AWS Certified Generative AI Developer — Professional (AIP-C01) practice questions and exam guide

A developer building a prompt template needs to insert user-supplied free text (such as a customer complaint) into a fixed instruction template. Which risk is MOST important to mitigate at this insertion point?

1. Exceeding the model's maximum supported number of few-shot examples
2. Triggering an automatic fine-tuning job on the inserted text
3. Causing the embedding model to generate incorrect vector dimensions
4. Prompt injection, where the inserted user text contains instructions that attempt to override the template's intended behavior

Answer: D — Prompt injection, where the inserted user text contains instructions that attempt to override the template's intended behavior

Right — free-text insertion into a fixed template is the classic vector for prompt injection, where malicious or unexpected instructions embedded in user input attempt to hijack the model's behavior, making this the controlling security risk. A few-shot example count limit is a true-but-irrelevant constraint unrelated to inserting a single piece of free text. Inference calls do not trigger fine-tuning jobs automatically, so that is a fabricated consequence. Embedding vector dimensionality is determined by the embeddings model configuration, not by inserting text into a generation prompt.

Which AWS service provides a curated hub of pre-trained foundation and task-specific models, along with example notebooks, that a team can deploy directly to a SageMaker endpoint for fine-tuning or inference?

1. Amazon SageMaker Canvas
2. AWS Marketplace for Machine Learning
3. SageMaker JumpStart
4. Amazon Bedrock Knowledge Bases

Answer: C — SageMaker JumpStart

Right — JumpStart is the model hub inside SageMaker Studio that packages pre-trained models with deployable notebooks for fine-tuning and inference. Knowledge Bases is a real Bedrock capability, but it manages RAG retrieval, not a general model catalog with notebooks. SageMaker Canvas is a true AWS service, but it is a no-code ML/BI tool, not a model hub. AWS Marketplace does list ML models for purchase, which makes it tempting, but it is a general software marketplace rather than the SageMaker-integrated hub with example notebooks.

What is the PRIMARY purpose of Amazon Bedrock's model evaluation feature?

1. To monitor real-time production inference latency and trigger automatic failover between models
2. To redact personally identifiable information from prompts before they reach the model
3. To compare candidate foundation models against each other using automatic metrics or human evaluators on a representative task set before committing to one for production
4. To automatically retrain a foundation model's weights on a customer's proprietary dataset

Answer: C — To compare candidate foundation models against each other using automatic metrics or human evaluators on a representative task set before committing to one for production

Right — model evaluation is a pre-selection benchmarking capability that compares models on metrics or human judgment for a given task set. Retraining weights describes fine-tuning/customization, a different Bedrock capability entirely. Real-time latency monitoring and failover describes an operational/observability concern, not evaluation. PII redaction describes a Guardrails-related data protection function, not model comparison.

A developer needs an agent to answer questions from an internal HR policy PDF library and also be able to submit a time-off request through an internal API. Which pairing of Bedrock agent resources correctly matches the two capabilities?

1. A knowledge base for the PDF library, and an action group for submitting the time-off request
2. An action group for the PDF library, and a knowledge base for submitting the time-off request
3. Two action groups, one for each capability, since both involve external systems
4. A single knowledge base that stores both the PDF library and a log of submitted requests

Answer: A — A knowledge base for the PDF library, and an action group for submitting the time-off request

Knowledge bases are for retrieval over unstructured content like policy documents, while action groups are for taking real, parameterized actions against an API — matching each capability to its purpose. The reversed pairing mismatches both: PDFs aren't an executable action, and submitting a request isn't retrievable, static content. Treating the PDF library as an action group misses that it's static reference content meant for RAG, not an API call. A single knowledge base can't execute a write operation like submitting a request; knowledge bases are read-only retrieval sources, not systems for taking action.

A customer-facing chatbot frequently receives near-duplicate questions (e.g., many phrasings of 'what are your return hours') that all require the same underlying model-generated answer. Latency and Bedrock invocation costs are both concerns. Which enhancement addresses BOTH without materially harming answer freshness for genuinely new questions?

1. Introduce a semantic caching layer that matches incoming queries against previously answered, semantically similar queries and reuses the cached response when the similarity exceeds a threshold
2. Increase the model's max token output so future answers are more complete on the first try
3. Switch the underlying model to a larger, more capable model to reduce the chance of a wrong answer
4. Reduce the model's temperature to 0 for every request to make responses more deterministic

Answer: A — Introduce a semantic caching layer that matches incoming queries against previously answered, semantically similar queries and reuses the cached response when the similarity exceeds a threshold

A semantic cache recognizes that differently worded questions carry the same intent and serves the previously generated answer for high-similarity matches, cutting both latency and repeated invocation cost while still calling the model fresh for genuinely novel queries. Increasing max tokens affects response length/completeness, not repeated cost or latency for duplicate questions. A larger model could improve quality but would increase, not decrease, per-invocation cost and latency, the opposite of what's needed here. Setting temperature to 0 improves consistency of a single model call but does nothing to avoid re-invoking the model for repeated semantically similar questions.

A developer configuring a Bedrock agent action group has only three simple parameters (a customer ID, a date range, and a status filter) with no need for nested objects or multiple HTTP methods. Compared to authoring a full OpenAPI schema, what is the advantage of instead defining the action using the function-detail schema format?

1. It is the only format Bedrock supports for actions backed by a Lambda function
2. It automatically generates API Gateway routes for the underlying Lambda function
3. It removes the need to grant the agent's execution role permission to invoke the Lambda function
4. It lets the developer declare the function's name, description, and parameters directly and concisely, without writing a full OpenAPI document

Answer: D — It lets the developer declare the function's name, description, and parameters directly and concisely, without writing a full OpenAPI document

The function-detail schema is a lighter-weight alternative meant for simple, flat parameter sets, letting a developer skip the overhead of a full OpenAPI document when there's no real need for one. Both OpenAPI schemas and function-detail schemas can back Lambda-backed actions, so OpenAPI is not excluded, it's just heavier than necessary for a simple case. Neither schema format provisions API Gateway resources; that would need to be set up separately if desired. Invocation permissions are an IAM concern independent of which schema format describes the action's parameters.

A parent organization wants to prevent member accounts in a specific AWS Organizations OU from using any generative AI services except a pre-approved list, regardless of what IAM permissions individual account administrators grant. What is the MOST appropriate control?

1. A Service Control Policy (SCP) attached to the OU that denies the disallowed GenAI-related service actions
2. An IAM permissions boundary applied individually to every IAM user in each account
3. A Bedrock Guardrail applied at the organization level
4. AWS Config rules that flag non-compliant resource usage after the fact

Answer: A — A Service Control Policy (SCP) attached to the OU that denies the disallowed GenAI-related service actions

Right — a Service Control Policy attached at the OU level sets a permission ceiling that applies across every account and principal in that OU, including account administrators, so even if a local admin grants broad IAM permissions, actions denied by the SCP still cannot be performed, which matches the requirement for an org-wide, override-proof restriction. Applying permissions boundaries to every individual IAM user is operationally unscalable across many accounts and does not inherently prevent an account administrator from creating new users or roles without that boundary attached. Bedrock Guardrails operate on the content of prompts and responses for a given model invocation; they are not an access-control mechanism for restricting which GenAI services can be used at the organization level. AWS Config rules can detect and report non-compliant configurations after they occur, but they do not preventively block disallowed API actions the way an SCP does.

Which of the following IAM policy statements for a Bedrock agent application violates least privilege, EXCEPT for one that is actually appropriately scoped? Identify the appropriately scoped statement.

1. Allow iam:PassRole on Resource: '*' for the same execution role
2. Allow s3:* on Resource: '*' attached to the role that only needs to read one knowledge base data source bucket
3. Allow bedrock:InvokeAgent restricted to the specific agent alias ARN the application uses in production
4. Allow bedrock:* on Resource: '*' for the application's runtime execution role

Answer: C — Allow bedrock:InvokeAgent restricted to the specific agent alias ARN the application uses in production

Right — scoping bedrock:InvokeAgent to the exact agent alias ARN the application actually uses grants only the specific permission needed for the application's function, which is the definition of least privilege being correctly applied. Granting bedrock:* across all resources gives the role administrative-level access to every Bedrock action (including model creation, deletion, and guardrail management) far beyond invoking an agent, which is excessive. Allowing iam:PassRole on all resources lets the role pass any role in the account to a service, which could enable privilege escalation and is unrelated to the agent's actual function. Granting s3:* on all resources when only read access to one specific bucket is needed grants full S3 administrative control (including delete and write on unrelated buckets) far beyond what the workload requires.

A GenAI application running in private subnets calls Amazon Bedrock through an interface VPC endpoint. Security review flags that the endpoint's security group currently allows inbound HTTPS from 0.0.0.0/0. What is the BEST remediation?

1. Restrict the endpoint security group's inbound rule to the CIDR ranges of the specific subnets or security groups that host the application, on port 443 only
2. Remove the security group from the VPC endpoint entirely so no traffic filtering is applied
3. Change the endpoint from an interface endpoint to a gateway endpoint to eliminate the need for a security group
4. Leave the rule as-is since VPC endpoint traffic never leaves the AWS network regardless of security group configuration

Answer: A — Restrict the endpoint security group's inbound rule to the CIDR ranges of the specific subnets or security groups that host the application, on port 443 only

Right — scoping the interface endpoint's security group to allow inbound HTTPS only from the specific application subnets or security groups enforces least privilege at the network layer, ensuring only intended resources within the VPC can reach the endpoint even though the endpoint itself is already private. Removing the security group is not a valid remediation and would leave the resource without any traffic filtering, worsening the exposure rather than fixing it. Bedrock does not support gateway endpoints (only S3 and DynamoDB do); interface endpoints always require a security group, so this option describes an unsupported configuration. Being privately routed within AWS's network is a separate property from access control; an overly broad 0.0.0.0/0 rule still allows any resource within the VPC (or peered/routed networks) to reach the endpoint, so it remains a real least-privilege gap worth fixing.

An application occasionally receives ThrottlingException errors from Bedrock during short traffic bursts that resolve within a few seconds. The team wants to handle this gracefully without manual intervention or overwhelming the service further. What is the BEST client-side pattern?

1. Implement retries with exponential backoff and jitter, capped at a small number of attempts before surfacing an error.
2. Immediately retry the failed request in a tight loop until it succeeds.
3. Increase the application's request timeout so throttled requests are given more time to complete.
4. Switch all traffic to batch inference so throttling no longer applies.

Answer: A — Implement retries with exponential backoff and jitter, capped at a small number of attempts before surfacing an error.

Right - because exponential backoff with jitter spaces out retries so the client gives the service room to recover from a burst rather than adding to the load, and capping attempts prevents the retry logic from hanging indefinitely. Retrying in a tight loop is a common mistake practitioners fall into - it increases request rate exactly when the service is already constrained, which can prolong or worsen the throttling. Extending the timeout does not help because a throttled request is rejected immediately rather than left pending, so waiting longer changes nothing about the outcome. Moving all traffic to batch inference sidesteps real-time throttling but abandons the latency-sensitive, real-time nature of the application, and batch inference has its own separate quotas that can also be exceeded.

A platform team supports five product teams that all invoke the same shared Bedrock models. Finance wants to attribute GenAI spend to each product team for chargeback. What is the BEST way to enable this?

1. Use CloudWatch Logs Insights to query invocation logs and manually total tokens per team each month.
2. Enable Bedrock model invocation logging to Amazon S3 for long-term audit retention.
3. Apply consistent cost allocation tags, such as team, project, and cost-center, to the invoking resources and requests, and activate those tags in AWS Cost Explorer or Billing.
4. Create a separate AWS account for each product team so costs are isolated by account boundary.

Answer: C — Apply consistent cost allocation tags, such as team, project, and cost-center, to the invoking resources and requests, and activate those tags in AWS Cost Explorer or Billing.

Right - because cost allocation tags are the AWS-native mechanism for attributing shared-resource spend to the teams generating it, and activating them surfaces per-team costs directly in Cost Explorer or Billing reports. A per-team account achieves isolation too, but it is a much heavier organizational restructuring than the question calls for when tagging within the existing shared setup solves the same problem. Manually tallying tokens from logs is possible but labor-intensive and error-prone, and it is not the built-in AWS cost allocation mechanism. Invocation logging to S3 is a true and useful capability for audit and compliance, but logging alone does not attribute dollar cost to a team without an additional tagging or accounting layer.

A team is evaluating a summarization model in Amazon Bedrock and needs to score a subjective quality -- whether the tone of each summary is appropriate for an executive audience -- across hundreds of generated outputs. Which evaluation approach is MOST appropriate?

1. Configure a Bedrock automatic evaluation job and use the ROUGE score to approximate tone quality
2. Skip a formal evaluation job and have one engineer spot-check five outputs in the console
3. Configure a Bedrock human evaluation job with a defined work team and a rubric that scores tone appropriateness on an anchored scale
4. Configure a Bedrock automatic evaluation job using the built-in toxicity metric

Answer: C — Configure a Bedrock human evaluation job with a defined work team and a rubric that scores tone appropriateness on an anchored scale

Right -- tone appropriateness is a nuanced, subjective judgment that automatic metrics cannot reliably score, so a human evaluation job with a defined rubric and work team is the controlling choice; the binding constraint is that only human raters can judge audience-appropriate tone consistently. The toxicity metric is a real automatic metric, but it measures harmful content, not tone fit, so it is true but irrelevant here. ROUGE measures n-gram overlap with a reference text and says nothing about tone, a common misconception about what lexical-overlap metrics can capture. Ad hoc spot-checking by one person is not a repeatable or scalable evaluation process and lacks any defined rubric.

What role does an OpenAPI schema play in a Bedrock Agent action group?

It formally describes the available API operations, parameters, and expected responses, allowing the foundation model to understand which action to call and how to structure the request correctly.

What is the purpose of A/B testing prompts in a GenAI application?

Comparing two or more prompt variants (or model configurations) against real or simulated traffic to measure differences in output quality, latency, or user engagement before committing to a single version in production.

What is the AWS Certified Generative AI Developer - Professional exam?

It is a professional-level AWS certification that validates a candidate's ability to design, build, deploy, secure, and optimize generative AI applications on AWS using services such as Amazon Bedrock and Amazon SageMaker. It targets experienced GenAI developers who work with foundation models in production.

What is few-shot prompting?

A prompting technique that includes a small number of example input-output pairs in the prompt before the actual task, helping the model infer the expected pattern, format, or style of response.

What is the purpose of Amazon Bedrock Prompt Flows?

A visual, low-code builder for chaining prompts, foundation model calls, knowledge base lookups, and Lambda logic into a defined execution flow, simplifying orchestration of multi-step GenAI application logic.

When should you use human-based evaluation instead of automatic evaluation in Bedrock?

When judging subjective qualities like coherence, helpfulness, or brand tone that automated metrics cannot reliably capture; human evaluators score or compare model outputs using defined rating criteria.