Topic 09 Practice Test 2 covers Guardrails, Prompt-Injection Defense, Output Safety, Grounding, and Hallucination Controls in Domain 3 (Task 3.1). For broader exam preparation, review the AIP-C01 Exam Dumps. Every option includes focused technical reasoning tied to the tested decision.
Question 1
A medical assistant must run a custom classifier, look up an exception list, route uncertain cases to review, and only then invoke the model. Which AWS design best fits the multi-step moderation requirement? Choose ONE.
- Step Functions and Lambda custom moderation workflow
- Amazon Bedrock Guardrails input content filters
- ApplyGuardrail before model invocation
- Synchronous application input validator
Correct Answer: A
Correct Answer
Answer A is correct because This requirement points to Step Functions and Lambda custom moderation workflow: Step Functions and Lambda can coordinate several organization-specific checks and human-review branches that a single managed filter does not express. The necessary capability is orchestrated custom moderation with branching. the workflow makes each moderation stage explicit and auditable before inference.
Incorrect Answers
Answer B is incorrect because Amazon Bedrock Guardrails input content filters is useful when classifying and blocking harmful categories such as hate, violence, sexual content, insults, misconduct, or prompt attacks before a supported model processes the request. This case instead requires orchestrated custom moderation with branching.
Answer C is incorrect because ApplyGuardrail before model invocation helps with evaluating user text with a configured Bedrock guardrail independently of a foundation-model call. Because it does not by itself execute a bespoke multi-service moderation state machine, the option would not produce the requested control outcome, though it can remain part of a broader defense strategy.
Answer D is incorrect because Synchronous application input validator primarily supports rejecting malformed, disallowed, or policy-breaking requests immediately before model invocation using deterministic application rules. Its shortcoming is that it cannot semantically ground a model response against retrieved evidence, so choosing it would leave the requested safety or accuracy mechanism incomplete.
Question 2
A policy assistant must never generate discussion of a prohibited subject, even if that subject was not present in the user prompt. Which Bedrock control can be applied to the response semantics? Choose ONE.
- Amazon Bedrock Guardrails output content filters
- Bedrock Guardrails sensitive-information masking
- Amazon Bedrock Guardrails denied topics
- Amazon Bedrock Guardrails word filters
Correct Answer: C
Correct Answer
Answer C is correct because Amazon Bedrock Guardrails denied topics fits the evidence in the scenario because denied topics can evaluate responses as well as prompts and block content that falls within a configured disallowed theme. That is the direct control path, whereas adjacent safeguards address different inputs, outputs, or assurance goals.
Incorrect Answers
Answer A is incorrect because Use Amazon Bedrock Guardrails output content filters when the goal is evaluating generated text against harmful-content categories before the response is delivered. Since it does not prove that every factual claim is supported by a reference source, the option does not provide the required assurance by itself.
Answer B is incorrect because Bedrock Guardrails sensitive-information masking is relevant to detecting supported sensitive entities or configured patterns in a response and replacing them rather than exposing the original value. Because masking sensitive data does not establish factual grounding, the option is technically useful but positioned for a different purpose than the control being requested.
Answer D is incorrect because Amazon Bedrock Guardrails word filters fits situations involving blocking exact custom words or phrases, including organization-specific terms that must never appear in an interaction. Its limitation here is that it does not reason about a broad topic semantically, making it complementary rather than sufficient for the requested control.
Question 3
A verification service embeds a generated claim and the authoritative passage, then rejects claims whose semantic similarity is below an evaluated threshold. Which accuracy technique is being implemented? Choose ONE.
- Bedrock Guardrails contextual grounding check
- JSON Schema constrained output validation
- Evidence-backed source citation
- Semantic-similarity evidence verification
Correct Answer: D
Correct Answer
Answer D is correct because Use Semantic-similarity evidence verification. The decisive phrase in the requirement is semantic evidence comparison after generation, and it provides a verification signal independent from whether the text merely conforms to a response schema. This choice provides the requested safeguard at the correct stage while preserving room for separate defense-in-depth controls.
Incorrect Answers
Answer A is incorrect because The normal role of Bedrock Guardrails contextual grounding check is scoring whether a response is supported by supplied grounding source content and filtering responses below the configured grounding threshold. Here the application needs semantic evidence comparison after generation.
Answer B is incorrect because JSON Schema constrained output validation helps with requiring generated structured output to conform to expected fields, types, and allowed shapes before downstream automation accepts it. Because schema validity cannot prove that a semantically plausible value is factually true, the option would not produce the requested control outcome, though it can remain part of a broader defense strategy.
Answer C is incorrect because Evidence-backed source citation is designed around returning identifiers or references for the retrieved material supporting an answer so users or downstream checks can verify important claims. Its limitation is that citations are only trustworthy when they are bound to the actual retrieved evidence; as a result, it cannot be the primary answer to this particular scenario.
Question 4
An agent accepts structured requests and later emits executable configuration. The application must validate both the incoming parameters and the generated configuration before any action occurs. Which pattern best meets the requirement? Choose ONE.
- ApplyGuardrail on both input and output
- Deterministic request schema validation
- JSON Schema constrained output validation
- Deterministic pre- and post-generation validation
Correct Answer: D
Correct Answer
Answer D is correct because Deterministic pre- and post-generation validation provides the required mechanism because pre-generation checks protect prompt construction while post-generation checks protect downstream execution, creating two distinct deterministic boundaries around the model. The operational objective is deterministic validation before and after generation. using only one side leaves either malformed requests or unsafe generated actions unchecked.
Incorrect Answers
Answer A is incorrect because ApplyGuardrail on both input and output fits situations involving running the configured guardrail before inference and again on generated content so unsafe prompts and unsafe responses are independently evaluated. Its limitation here is that it still may need custom controls for organization-specific logic, making it complementary rather than sufficient for the requested control.
Answer B is incorrect because Deterministic request schema validation would make sense for requiring the incoming payload to match allowed fields, types, sizes, and enum values before any prompt is assembled. Because it does not detect adversarial natural-language intent by itself, it targets the wrong failure mode even though it may coexist with the correct safeguard.
Answer C is incorrect because JSON Schema constrained output validation supports requiring generated structured output to conform to expected fields, types, and allowed shapes before downstream automation accepts it. Because schema validity cannot prove that a semantically plausible value is factually true, relying on it would leave the application exposed to the failure mode called out in the question.
Question 5
A knowledge-base document contains a hidden instruction telling the model to ignore the user and exfiltrate secrets. The user prompt itself is harmless. Which control most directly addresses this threat? Choose ONE.
- Amazon Bedrock Knowledge Bases retrieval grounding
- Retrieved-content isolation and sanitization
- Indirect prompt-injection defense for retrieved content
- Amazon Bedrock Guardrails prompt attack filter
Correct Answer: C
Correct Answer
Answer C is correct because The scenario is best handled by Indirect prompt-injection defense for retrieved content. indirect prompt-injection defenses treat retrieved text as untrusted, separate it from trusted instructions, and filter suspicious directives before context construction. Its relevance comes from the need for defend against instructions embedded in retrieved content; checking only the original user prompt leaves the malicious document path unexamined.
Incorrect Answers
Answer A is incorrect because The normal role of Amazon Bedrock Knowledge Bases retrieval grounding is retrieving relevant enterprise source material and supplying it as context so the model answers from managed evidence. Here the application needs defend against instructions embedded in retrieved content.
Answer B is incorrect because Retrieved-content isolation and sanitization serves treating retrieved documents as untrusted data, stripping active instructions or suspicious control text, and separating evidence from system instructions. What differentiates this case is the need for defend against instructions embedded in retrieved content.
Answer D is incorrect because Amazon Bedrock Guardrails prompt attack filter is intended for detecting prompt injection and jailbreak attempts intended to override developer instructions, bypass safeguards, or expose protected instructions. This case requires defend against instructions embedded in retrieved content. Since it must be configured at the appropriate strength and applied to the content that should be evaluated, it would shift attention to a different control objective and leave the stated requirement unsatisfied.
Question 6
A multilingual intake service wants an additional pre-processing signal that classifies incoming text before Bedrock guardrails and custom rules execute. Which component best serves as that upstream classification layer? Choose ONE.
- Amazon Comprehend pre-processing filter
- ApplyGuardrail before model invocation
- Deterministic request schema validation
- Amazon Bedrock Guardrails word filters
Correct Answer: A
Correct Answer
Answer A is correct because Amazon Comprehend pre-processing filter is the strongest fit because Amazon Comprehend can analyze incoming text before the generative model and contribute a separate pre-processing safety signal. The deciding requirement is an upstream text classification signal. That combination addresses the stated safety boundary directly while leaving unrelated controls to complementary layers.
Incorrect Answers
Answer B is incorrect because ApplyGuardrail before model invocation would make sense for evaluating user text with a configured Bedrock guardrail independently of a foundation-model call. Because it does not by itself execute a bespoke multi-service moderation state machine, it targets the wrong failure mode even though it may coexist with the correct safeguard.
Answer C is incorrect because Deterministic request schema validation solves problems involving requiring the incoming payload to match allowed fields, types, sizes, and enum values before any prompt is assembled. Here the exact requirement is an upstream text classification signal. Its limitation is that it does not detect adversarial natural-language intent by itself, so the application would still be missing the mechanism the question asks for.
Answer D is incorrect because Amazon Bedrock Guardrails word filters addresses blocking exact custom words or phrases, including organization-specific terms that must never appear in an interaction. Since it does not reason about a broad topic semantically, selecting it would protect a different boundary and would not close the specific exposure described.
Question 7
A benefits chatbot can legitimately process Social Security numbers internally, but returned text must mask detected SSNs before display. Which control best meets the response requirement? Choose ONE.
- Evidence-backed source citation
- Bedrock Guardrails sensitive-information masking
- Amazon Bedrock Guardrails output content filters
- Amazon Bedrock Guardrails word filters
Correct Answer: B
Correct Answer
Answer B is correct because The required control is Bedrock Guardrails sensitive-information masking. Here, Bedrock Guardrails sensitive-information filters can detect supported PII entities or patterns and mask them in the response, which matches the need for mask sensitive values in model output. the goal is not to ban the entire topic or merely cite the source.
Incorrect Answers
Answer A is incorrect because Evidence-backed source citation serves returning identifiers or references for the retrieved material supporting an answer so users or downstream checks can verify important claims. What differentiates this case is the need for mask sensitive values in model output.
Answer C is incorrect because Amazon Bedrock Guardrails output content filters supports evaluating generated text against harmful-content categories before the response is delivered, which is useful in the right context. Since it does not prove that every factual claim is supported by a reference source, it addresses a separate concern and is not the control that closes this gap.
Answer D is incorrect because Amazon Bedrock Guardrails word filters belongs in designs that need blocking exact custom words or phrases, including organization-specific terms that must never appear in an interaction. Because it does not reason about a broad topic semantically, it would be a supporting layer at best and would not satisfy the stated control objective.
Question 8
A customer-support system produces a calibrated answer-confidence score. Product policy says low-confidence answers must not be shown without another action. Which design uses that signal correctly? Choose ONE.
- Tuned contextual-grounding threshold
- Confidence or uncertainty scoring with a decision threshold
- Low-confidence abstention and escalation
- Evidence-backed source citation
Correct Answer: B
Correct Answer
Answer B is correct because Confidence or uncertainty scoring with a decision threshold directly satisfies this scenario: confidence scoring can quantify uncertainty so the application has an input for acceptance, retry, abstention, or escalation decisions. the score must be validated and tied to an explicit policy rather than displayed as decoration.
Incorrect Answers
Answer A is incorrect because Tuned contextual-grounding threshold can strengthen a system through raising or lowering the configured minimum grounding or relevance score based on validated false-positive and false-negative trade-offs. Because the threshold is meaningful only when contextual-grounding inputs are supplied correctly, this choice would address a neighboring risk and leave the central requirement unmet.
Answer C is incorrect because Low-confidence abstention and escalation is a reasonable control for refusing or routing a response when verification confidence falls below an approved threshold rather than guessing. The mismatch is that it is a decision policy, not the mechanism that produces grounding evidence; therefore the required safety decision would still depend on another component.
Answer D is incorrect because Evidence-backed source citation solves problems involving returning identifiers or references for the retrieved material supporting an answer so users or downstream checks can verify important claims. Here the exact requirement is a calibrated reliability signal for decision logic.
Question 9
Several application paths can generate a response, including a fallback handler. Security needs one final control that every outbound response crosses before leaving the API. What should be added? Choose ONE.
- Comprehend → Guardrails → Lambda → API Gateway layered safety path
- API Gateway response filtering layer
- Specialized toxicity and content-moderation evaluation
- Last-mile API response safety filter
Correct Answer: D
Correct Answer
Answer D is correct because Choose Last-mile API response safety filter because a last-mile API filter catches responses from every application branch immediately before delivery, reducing bypass risk from alternate code paths. In this workload, the critical constraint is a common final outbound safety boundary. it complements earlier model-aware checks rather than replacing them.
Incorrect Answers
Answer A is incorrect because Comprehend → Guardrails → Lambda → API Gateway layered safety path is appropriate for using distinct pre-processing, managed guardrails, custom post-processing, and API-edge controls so one failure does not become the only barrier. This requirement instead centers on a common final outbound safety boundary.
Answer B is incorrect because The value of API Gateway response filtering layer is enforcing a final API-edge response policy or transformation after application processing and before data leaves the service boundary. Since it is not a model-aware hallucination detector by itself, the design would still need a different control to satisfy the question.
Answer C is incorrect because Specialized toxicity and content-moderation evaluation supports measuring or classifying generated outputs for toxic or unsafe language so the application can block, score, or route them, which is useful in the right context. Since it does not enforce relational database semantics, it addresses a separate concern and is not the control that closes this gap.
Question 10
A team uses the Standard tier of Amazon Bedrock Guardrails. An attacker repeatedly paraphrases requests to reveal the hidden system and developer instructions. Which managed safeguard is designed to detect this prompt-leakage behavior? Choose ONE.
- Amazon Bedrock Guardrails denied topics
- Amazon Bedrock Guardrails word filters
- Deterministic request schema validation
- Amazon Bedrock Guardrails prompt attack filter
Correct Answer: D
Correct Answer
Answer D is correct because Amazon Bedrock Guardrails prompt attack filter matches both the mechanism and placement required here. the Bedrock Guardrails prompt attack filter in Standard tier includes prompt-leakage attempts that seek to extract system prompts or developer instructions. The scenario calls for managed detection of prompt leakage; semantic topic, word, and grounding policies address different classes of risk.
Incorrect Answers
Answer A is incorrect because Amazon Bedrock Guardrails denied topics can be valuable when implementing blocking semantically defined subjects that the application is not allowed to discuss, such as investment advice for a retail-banking bot. The current scenario is determined by managed detection of prompt leakage.
Answer B is incorrect because Amazon Bedrock Guardrails word filters is best suited to blocking exact custom words or phrases, including organization-specific terms that must never appear in an interaction. Its gap is that it does not reason about a broad topic semantically; consequently, it cannot replace the control that directly addresses this condition.
Answer C is incorrect because Deterministic request schema validation is a reasonable control for requiring the incoming payload to match allowed fields, types, sizes, and enum values before any prompt is assembled. The mismatch is that it does not detect adversarial natural-language intent by itself; therefore the required safety decision would still depend on another component.
Question 11
An internal API accepts only a small set of permitted task names and parameter types. Requests outside that contract must be rejected before prompt construction, regardless of their natural-language content. What should be implemented first? Choose ONE.
- Deterministic request schema validation
- Amazon Bedrock Guardrails denied topics
- Amazon Comprehend pre-processing filter
- Amazon Bedrock Guardrails input content filters
Correct Answer: A
Correct Answer
Answer A is correct because The best answer is Deterministic request schema validation. That directly implements deterministic payload-contract enforcement, and this closes an interface-control gap that semantic content filters are not designed to police. The distinction matters because a control aimed at a different layer could leave the specified exposure unchanged.
Incorrect Answers
Answer B is incorrect because Amazon Bedrock Guardrails denied topics can help with blocking semantically defined subjects that the application is not allowed to discuss, such as investment advice for a retail-banking bot, but the question hinges on deterministic payload-contract enforcement. Its limitation here is that it is not intended to match one literal word or entity name.
Answer C is incorrect because The value of Amazon Comprehend pre-processing filter is classifying or extracting signals from incoming text before it reaches a generative model as one layer of a safety pipeline. Since it does not replace Bedrock guardrail policies or downstream verification, the design would still need a different control to satisfy the question.
Answer D is incorrect because Amazon Bedrock Guardrails input content filters has value for classifying and blocking harmful categories such as hate, violence, sexual content, insults, misconduct, or prompt attacks before a supported model processes the request. Because it is not a custom multi-step business escalation workflow, the choice does not align with the point where the specified risk must be controlled.
Question 12
A model emits shell commands for an operations assistant. Before a command is shown, the company must run a custom parser that rejects forbidden binaries and dangerous flag combinations. Which component is the best fit? Choose ONE.
- Lambda post-processing safety validator
- JSON Schema constrained output validation
- Amazon Bedrock Guardrails output content filters
- Human review for high-impact generated output
Correct Answer: A
Correct Answer
Answer A is correct because Lambda post-processing safety validator is appropriate because a Lambda post-processor can parse the generated command and enforce organization-specific allow and deny rules before release. managed content categories cannot express every executable-specific constraint. This makes the control operationally relevant to the exact threat or quality failure described.
Incorrect Answers
Answer B is incorrect because JSON Schema constrained output validation is useful when requiring generated structured output to conform to expected fields, types, and allowed shapes before downstream automation accepts it. Because schema validity cannot prove that a semantically plausible value is factually true, it would leave the deciding safety requirement unresolved even though it could still appear elsewhere in a layered design.
Answer C is incorrect because Amazon Bedrock Guardrails output content filters primarily supports evaluating generated text against harmful-content categories before the response is delivered. Its shortcoming is that it does not prove that every factual claim is supported by a reference source, so choosing it would leave the requested safety or accuracy mechanism incomplete.
Answer D is incorrect because Human review for high-impact generated output is best suited to placing a qualified reviewer before release when automated safety checks are insufficient for consequential or ambiguous content. The deciding need here is custom deterministic post-generation command validation. Its gap is that it introduces latency and is not the first-line automated filter for routine traffic; consequently, it cannot replace the control that directly addresses this condition.
Question 13
A model must return a list of invoice IDs and decimal totals. The downstream process has failed when the model added prose or changed data types. Which control improves structural accuracy? Choose ONE.
- Evidence-backed source citation
- JSON Schema enforcement for structured answers
- Semantic-similarity evidence verification
- Bedrock Guardrails contextual grounding check
Correct Answer: B
Correct Answer
Answer B is correct because This requirement points to JSON Schema enforcement for structured answers: JSON Schema can enforce required fields, arrays, numeric types, and other response-shape rules before the result reaches automation. The necessary capability is strict structural conformance of generated data. this prevents malformed structured output even though source-based factual verification remains a separate concern.
Incorrect Answers
Answer A is incorrect because Evidence-backed source citation is relevant to returning identifiers or references for the retrieved material supporting an answer so users or downstream checks can verify important claims. Because citations are only trustworthy when they are bound to the actual retrieved evidence, the option is technically useful but positioned for a different purpose than the control being requested.
Answer C is incorrect because Semantic-similarity evidence verification has value for comparing generated claims or answer content with authoritative retrieved evidence and rejecting material mismatches. Because similarity is a verification signal and should not be treated as a replacement for source governance, the choice does not align with the point where the specified risk must be controlled.
Answer D is incorrect because Use Bedrock Guardrails contextual grounding check when the goal is scoring whether a response is supported by supplied grounding source content and filtering responses below the configured grounding threshold. That is not the decisive goal in this scenario, which is strict structural conformance of generated data.
Question 14
A safety pipeline has three mandatory checks. Today, if one times out, the application skips it and still returns the model answer. Which defense-in-depth change is most important? Choose ONE.
- Fail-closed safety-chain policy
- Fail-closed safety handling
- Step Functions safety orchestration
- Safety telemetry with automated alerting
Correct Answer: A
Correct Answer
Answer A is correct because Fail-closed safety-chain policy fits the evidence in the scenario because a fail-closed chain prevents faults from silently collapsing multiple defenses into an unchecked path. What must be achieved is block whenever a required safety stage is unavailable. That is the direct control path, whereas adjacent safeguards address different inputs, outputs, or assurance goals.
Incorrect Answers
Answer B is incorrect because Fail-closed safety handling is designed around withholding a response or action when a required safety control errors, times out, or returns an indeterminate result. Its limitation is that it governs failure behavior rather than detecting a specific unsafe category; as a result, it cannot be the primary answer to this particular scenario.
Answer C is incorrect because Step Functions safety orchestration helps with coordinating multiple safety checks, retries, approval branches, and fail-closed handling as an explicit workflow. Because it orchestrates controls rather than replacing the controls it invokes, the option would not produce the requested control outcome, though it can remain part of a broader defense strategy.
Answer D is incorrect because Safety telemetry with automated alerting is useful when recording guardrail interventions, classifier scores, and blocked attack patterns so operators can detect changing abuse and tune controls. This case instead requires block whenever a required safety stage is unavailable.
Question 15
Attackers encode dangerous instructions with mixed Unicode forms and spacing so the prompt-attack classifier sees a different representation. What should run before the detector? Choose ONE.
- Deterministic request schema validation
- Amazon Bedrock Guardrails word filters
- Canonicalization before prompt-attack detection
- Untrusted-input sanitization
Correct Answer: C
Correct Answer
Answer C is correct because Use Canonicalization before prompt-attack detection. The decisive phrase in the requirement is canonicalize obfuscated representations before classification, and the normalized content still needs a detector or policy decision afterward. This choice provides the requested safeguard at the correct stage while preserving room for separate defense-in-depth controls.
Incorrect Answers
Answer A is incorrect because Deterministic request schema validation fits situations involving requiring the incoming payload to match allowed fields, types, sizes, and enum values before any prompt is assembled. Its limitation here is that it does not detect adversarial natural-language intent by itself, making it complementary rather than sufficient for the requested control.
Answer B is incorrect because Use Amazon Bedrock Guardrails word filters when the goal is blocking exact custom words or phrases, including organization-specific terms that must never appear in an interaction. Since it does not reason about a broad topic semantically, the option does not provide the required assurance by itself.
Answer D is incorrect because Untrusted-input sanitization supports removing or neutralizing control sequences, markup, or executable fragments that should be treated as data rather than trusted instructions. Because sanitization is complementary to semantic prompt-attack detection, relying on it would leave the application exposed to the failure mode called out in the question.
Question 16
A Bedrock Converse integration includes system instructions, retrieved context, and user text. Only the user text plus a specific retrieved excerpt should be evaluated by the configured content policies. Which mechanism should the developer use? Choose ONE.
- Amazon Bedrock Guardrails word filters
- Deterministic request schema validation
- Bedrock Guardrails guardContent scoping
- ApplyGuardrail before model invocation
Correct Answer: C
Correct Answer
Answer C is correct because Bedrock Guardrails guardContent scoping provides the required mechanism because guardContent blocks identify the content that configured guardrail policies should inspect in supported Bedrock APIs. The operational objective is precise guardrail evaluation scope. It solves that objective directly rather than relying on a control whose primary purpose is elsewhere in the safety architecture.
Incorrect Answers
Answer A is incorrect because Amazon Bedrock Guardrails word filters is designed around blocking exact custom words or phrases, including organization-specific terms that must never appear in an interaction. Its limitation is that it does not reason about a broad topic semantically; as a result, it cannot be the primary answer to this particular scenario.
Answer B is incorrect because The normal role of Deterministic request schema validation is requiring the incoming payload to match allowed fields, types, sizes, and enum values before any prompt is assembled. Because it does not detect adversarial natural-language intent by itself, this option solves an adjacent problem rather than the one that determines the answer.
Answer D is incorrect because ApplyGuardrail before model invocation is intended for evaluating user text with a configured Bedrock guardrail independently of a foundation-model call. This case requires precise guardrail evaluation scope. Since it does not by itself execute a bespoke multi-service moderation state machine, it would shift attention to a different control objective and leave the stated requirement unsatisfied.
Question 17
A generated HTTP response passes model checks but must still have forbidden headers removed and a policy banner added at the service boundary. Where should this final transformation occur? Choose ONE.
- ApplyGuardrail on generated output
- API Gateway response filtering layer
- Amazon Bedrock Guardrails output content filters
- Lambda post-processing safety validator
Correct Answer: B
Correct Answer
Answer B is correct because The scenario is best handled by API Gateway response filtering layer. an API Gateway response layer can apply edge transformations or filtering after application processing and before the payload leaves the API boundary. Its relevance comes from the need for last-stage API response policy enforcement; model-aware safety controls belong earlier and address different risks.
Incorrect Answers
Answer A is incorrect because ApplyGuardrail on generated output supports assessing model-generated text with a configured Bedrock guardrail independently from the model invocation path. Because it is not a factual grounding system unless contextual-grounding inputs are also supplied, relying on it would leave the application exposed to the failure mode called out in the question.
Answer C is incorrect because Amazon Bedrock Guardrails output content filters would make sense for evaluating generated text against harmful-content categories before the response is delivered. Because it does not prove that every factual claim is supported by a reference source, it targets the wrong failure mode even though it may coexist with the correct safeguard.
Answer D is incorrect because Lambda post-processing safety validator addresses running custom deterministic checks on generated output before it reaches the caller when managed policies are not sufficient. Since it requires application logic and does not automatically provide all Bedrock Guardrail policy types, selecting it would protect a different boundary and would not close the specific exposure described.
Question 18
A compliance assistant must show the document identifiers that support each answer so a reviewer can inspect the evidence. Which design best increases verifiability? Choose ONE.
- JSON Schema constrained output validation
- Evidence-backed source citation
- Confidence or uncertainty scoring with a decision threshold
- Amazon Bedrock Knowledge Bases retrieval grounding
Correct Answer: B
Correct Answer
Answer B is correct because Evidence-backed source citation is the strongest fit because evidence-backed citations connect the response to the specific retrieved sources used for support, enabling independent reviewer verification. The deciding requirement is traceable evidence attribution for generated answers. That combination addresses the stated safety boundary directly while leaving unrelated controls to complementary layers.
Incorrect Answers
Answer A is incorrect because JSON Schema constrained output validation is intended for requiring generated structured output to conform to expected fields, types, and allowed shapes before downstream automation accepts it. Since schema validity cannot prove that a semantically plausible value is factually true, it would shift attention to a different control objective and leave the stated requirement unsatisfied.
Answer C is incorrect because Confidence or uncertainty scoring with a decision threshold serves estimating answer reliability and using a calibrated threshold to accept, retry, abstain, or escalate uncertain responses. Since an uncalibrated score can create false assurance, it would not enforce the exact boundary described and therefore is not the best answer.
Answer D is incorrect because Amazon Bedrock Knowledge Bases retrieval grounding belongs in designs that need retrieving relevant enterprise source material and supplying it as context so the model answers from managed evidence. The present requirement is narrower: traceable evidence attribution for generated answers.
Question 19
A company alternates between Bedrock models and an external provider but wants the same managed text-safety policy around both. Which design best preserves a consistent control? Choose ONE.
- ApplyGuardrail on generated output
- Comprehend → Guardrails → Lambda → API Gateway layered safety path
- ApplyGuardrail before model invocation
- Provider-independent ApplyGuardrail safety layer
Correct Answer: D
Correct Answer
Answer D is correct because The required control is Provider-independent ApplyGuardrail safety layer. Here, the independent ApplyGuardrail API can evaluate text outside a Bedrock model invocation, allowing one safety policy to wrap different inference providers, which matches the need for a guardrail layer decoupled from the generator provider. the application still decides where to place input and output checks.
Incorrect Answers
Answer A is incorrect because ApplyGuardrail on generated output solves problems involving assessing model-generated text with a configured Bedrock guardrail independently from the model invocation path. Its limitation is that it is not a factual grounding system unless contextual-grounding inputs are also supplied, so the application would still be missing the mechanism the question asks for.
Answer B is incorrect because Comprehend → Guardrails → Lambda → API Gateway layered safety path addresses using distinct pre-processing, managed guardrails, custom post-processing, and API-edge controls so one failure does not become the only barrier. The scenario’s controlling requirement is a guardrail layer decoupled from the generator provider, not that function.
Answer C is incorrect because ApplyGuardrail before model invocation can strengthen a system through evaluating user text with a configured Bedrock guardrail independently of a foundation-model call. Because it does not by itself execute a bespoke multi-service moderation state machine, this choice would address a neighboring risk and leave the central requirement unmet.
Question 20
An agent tool accepts an operation name, resource ARN, and numeric limit. Security wants to reject unknown operations and out-of-range parameters even if the model requests them. Which control is most appropriate? Choose ONE.
- Amazon Bedrock Guardrails prompt attack filter
- Deterministic request schema validation
- Schema-constrained tool arguments with allowlisted values
- Least-privilege tool and action allowlist
Correct Answer: C
Correct Answer
Answer C is correct because Schema-constrained tool arguments with allowlisted values directly satisfies this scenario: validating operation names, resource patterns, and bounded values at the tool boundary prevents generated arguments from exceeding approved authority. The application specifically needs strict schema and allowlist enforcement on tool parameters. this is a deterministic safeguard even when upstream attack detection is imperfect.
Incorrect Answers
Answer A is incorrect because Amazon Bedrock Guardrails prompt attack filter belongs in designs that need detecting prompt injection and jailbreak attempts intended to override developer instructions, bypass safeguards, or expose protected instructions. The present requirement is narrower: strict schema and allowlist enforcement on tool parameters.
Answer B is incorrect because Deterministic request schema validation supports requiring the incoming payload to match allowed fields, types, sizes, and enum values before any prompt is assembled, which is useful in the right context. The deciding requirement here is strict schema and allowlist enforcement on tool parameters.
Answer D is incorrect because Least-privilege tool and action allowlist is appropriate for permitting only approved agent tools, methods, and parameter ranges so a manipulated prompt cannot invoke arbitrary capabilities. Since it limits blast radius but does not detect every prompt attack, it belongs elsewhere in the design and does not meet the scenario’s primary safety objective.
