Topic 07 Practice Test 2 covers Enterprise Integration, Event-Driven Patterns, Legacy Systems, and Data Synchronization in Domain 2 (Task 2.3). For broader exam preparation, review the AIP-C01 Exam Dumps. Every option includes focused technical reasoning tied to the tested decision.
Question 1
During a production-readiness review, engineers identify a data-handling issue. An order system should notify a GenAI enrichment workflow whenever an order changes, but the order transaction must not wait for the enrichment service. Which design is the best fit for this requirement? Choose ONE.
- AWS DataSync for scheduled on-premises file transfer
- Amazon SNS fanout for shared enterprise events
- EventBridge event-driven decoupling
- Amazon AppFlow SaaS data synchronization
Correct Answer: C
Correct Answer
Answer C is correct because EventBridge event-driven decoupling solves the right problem. It will publish business events to a bus so producers and GenAI consumers evolve independently. The case depends on the fact that the integration must be loosely coupled and react to enterprise events without synchronous dependencies.
Incorrect Answers
Answer A is incorrect because AWS DataSync for scheduled on-premises file transfer is useful when enterprise files must be synchronized reliably from on-premises storage before GenAI processing and can transfer large file sets between on-premises storage and AWS with managed scheduling and integrity handling. The described workload requires the integration must be loosely coupled and react to enterprise events without synchronous dependencies.
Answer B is incorrect because Amazon SNS fanout for shared enterprise events targets a different issue by helping to publish one event to multiple subscribed consumers that need independent copies. It fits where several enterprise applications must react independently to the same GenAI-related event. The deciding condition is the integration must be loosely coupled and react to enterprise events without synchronous dependencies.
Answer D is incorrect because Amazon AppFlow SaaS data synchronization is useful when enterprise SaaS records must be synchronized into AWS without maintaining custom extraction code because it can move selected data between supported SaaS applications and AWS on a managed schedule or event-driven flow. The current requirement is the integration must be loosely coupled and react to enterprise events without synchronous dependencies, which makes this a mismatch.
Question 2
A cloud engineering team must correct a data-processing weakness. A claims platform can emit thousands of enrichment requests in seconds, while the GenAI worker processes them at a steadier rate. Which implementation best satisfies the requirement? Choose ONE.
- Amazon SQS buffering between enterprise systems
- API Gateway facade for a legacy HTTP service
- Lambda webhook handler behind API Gateway
- Amazon SNS fanout for shared enterprise events
Correct Answer: A
Correct Answer
Answer A is correct because Amazon SQS buffering between enterprise systems is the direct remedy. It can queue integration work so bursts and temporary downstream outages do not overload the FM consumer. The critical scenario condition is that producers can outpace the GenAI worker and messages must survive transient failures.
Incorrect Answers
Answer B is incorrect because API Gateway facade for a legacy HTTP service is relevant, but it is intended to present a managed API boundary that shields callers from legacy endpoint details and supports validation, authorization, and versioning when an existing enterprise application must expose a stable integration contract without rewriting the legacy backend. The actual requirement is producers can outpace the GenAI worker and messages must survive transient failures.
Answer C is incorrect because Lambda webhook handler behind API Gateway solves a different input problem. It helps to accept a short-lived webhook callback, validate it, transform the payload, and invoke downstream AWS services, normally when an external enterprise application pushes lightweight events and the handler should scale without server management. The current workflow needs producers can outpace the GenAI worker and messages must survive transient failures.
Answer D is incorrect because Amazon SNS fanout for shared enterprise events is appropriate where several enterprise applications must react independently to the same GenAI-related event. It achieves that by helping to publish one event to multiple subscribed consumers that need independent copies. This scenario instead requires producers can outpace the GenAI worker and messages must survive transient failures.
Question 3
A solutions architect is reviewing how source data reaches an FM. A queue contains many event types, but only high-priority support cases should invoke the GenAI workflow after a small metadata transformation. What should be used to meet this requirement? Choose ONE.
- EventBridge Pipes filtering and enrichment
- AWS DataSync for scheduled on-premises file transfer
- Lambda webhook handler behind API Gateway
- Amazon AppFlow SaaS data synchronization
Correct Answer: A
Correct Answer
Answer A is correct because Use EventBridge Pipes filtering and enrichment. It will connect an event source to a target with declarative filtering, transformation, and optional enrichment. The deciding condition is that only a subset of events should reach the GenAI integration and simple routing logic should not require a custom service. This matches the requirement.
Incorrect Answers
Answer B is incorrect because AWS DataSync is intended to transfer large file sets between on-premises storage and AWS with managed scheduling and integrity handling. That fits file synchronization, not selective event routing. This scenario needs filtering and transformation between an event source and target without a custom service, so DataSync does not address the deciding requirement.
Answer C is incorrect because A Lambda webhook handler can validate and transform callbacks from an external application before invoking downstream AWS services. That is useful for push-style webhook integration. Here the need is declarative filtering and routing of an existing event stream, so building a custom webhook handler would solve a different integration problem.
Answer D is incorrect because Amazon AppFlow SaaS data synchronization works for cases where enterprise SaaS records must be synchronized into AWS without maintaining custom extraction code by helping to move selected data between supported SaaS applications and AWS on a managed schedule or event-driven flow. The present scenario needs only a subset of events should reach the GenAI integration and simple routing logic should not require a custom service.
Question 4
A platform team is reviewing a production GenAI data pipeline. An onboarding workflow must call a CRM, invoke an FM, request human approval, and update an ERP with separate retry rules. What is the most appropriate implementation choice? Choose ONE.
- AWS DataSync for scheduled on-premises file transfer
- Amazon SNS fanout for shared enterprise events
- API Gateway facade for a legacy HTTP service
- Step Functions enterprise workflow orchestration
Correct Answer: D
Correct Answer
Answer D is correct because Step Functions enterprise workflow orchestration directly fits. It can coordinate multiple integration steps with explicit state, retries, branches, and compensating paths. The scenario is specifically about the case where a business process spans several services and needs durable orchestration rather than one long-running function.
Incorrect Answers
Answer A is incorrect because AWS DataSync for scheduled on-premises file transfer belongs in workflows where enterprise files must be synchronized reliably from on-premises storage before GenAI processing because it can transfer large file sets between on-premises storage and AWS with managed scheduling and integrity handling. This question instead asks for a business process spans several services and needs durable orchestration rather than one long-running function.
Answer B is incorrect because Amazon SNS fanout for shared enterprise events is useful when several enterprise applications must react independently to the same GenAI-related event and can publish one event to multiple subscribed consumers that need independent copies. The described workload requires a business process spans several services and needs durable orchestration rather than one long-running function.
Answer C is incorrect because API Gateway facade for a legacy HTTP service targets a different issue by helping to present a managed API boundary that shields callers from legacy endpoint details and supports validation, authorization, and versioning. It fits where an existing enterprise application must expose a stable integration contract without rewriting the legacy backend. The deciding condition is a business process spans several services and needs durable orchestration rather than one long-running function.
Question 5
An enterprise team is refining the input pipeline for a GenAI application. A customer-profile table is authoritative in DynamoDB. The GenAI personalization job should run only when relevant profile items change. What should the developer implement? Choose ONE.
- API Gateway facade for a legacy HTTP service
- DynamoDB Streams change-event integration
- Amazon AppFlow SaaS data synchronization
- Lambda webhook handler behind API Gateway
Correct Answer: B
Correct Answer
Answer B is correct because The correct choice is DynamoDB Streams change-event integration. It helps to emit item-level change records that can trigger downstream processing when application state changes. The deciding detail is that updates already land in DynamoDB and the GenAI workflow should react only to actual table changes.
Incorrect Answers
Answer A is incorrect because API Gateway facade for a legacy HTTP service can present a managed API boundary that shields callers from legacy endpoint details and supports validation, authorization, and versioning. Its best fit is where an existing enterprise application must expose a stable integration contract without rewriting the legacy backend. The current case instead needs updates already land in DynamoDB and the GenAI workflow should react only to actual table changes.
Answer C is incorrect because Amazon AppFlow SaaS data synchronization is relevant, but it is intended to move selected data between supported SaaS applications and AWS on a managed schedule or event-driven flow when enterprise SaaS records must be synchronized into AWS without maintaining custom extraction code. The actual requirement is updates already land in DynamoDB and the GenAI workflow should react only to actual table changes.
Answer D is incorrect because Lambda webhook handler behind API Gateway solves a different input problem. It helps to accept a short-lived webhook callback, validate it, transform the payload, and invoke downstream AWS services, normally when an external enterprise application pushes lightweight events and the handler should scale without server management. The current workflow needs updates already land in DynamoDB and the GenAI workflow should react only to actual table changes.
Question 6
An application team is standardizing data before foundation-model inference. A shared-services account hosts a GenAI gateway, and a workload account needs temporary, auditable access to invoke it. Which implementation provides the required behavior? Choose ONE.
- STS AssumeRole for cross-account integration
- least-privilege IAM policy for Bedrock invocation
- Cognito JWT authorization at API Gateway
- per-application IAM role isolation
Correct Answer: A
Correct Answer
Answer A is correct because Select STS AssumeRole for cross-account integration. Its purpose is to issue temporary credentials by assuming a narrowly scoped role in the target account. The operational requirement is that an application in one AWS account must call an approved GenAI resource in another account without static access keys.
Incorrect Answers
Answer B is incorrect because least-privilege IAM policy for Bedrock invocation has value because it can allow only the required model actions and resources instead of broad wildcard permissions. Its proper fit is when an enterprise application should invoke approved FMs but must not gain unrelated AWS privileges. This question requires an application in one AWS account must call an approved GenAI resource in another account without static access keys.
Answer C is incorrect because Cognito JWT authorization at API Gateway can help a pipeline validate application-user tokens at the API boundary before requests enter the GenAI backend, especially when external application users need authenticated, claim-aware access to a managed GenAI API. The present requirement is an application in one AWS account must call an approved GenAI resource in another account without static access keys, so it is not the best answer.
Answer D is incorrect because per-application IAM role isolation would improve another stage by enabling it to assign separate execution roles to integrating applications so permissions and audit trails are not shared. It fits when multiple enterprise apps use the same gateway but each requires distinct least-privilege access and attribution. The stated problem is an application in one AWS account must call an approved GenAI resource in another account without static access keys.
Question 7
An operations team is improving the reliability of an FM input path. A platform group lets product teams create GenAI execution roles, but those teams must never be able to grant themselves broad administrative access. Which change should the team make? Choose ONE.
- IAM Identity Center federation for workforce access
- attribute-based IAM access control
- Cognito JWT authorization at API Gateway
- IAM permissions boundary for delegated development
Correct Answer: D
Correct Answer
Answer D is correct because The strongest answer is IAM permissions boundary for delegated development. It works by helping to cap the maximum permissions that application teams can grant to roles they create. The requirement is that teams may self-service roles but central security must prevent them from exceeding an approved privilege ceiling.
Incorrect Answers
Answer A is incorrect because IAM Identity Center federation for workforce access can federate enterprise workforce identities into AWS so access is based on centrally managed users and groups, which matters when employees must use existing corporate identities rather than separate long-lived AWS credentials. The present case is driven by teams may self-service roles but central security must prevent them from exceeding an approved privilege ceiling.
Answer B is incorrect because attribute-based IAM access control belongs in workflows where many teams need access determined by attributes such as department or environment rather than one policy per user because it can use principal and resource tags in policy conditions so permissions scale with business attributes. This question instead asks for teams may self-service roles but central security must prevent them from exceeding an approved privilege ceiling.
Answer C is incorrect because Cognito JWT authorization at API Gateway is useful when external application users need authenticated, claim-aware access to a managed GenAI API and can validate application-user tokens at the API boundary before requests enter the GenAI backend. The described workload requires teams may self-service roles but central security must prevent them from exceeding an approved privilege ceiling.
Question 8
A developer is hardening an FM-consumption workflow. A central GenAI gateway runs behind an internal load balancer and multiple application VPCs require private connectivity to it. Which approach most directly addresses the stated constraint? Choose ONE.
- least-privilege IAM policy for Bedrock invocation
- attribute-based IAM access control
- AWS PrivateLink private service exposure
- per-application IAM role isolation
Correct Answer: C
Correct Answer
Answer C is correct because AWS PrivateLink private service exposure is correct. It publish an internal service through private VPC connectivity without sending traffic over the public internet. This matters because enterprise consumers in VPCs need private access to a centralized GenAI integration service. That directly addresses the scenario.
Incorrect Answers
Answer A is incorrect because least-privilege IAM policy for Bedrock invocation is designed to allow only the required model actions and resources instead of broad wildcard permissions. That makes sense when an enterprise application should invoke approved FMs but must not gain unrelated AWS privileges. The question is centered on enterprise consumers in VPCs need private access to a centralized GenAI integration service.
Answer B is incorrect because attribute-based IAM access control can use principal and resource tags in policy conditions so permissions scale with business attributes. Its best fit is where many teams need access determined by attributes such as department or environment rather than one policy per user. The current case instead needs enterprise consumers in VPCs need private access to a centralized GenAI integration service.
Answer D is incorrect because per-application IAM role isolation is relevant, but it is intended to assign separate execution roles to integrating applications so permissions and audit trails are not shared when multiple enterprise apps use the same gateway but each requires distinct least-privilege access and attribution. The actual requirement is enterprise consumers in VPCs need private access to a centralized GenAI integration service.
Question 9
A GenAI workload is moving from prototype to production. A central artifact bucket contains approved prompt templates and must be readable only by two named workload roles in other accounts. Which option best meets the operational requirement? Choose ONE.
- per-application IAM role isolation
- cross-account resource policy with explicit principals
- Cognito JWT authorization at API Gateway
- IAM Identity Center federation for workforce access
Correct Answer: B
Correct Answer
Answer B is correct because Choose cross-account resource policy with explicit principals. Its role is to grant a known external account or role access at the resource boundary while keeping the allowed principal set narrow. The key requirement is that a shared resource must be consumed across accounts with auditable, explicit trust.
Incorrect Answers
Answer A is incorrect because per-application IAM role isolation addresses another concern by helping to assign separate execution roles to integrating applications so permissions and audit trails are not shared. It fits where multiple enterprise apps use the same gateway but each requires distinct least-privilege access and attribution. Here the deciding need is a shared resource must be consumed across accounts with auditable, explicit trust.
Answer C is incorrect because Cognito JWT authorization at API Gateway has value because it can validate application-user tokens at the API boundary before requests enter the GenAI backend. Its proper fit is when external application users need authenticated, claim-aware access to a managed GenAI API. This question requires a shared resource must be consumed across accounts with auditable, explicit trust.
Answer D is incorrect because IAM Identity Center federation for workforce access can help a pipeline federate enterprise workforce identities into AWS so access is based on centrally managed users and groups, especially when employees must use existing corporate identities rather than separate long-lived AWS credentials. The present requirement is a shared resource must be consumed across accounts with auditable, explicit trust, so it is not the best answer.
Question 10
A regulated workflow requires deterministic preprocessing before inference. Dozens of internal teams call different FMs directly today. Security wants one controlled entry point with common policy and observability. Which solution most directly resolves this issue? Choose ONE.
- attribute-based IAM access control
- central GenAI gateway with policy enforcement
- IAM Identity Center federation for workforce access
- least-privilege IAM policy for Bedrock invocation
Correct Answer: B
Correct Answer
Answer B is correct because central GenAI gateway with policy enforcement is appropriate because it will route enterprise FM consumption through one abstraction layer that applies authentication, model allowlists, quotas, and logging. The requirement centers on a situation where many applications need consistent controls without embedding governance logic in every client.
Incorrect Answers
Answer A is incorrect because attribute-based IAM access control would be sound if the goal were many teams need access determined by attributes such as department or environment rather than one policy per user; it can use principal and resource tags in policy conditions so permissions scale with business attributes. The requirement here is many applications need consistent controls without embedding governance logic in every client.
Answer C is incorrect because IAM Identity Center federation for workforce access belongs in workflows where employees must use existing corporate identities rather than separate long-lived AWS credentials because it can federate enterprise workforce identities into AWS so access is based on centrally managed users and groups. This question instead asks for many applications need consistent controls without embedding governance logic in every client.
Answer D is incorrect because least-privilege IAM policy for Bedrock invocation is useful when an enterprise application should invoke approved FMs but must not gain unrelated AWS privileges and can allow only the required model actions and resources instead of broad wildcard permissions. The described workload requires many applications need consistent controls without embedding governance logic in every client.
Question 11
During a production-readiness review, engineers identify a data-handling issue. A field-assistance application used over 5G needs nearby processing to reduce round-trip latency before calling approved GenAI services. Which design is the best fit for this requirement? Choose ONE.
- AWS DataSync bandwidth-scheduled transfer
- local redaction before cloud transfer
- encrypted VPC-to-on-premises routing
- AWS Wavelength for edge-proximate inference integration
Correct Answer: D
Correct Answer
Answer D is correct because The requirement points to AWS Wavelength for edge-proximate inference integration. It is meant to place application components close to carrier edge locations to reduce network latency for mobile workloads. The scenario needs an approach where a mobile GenAI experience requires very low latency near end users at the telecom edge.
Incorrect Answers
Answer A is incorrect because AWS DataSync bandwidth-scheduled transfer targets a neighboring concern. It can schedule managed data movement during approved windows to control network impact between on-premises and AWS when large on-premises datasets may move to AWS only during a limited nightly network window. The key requirement here is a mobile GenAI experience requires very low latency near end users at the telecom edge.
Answer B is incorrect because local redaction before cloud transfer is designed to remove or tokenize restricted fields in the local environment before sending the remaining content to cloud GenAI services. That makes sense when raw regulated data cannot leave the local site but de-identified content may be processed in AWS. The question is centered on a mobile GenAI experience requires very low latency near end users at the telecom edge.
Answer C is incorrect because encrypted VPC-to-on-premises routing can use private routed connectivity with encryption controls between cloud VPC resources and enterprise networks. Its best fit is where cloud and on-premises components must exchange approved data over a controlled network path. The current case instead needs a mobile GenAI experience requires very low latency near end users at the telecom edge.
Question 12
A cloud engineering team must correct a data-processing weakness. EU and US customer records use the same application, but policy requires each record to be processed only in its permitted geography. Which implementation best satisfies the requirement? Choose ONE.
- local redaction before cloud transfer
- approved-field synchronization across environments
- region-aware request routing for data residency
- AWS Outposts for local data processing
Correct Answer: C
Correct Answer
Answer C is correct because region-aware request routing for data residency matches the constraint. It can select a compliant regional processing path based on the data’s jurisdiction before FM access. This is the intended approach when requests from different jurisdictions must remain within approved regions.
Incorrect Answers
Answer A is incorrect because local redaction before cloud transfer is useful when raw regulated data cannot leave the local site but de-identified content may be processed in AWS because it can remove or tokenize restricted fields in the local environment before sending the remaining content to cloud GenAI services. The current requirement is requests from different jurisdictions must remain within approved regions, which makes this a mismatch.
Answer B is incorrect because approved-field synchronization across environments addresses another concern by helping to replicate only explicitly permitted attributes between on-premises and cloud systems. It fits where enterprise synchronization is required but sensitive columns must remain in the source environment. Here the deciding need is requests from different jurisdictions must remain within approved regions.
Answer D is incorrect because AWS Outposts for local data processing has value because it can run AWS infrastructure and application components on premises so regulated data can remain at the local site. Its proper fit is when jurisdiction or policy requires sensitive data processing to stay on premises while using AWS-consistent infrastructure. This question requires requests from different jurisdictions must remain within approved regions.
Question 13
A solutions architect is reviewing how source data reaches an FM. A multinational application must keep Canadian and European GenAI traffic on separate approved regional stacks. What should be used to meet this requirement? Choose ONE.
- encrypted VPC-to-on-premises routing
- AWS DataSync bandwidth-scheduled transfer
- separate regional integration endpoints
- approved-field synchronization across environments
Correct Answer: C
Correct Answer
Answer C is correct because Use separate regional integration endpoints for this design. It will deploy independent endpoints and data stores per jurisdiction rather than sharing one global processing path. That aligns with the need that regional isolation is required for both data storage and FM request handling.
Incorrect Answers
Answer A is incorrect because encrypted VPC-to-on-premises routing is appropriate where cloud and on-premises components must exchange approved data over a controlled network path. It achieves that by helping to use private routed connectivity with encryption controls between cloud VPC resources and enterprise networks. This scenario instead requires regional isolation is required for both data storage and FM request handling.
Answer B is incorrect because AWS DataSync bandwidth-scheduled transfer would be sound if the goal were large on-premises datasets may move to AWS only during a limited nightly network window; it can schedule managed data movement during approved windows to control network impact between on-premises and AWS. The requirement here is regional isolation is required for both data storage and FM request handling.
Answer D is incorrect because approved-field synchronization across environments belongs in workflows where enterprise synchronization is required but sensitive columns must remain in the source environment because it can replicate only explicitly permitted attributes between on-premises and cloud systems. This question instead asks for regional isolation is required for both data storage and FM request handling.
Question 14
A platform team is reviewing a production GenAI data pipeline. A remote plant loses WAN connectivity for several minutes each day but must preserve GenAI enrichment requests for later processing. What is the most appropriate implementation choice? Choose ONE.
- AWS DataSync bandwidth-scheduled transfer
- store-and-forward integration during link outages
- local redaction before cloud transfer
- AWS Outposts for local data processing
Correct Answer: B
Correct Answer
Answer B is correct because store-and-forward integration during link outages is the best fit because it can persist integration events locally and forward them after connectivity returns instead of dropping or blocking the business process. The workflow needs a case where an edge or on-premises site must continue operating during temporary cloud disconnection.
Incorrect Answers
Answer A is incorrect because AWS DataSync bandwidth-scheduled transfer works for cases where large on-premises datasets may move to AWS only during a limited nightly network window by helping to schedule managed data movement during approved windows to control network impact between on-premises and AWS. The present scenario needs an edge or on-premises site must continue operating during temporary cloud disconnection.
Answer C is incorrect because local redaction before cloud transfer is designed to remove or tokenize restricted fields in the local environment before sending the remaining content to cloud GenAI services. That makes sense when raw regulated data cannot leave the local site but de-identified content may be processed in AWS. The question is centered on an edge or on-premises site must continue operating during temporary cloud disconnection.
Answer D is incorrect because AWS Outposts for local data processing can run AWS infrastructure and application components on premises so regulated data can remain at the local site. Its best fit is where jurisdiction or policy requires sensitive data processing to stay on premises while using AWS-consistent infrastructure. The current case instead needs an edge or on-premises site must continue operating during temporary cloud disconnection.
Question 15
An enterprise team is refining the input pipeline for a GenAI application. A workload must never send German customer prompts to an FM endpoint outside the approved EU Region even during a capacity event. What should the developer implement? Choose ONE.
- compliance-aware model endpoint selection
- AWS Outposts for local data processing
- encrypted VPC-to-on-premises routing
- approved-field synchronization across environments
Correct Answer: A
Correct Answer
Answer A is correct because Implement compliance-aware model endpoint selection. It is designed to map each jurisdiction to an approved model and Region rather than automatically using cross-region inference. Here, the important constraint is that data residency rules override convenience routing to any available model location.
Incorrect Answers
Answer B is incorrect because AWS Outposts for local data processing is useful when jurisdiction or policy requires sensitive data processing to stay on premises while using AWS-consistent infrastructure because it can run AWS infrastructure and application components on premises so regulated data can remain at the local site. The current requirement is data residency rules override convenience routing to any available model location, which makes this a mismatch.
Answer C is incorrect because encrypted VPC-to-on-premises routing addresses another concern by helping to use private routed connectivity with encryption controls between cloud VPC resources and enterprise networks. It fits where cloud and on-premises components must exchange approved data over a controlled network path. Here the deciding need is data residency rules override convenience routing to any available model location.
Answer D is incorrect because Using approved-field synchronization across environments would let the team replicate only explicitly permitted attributes between on-premises and cloud systems. That is appropriate when enterprise synchronization is required but sensitive columns must remain in the source environment. The scenario instead calls for data residency rules override convenience routing to any available model location.
Question 16
An application team is standardizing data before foundation-model inference. Every pull request must verify that the gateway still accepts the documented request schema and returns required response fields. Which implementation provides the required behavior? Choose ONE.
- automated quality gate with rollback
- consumer-driven contract tests
- CodeBuild automated integration tests
- CI security scan before deployment
Correct Answer: C
Correct Answer
Answer C is correct because CodeBuild automated integration tests should be used. It can run repeatable build-time tests against API contracts, prompt schemas, and integration behavior before deployment. That capability is needed because a release should fail automatically when the GenAI component breaks an enterprise contract.
Incorrect Answers
Answer A is incorrect because automated quality gate with rollback solves a different input problem. It helps to evaluate predefined GenAI integration tests after deployment and revert when acceptance thresholds fail, normally when deployment success depends on behavioral quality as well as infrastructure health. The current workflow needs a release should fail automatically when the GenAI component breaks an enterprise contract.
Answer B is incorrect because consumer-driven contract tests is appropriate where multiple dependent applications could break even when provider-side unit tests pass. It achieves that by helping to validate that a new gateway release continues to satisfy the request and response expectations of existing enterprise clients. This scenario instead requires a release should fail automatically when the GenAI component breaks an enterprise contract.
Answer D is incorrect because CI security scan before deployment can add automated dependency, infrastructure, and policy checks to the pipeline before a GenAI component can be promoted, which matters when enterprise compliance requires releases with known critical security findings to be blocked. The present case is driven by a release should fail automatically when the GenAI component breaks an enterprise contract.
Question 17
An operations team is improving the reliability of an FM input path. A new gateway version changes model routing logic and must be introduced without replacing the stable version in place. Which change should the team make? Choose ONE.
- CodeDeploy blue-green release with rollback
- API Gateway per-client throttling
- automated quality gate with rollback
- CodePipeline promotion for GenAI integration releases
Correct Answer: A
Correct Answer
Answer A is correct because CodeDeploy blue-green release with rollback solves the right problem. It will shift traffic between old and new application versions while retaining a fast rollback path. The case depends on the fact that a GenAI gateway update must minimize downtime and allow immediate reversal if health checks fail.
Incorrect Answers
Answer B is incorrect because API Gateway per-client throttling works for cases where many enterprise consumers share one gateway and noisy-neighbor behavior must be controlled by helping to apply quotas or rate limits by client so one application cannot consume all shared GenAI capacity. The present scenario needs a GenAI gateway update must minimize downtime and allow immediate reversal if health checks fail.
Answer C is incorrect because automated quality gate with rollback targets a neighboring concern. It can evaluate predefined GenAI integration tests after deployment and revert when acceptance thresholds fail when deployment success depends on behavioral quality as well as infrastructure health. The key requirement here is a GenAI gateway update must minimize downtime and allow immediate reversal if health checks fail.
Answer D is incorrect because CodePipeline promotion for GenAI integration releases is designed to orchestrate source, build, test, approval, and deployment stages for repeatable enterprise releases. That makes sense when GenAI integration changes need controlled promotion across environments. The question is centered on a GenAI gateway update must minimize downtime and allow immediate reversal if health checks fail.
Question 18
A developer is hardening an FM-consumption workflow. Internal applications need one stable endpoint even when the platform team changes the selected Bedrock model. Which approach most directly addresses the stated constraint? Choose ONE.
- CI security scan before deployment
- API Gateway centralized model abstraction
- API Gateway per-client throttling
- consumer-driven contract tests
Correct Answer: B
Correct Answer
Answer B is correct because API Gateway centralized model abstraction is the direct remedy. It can expose a stable enterprise API while backend model providers or versions can change behind the gateway. The critical scenario condition is that client applications should not depend on provider-specific FM endpoint details.
Incorrect Answers
Answer A is incorrect because CI security scan before deployment targets a different issue by helping to add automated dependency, infrastructure, and policy checks to the pipeline before a GenAI component can be promoted. It fits where enterprise compliance requires releases with known critical security findings to be blocked. The deciding condition is client applications should not depend on provider-specific FM endpoint details.
Answer C is incorrect because API Gateway per-client throttling is useful when many enterprise consumers share one gateway and noisy-neighbor behavior must be controlled because it can apply quotas or rate limits by client so one application cannot consume all shared GenAI capacity. The current requirement is client applications should not depend on provider-specific FM endpoint details, which makes this a mismatch.
Answer D is incorrect because consumer-driven contract tests addresses another concern by helping to validate that a new gateway release continues to satisfy the request and response expectations of existing enterprise clients. It fits where multiple dependent applications could break even when provider-side unit tests pass. Here the deciding need is client applications should not depend on provider-specific FM endpoint details.
Question 19
A GenAI workload is moving from prototype to production. A support team can see 5xx errors but cannot determine whether failures occur in API Gateway, Lambda, or the FM invocation. Which option best meets the operational requirement? Choose ONE.
- automated quality gate with rollback
- consumer-driven contract tests
- CodePipeline promotion for GenAI integration releases
- CloudWatch and X-Ray gateway observability
Correct Answer: D
Correct Answer
Answer D is correct because Use CloudWatch and X-Ray gateway observability. It will capture metrics, logs, and distributed traces across the enterprise integration boundary. The deciding condition is that operators need request-level visibility across gateway, function, and downstream GenAI calls. This matches the requirement.
Incorrect Answers
Answer A is incorrect because automated quality gate with rollback is relevant, but it is intended to evaluate predefined GenAI integration tests after deployment and revert when acceptance thresholds fail when deployment success depends on behavioral quality as well as infrastructure health. The actual requirement is operators need request-level visibility across gateway, function, and downstream GenAI calls.
Answer B is incorrect because consumer-driven contract tests solves a different input problem. It helps to validate that a new gateway release continues to satisfy the request and response expectations of existing enterprise clients, normally when multiple dependent applications could break even when provider-side unit tests pass. The current workflow needs operators need request-level visibility across gateway, function, and downstream GenAI calls.
Answer C is incorrect because CodePipeline promotion for GenAI integration releases is appropriate where GenAI integration changes need controlled promotion across environments. It achieves that by helping to orchestrate source, build, test, approval, and deployment stages for repeatable enterprise releases. This scenario instead requires operators need request-level visibility across gateway, function, and downstream GenAI calls.
Question 20
A regulated workflow requires deterministic preprocessing before inference. The platform team changes approved model mappings several times per week and wants guarded configuration updates without rebuilding the gateway. Which solution most directly resolves this issue? Choose ONE.
- CodePipeline promotion for GenAI integration releases
- API Gateway per-client throttling
- CI security scan before deployment
- AWS AppConfig externalized integration configuration
Correct Answer: D
Correct Answer
Answer D is correct because AWS AppConfig externalized integration configuration directly fits. It can store and deploy routing or feature configuration separately from application code with controlled rollout. The scenario is specifically about the case where model-routing rules change frequently and should not require a full code deployment.
Incorrect Answers
Answer A is incorrect because CodePipeline promotion for GenAI integration releases can help a pipeline orchestrate source, build, test, approval, and deployment stages for repeatable enterprise releases, especially when GenAI integration changes need controlled promotion across environments. The present requirement is model-routing rules change frequently and should not require a full code deployment, so it is not the best answer.
Answer B is incorrect because API Gateway per-client throttling would improve another stage by enabling it to apply quotas or rate limits by client so one application cannot consume all shared GenAI capacity. It fits when many enterprise consumers share one gateway and noisy-neighbor behavior must be controlled. The stated problem is model-routing rules change frequently and should not require a full code deployment.
Answer C is incorrect because CI security scan before deployment works for cases where enterprise compliance requires releases with known critical security findings to be blocked by helping to add automated dependency, infrastructure, and policy checks to the pipeline before a GenAI component can be promoted. The present scenario needs model-routing rules change frequently and should not require a full code deployment.
