intersections of attributes when a broad group metric could hide a problem affecting a smaller subgroup. Best used when responsible-AI review needs sufficient granularity to detect localized disparities; T11P1Q10 instead needs prevent noncompliant deployments rather than discover them after release, so it misses the deciding constraint.
Answer C is incorrect because AI response logging with correlation IDs: records model outputs together with request, model, policy, and trace identifiers so reviewers can reconstruct a production interaction. Best used when an incident team must connect a disputed answer to the exact invocation and control configuration; T11P1Q10 instead needs prevent noncompliant deployments rather than discover them after release, so it misses the deciding constraint.
Question 11
Risk management cannot answer how many production FMs are in use or which business units own them. Which approach best satisfies the requirement? Choose ONE.
- Output policy filter
- Predeployment responsible-AI approval gate
- Central model inventory
- Prompt A/B fairness test
Correct Answer: C
Correct Answer
Answer C is correct because Central model inventory: maintains a governed inventory of deployed or approved AI assets with owners, versions, risk classifications, and lifecycle state. T11P1Q11 needs create an authoritative enterprise inventory of AI assets; it directly fits because it will maintain a centralized governed model/system inventory with ownership and status metadata.
Incorrect Answers
Answer A is incorrect because Output policy filter: evaluates generated content against explicit organizational rules before it reaches the user or downstream system. Best used when the organization must enforce a policy beyond the base model’s default behavior; T11P1Q11 instead needs create an authoritative enterprise inventory of AI assets, so it misses the deciding constraint.
Answer B is incorrect because Predeployment responsible-AI approval gate: requires documented review of model limitations, fairness evidence, safety controls, and ownership before a production release is authorized. Best used when responsible-AI evidence must be evaluated before users are exposed to a new model or prompt configuration; T11P1Q11 instead needs create an authoritative enterprise inventory of AI assets, so it misses the deciding constraint.
Answer D is incorrect because Prompt A/B fairness test: runs controlled prompt variants against the same evaluation set so teams can measure whether wording changes improve fairness without guessing. Best used when a prompt change is proposed specifically to reduce disparate behavior; T11P1Q11 instead needs create an authoritative enterprise inventory of AI assets, so it misses the deciding constraint.
Question 12
A brainstorming assistant and an automated claims-recommendation system currently follow the same lightweight approval process. What should the developer implement? Choose ONE.
- Risk-tiered approval workflow
- SageMaker Model Card intended-use record
- Bedrock LLM-as-a-judge evaluation
- Governance exception register
Correct Answer: A
Correct Answer
Answer A is correct because Risk-tiered approval workflow: applies stronger review requirements to higher-impact AI uses instead of treating every use case identically. T11P1Q12 needs require proportionate governance based on use-case impact and risk; it directly fits because it will route higher-risk AI deployments through additional review and approval stages.
Incorrect Answers
Answer B is incorrect because SageMaker Model Card intended-use record: documents a model’s purpose, intended and disallowed uses, risk rating, evaluation evidence, and other governance details in a structured lifecycle artifact. Best used when reviewers need one governed record explaining where a model may and may not be used; T11P1Q12 instead needs require proportionate governance based on use-case impact and risk, so it misses the deciding constraint.
Answer C is incorrect because Bedrock LLM-as-a-judge evaluation: uses a separate evaluator model to score generator responses against selected evaluation criteria and provide scoring explanations. Best used when large-scale qualitative assessment needs automated comparative scoring with a defined rubric; T11P1Q12 instead needs require proportionate governance based on use-case impact and risk, so it misses the deciding constraint.
Answer D is incorrect because Governance exception register: records approved deviations from standard policy with scope, justification, owner, expiration, and compensating controls. Best used when temporary exceptions must remain visible and automatically come back for review; T11P1Q12 instead needs require proportionate governance based on use-case impact and risk, so it misses the deciding constraint.
Question 13
A public GenAI API was compliant at launch, but regulators require continuous detection of repeated attempts to use it for prohibited activities. Which design most directly addresses the constraint? Choose ONE.
- Evidence-backed source citations
- Human evaluation for subjective harm review
- Versioned SageMaker Model Card update
- Automated misuse detection
Correct Answer: D
Correct Answer
Answer D is correct because Automated misuse detection: continuously analyzes usage or outputs for patterns that indicate prohibited behavior, abuse, or policy violations. T11P1Q13 needs identify policy misuse while the system is operating; it directly fits because it will monitor production activity with automated misuse and policy-violation detection.
Incorrect Answers
Answer A is incorrect because Evidence-backed source citations: presents the evidence or source attribution supporting a generated answer so users can verify important claims. Best used when transparency requires users to see where a factual answer came from; T11P1Q13 instead needs identify policy misuse while the system is operating, so it misses the deciding constraint.
Answer B is incorrect because Human evaluation for subjective harm review: uses qualified reviewers when nuanced, contextual, or high-impact judgments are not adequately captured by automated metrics. Best used when governance needs defensible review of ambiguous outputs where machine scoring is insufficient; T11P1Q13 instead needs identify policy misuse while the system is operating, so it misses the deciding constraint.
Answer C is incorrect because Versioned SageMaker Model Card update: creates a new model-card version when governed details change, preserving prior versions as an immutable audit history. Best used when governance must retain what reviewers previously approved rather than overwrite it; T11P1Q13 instead needs identify policy misuse while the system is operating, so it misses the deciding constraint.
Question 14
A hiring-assistance tool met launch thresholds, yet compliance wants alerts if outcome disparities across demographic slices worsen in production. What is the most appropriate implementation? Choose ONE.
- SageMaker lineage graph
- Bias drift monitoring
- Confidence and uncertainty telemetry
- Longitudinal fairness baseline
Correct Answer: B
Correct Answer
Answer B is correct because Bias drift monitoring: tracks fairness-related measurements over time so changing traffic, data, or model behavior can reveal emerging disparities. T11P1Q14 needs detect emerging fairness degradation after deployment; it directly fits because it will compute and monitor fairness metrics by relevant cohort over time.
Incorrect Answers
Answer A is incorrect because SageMaker lineage graph: tracks relationships among datasets, processing or training activities, models, and deployments so model provenance can be reconstructed. Best used when an auditor must trace a deployed model back through the artifacts and jobs that produced it; T11P1Q14 instead needs detect emerging fairness degradation after deployment, so it misses the deciding constraint.
Answer C is incorrect because Confidence and uncertainty telemetry: captures calibrated confidence or uncertainty indicators so downstream logic and operators can distinguish strong evidence from uncertain output. Best used when the system must expose uncertainty rather than present every response with equal certainty; T11P1Q14 instead needs detect emerging fairness degradation after deployment, so it misses the deciding constraint.
Answer D is incorrect because Longitudinal fairness baseline: compares current fairness measurements with an approved baseline so governance can detect drift rather than evaluate each snapshot in isolation. Best used when the organization needs to know whether disparity is worsening over time; T11P1Q14 instead needs detect emerging fairness degradation after deployment, so it misses the deciding constraint.
Question 15
When prohibited-output rate crosses the approved threshold, the application must notify owners and automatically switch to a safer configuration. Which solution best fits this production requirement? Choose ONE.
- Automated governance alert and remediation
- Representative fairness dataset
- AWS Glue Data Catalog source registration
- Bedrock agent trace
Correct Answer: A
Correct Answer
Answer A is correct because Automated governance alert and remediation: connects detected violations to notifications, containment, rollback, or human review so governance findings produce timely action. T11P1Q15 needs turn a governance signal into a bounded corrective workflow; it directly fits because it will connect the alert to automated remediation or escalation through an orchestrated workflow.
Incorrect Answers
Answer B is incorrect because Representative fairness dataset: includes realistic cases from relevant user groups so fairness evaluation measures the populations and scenarios the system will actually encounter. Best used when a balanced synthetic set that omits important user groups can give false assurance; T11P1Q15 instead needs turn a governance signal into a bounded corrective workflow, so it misses the deciding constraint.
Answer C is incorrect because AWS Glue Data Catalog source registration: registers governed datasets and metadata in a searchable catalog so data sources have stable identities and descriptions. Best used when teams need an enterprise record of which governed source fed a GenAI workflow; T11P1Q15 instead needs turn a governance signal into a bounded corrective workflow, so it misses the deciding constraint.
Answer D is incorrect because Bedrock agent trace: captures agent orchestration details such as tool selection and intermediate execution steps for supported troubleshooting and transparency workflows. Best used when developers or reviewers need trace evidence of how an agent executed its workflow; T11P1Q15 instead needs turn a governance signal into a bounded corrective workflow, so it misses the deciding constraint.
Question 16
Decision logs must preserve prompts for audit, but customer account numbers cannot be stored in clear text. Which approach best satisfies the requirement? Choose ONE.
- Source-attribution metadata tags
- Token-level sensitive-data redaction
- User-facing rationale summary
- Bedrock Guardrail policy enforcement
Correct Answer: B
Correct Answer
Answer B is correct because Token-level sensitive-data redaction: removes or masks sensitive spans before they are persisted or exposed, reducing the amount of regulated content in governance logs and outputs. T11P1Q16 needs retain useful audit context while excluding sensitive token values; it directly fits because it will redact or tokenize sensitive spans before writing the governed log record.
Incorrect Answers
Answer A is incorrect because Source-attribution metadata tags: carries source identifiers or provenance metadata with content so downstream retrieval and generation can report where evidence originated. Best used when generated content must be traceable to the specific documents that supported it; T11P1Q16 instead needs retain useful audit context while excluding sensitive token values, so it misses the deciding constraint.
Answer C is incorrect because User-facing rationale summary: provides a concise explanation of the factors or evidence behind an AI result without exposing protected implementation secrets or raw internal reasoning. Best used when users need understandable transparency about a consequential recommendation; T11P1Q16 instead needs retain useful audit context while excluding sensitive token values, so it misses the deciding constraint.
Answer D is incorrect because Bedrock Guardrail policy enforcement: applies configured content, denied-topic, sensitive-information, prompt-attack, and related safeguards consistently during supported model interactions. Best used when responsible-AI policy requires a reusable runtime control around model inputs and outputs; T11P1Q16 instead needs retain useful audit context while excluding sensitive token values, so it misses the deciding constraint.
Question 17
A customer challenges an AI-generated recommendation, and auditors need the response, model version, request ID, and policy version used at that moment. What should the developer implement? Choose ONE.
- IAM-enforced guardrail requirement
- AWS CloudTrail API audit history
- AI response logging with correlation IDs
- Uncertainty disclosure with escalation
Correct Answer: C
Correct Answer
Answer C is correct because AI response logging with correlation IDs: records model outputs together with request, model, policy, and trace identifiers so reviewers can reconstruct a production interaction. T11P1Q17 needs reconstruct the exact production decision context; it directly fits because it will log the response and governance metadata under a shared correlation identifier.
Incorrect Answers
Answer A is incorrect because IAM-enforced guardrail requirement: uses the Bedrock guardrail condition key in IAM so specified inference calls are denied if the required guardrail identifier is omitted. Best used when developers must not be able to bypass the organization’s mandatory guardrail accidentally; T11P1Q17 instead needs reconstruct the exact production decision context, so it misses the deciding constraint.
Answer B is incorrect because AWS CloudTrail API audit history: records supported AWS API activity with caller, time, source, request context, and affected resources for security and compliance review. Best used when investigators need to know which identity changed a governed AI resource; T11P1Q17 instead needs reconstruct the exact production decision context, so it misses the deciding constraint.
Answer D is incorrect because Uncertainty disclosure with escalation: tells the user when evidence is insufficient and routes the case to a safer fallback instead of presenting speculation as fact. Best used when responsible behavior requires acknowledging when the system cannot support a reliable answer; T11P1Q17 instead needs reconstruct the exact production decision context, so it misses the deciding constraint.
Question 18
A corporate assistant may discuss products but must never produce unreviewed forward-looking earnings guidance. Which design most directly addresses the constraint? Choose ONE.
- Evidence snippet presentation
- Model limitations in model card
- Output policy filter
- CloudWatch decision logging
Correct Answer: C
Correct Answer
Answer C is correct because Output policy filter: evaluates generated content against explicit organizational rules before it reaches the user or downstream system. T11P1Q18 needs apply an organization-specific rule at the output boundary; it directly fits because it will run generated content through an approved policy filter before release.
Incorrect Answers
Answer A is incorrect because Evidence snippet presentation: shows the relevant source excerpts that support an answer so reviewers can compare the generated claim with underlying material. Best used when citations alone are too opaque for a high-stakes review workflow; T11P1Q18 instead needs apply an organization-specific rule at the output boundary, so it misses the deciding constraint.
Answer B is incorrect because Model limitations in model card: documents known limitations, excluded uses, assumptions, risks, and evaluation findings so consumers understand where the model should not be trusted. Best used when responsible deployment requires communicating boundaries, not only benchmark strengths; T11P1Q18 instead needs apply an organization-specific rule at the output boundary, so it misses the deciding constraint.
Answer D is incorrect because CloudWatch decision logging: collects application decision records and operational evidence that can be queried for review, alerts, and compliance reporting. Best used when the application must retain why a policy path accepted, blocked, or escalated an AI request; T11P1Q18 instead needs apply an organization-specific rule at the output boundary, so it misses the deciding constraint.
Question 19
A team receives a 30-day exception to use a nonstandard model while a migration is completed. What is the most appropriate implementation? Choose ONE.
- Fairness metric by protected cohort
- Tamper-resistant audit archive
- Automated Lambda compliance check
- Governance exception register
Correct Answer: D
Correct Answer
Answer D is correct because Governance exception register: records approved deviations from standard policy with scope, justification, owner, expiration, and compensating controls. T11P1Q19 needs make the exception auditable and time-bounded rather than an informal agreement; it directly fits because it will record the exception with owner, rationale, compensating controls, and expiration date.
Incorrect Answers
Answer A is incorrect because Fairness metric by protected cohort: measures outcome or quality differences across relevant groups instead of averaging all users together. Best used when bias can be hidden by a strong overall score; T11P1Q19 instead needs make the exception auditable and time-bounded rather than an informal agreement, so it misses the deciding constraint.
Answer B is incorrect because Tamper-resistant audit archive: stores finalized audit evidence under retention controls that prevent ordinary modification or premature deletion. Best used when regulators require retained AI decision records to resist alteration during the mandated period; T11P1Q19 instead needs make the exception auditable and time-bounded rather than an informal agreement, so it misses the deciding constraint.
Answer C is incorrect because Automated Lambda compliance check: runs custom deterministic policy logic when an organization needs a control not natively represented by the model service. Best used when a deployment rule can be expressed programmatically and must be checked before AI output proceeds; T11P1Q19 instead needs make the exception auditable and time-bounded rather than an informal agreement, so it misses the deciding constraint.
Question 20
An internal policy assistant answers HR questions, and employees must be able to inspect the policy documents supporting each response. Which solution best fits this production requirement? Choose ONE.
- Fairness slice intersection analysis
- Governance owner and approval metadata
- Versioned guardrail promotion
- Evidence-backed source citations
Correct Answer: D
Correct Answer
Answer D is correct because Evidence-backed source citations: presents the evidence or source attribution supporting a generated answer so users can verify important claims. T11P1Q20 needs make important generated claims verifiable by the user; it directly fits because it will show citations that link the answer to the retrieved authoritative evidence.
Incorrect Answers
Answer A is incorrect because Fairness slice intersection analysis: evaluates intersections of attributes when a broad group metric could hide a problem affecting a smaller subgroup. Best used when responsible-AI review needs sufficient granularity to detect localized disparities; T11P1Q20 instead needs make important generated claims verifiable by the user, so it misses the deciding constraint.
Answer B is incorrect because Governance owner and approval metadata: assigns accountable owners, reviewers, and approval state to AI assets so policy exceptions and lifecycle decisions have clear responsibility. Best used when an organization needs a named decision-maker for each production GenAI system; T11P1Q20 instead needs make important generated claims verifiable by the user, so it misses the deciding constraint.
Answer C is incorrect because Versioned guardrail promotion: creates a stable guardrail version from a tested draft so production applications can reference an approved configuration snapshot. Best used when policy changes must be tested before they affect live traffic; T11P1Q20 instead needs make important generated claims verifiable by the user, so it misses the deciding constraint.
