Generative AI Security and Governance on AWS
AIF-C01 tests whether you can match a generative AI threat to the right AWS control. This page walks through a representative scenario question and then maps Bedrock Guardrails, IAM, KMS, CloudTrail, and PrivateLink to the threats they actually solve.
Short answer
The correct answer is B. Configure Amazon Bedrock Guardrails with denied topics and sensitive information filters.
Amazon Bedrock Guardrails is the purpose-built, managed safety layer for generative AI applications on Bedrock. It lets you define denied topics in natural language (for example, competitor brands, legal advice, or medical advice), configure content filters for hate, insults, sexual, and violence categories, apply sensitive information filters that detect and mask or block PII such as phone numbers, email addresses, and credit card numbers, add word filters for profanity and custom blocklists, and enable contextual grounding checks that score responses against source documents to reduce hallucinations. Guardrails evaluates both the input prompt and the model output, so a blocked topic in the user request is refused before it ever reaches the model, and a policy-violating response is intercepted before it reaches the user. Crucially, Guardrails is model-agnostic — the same guardrail can be applied across Claude, Llama, Titan, and others through the ApplyGuardrail API or the InvokeModel and Converse calls. That matches the scenario's requirements exactly: managed, no custom filtering code, topic and PII control, works on prompts and responses. IAM controls who can call the API, not what content flows through it, so it cannot enforce semantic rules like 'no competitor discussion.'
The Question
A retail company runs a customer-facing chatbot on Amazon Bedrock using Anthropic Claude. Legal has mandated that the assistant must never discuss competitor brands or provide legal or medical advice, and that any user-supplied personal information such as phone numbers or credit card numbers must be masked before it reaches the model. The team wants a managed, model-agnostic control that enforces these rules on both prompts and responses without building custom filtering code. Which AWS capability should they use?
Why B is correct
Amazon Bedrock Guardrails is the purpose-built, managed safety layer for generative AI applications on Bedrock. It lets you define denied topics in natural language (for example, competitor brands, legal advice, or medical advice), configure content filters for hate, insults, sexual, and violence categories, apply sensitive information filters that detect and mask or block PII such as phone numbers, email addresses, and credit card numbers, add word filters for profanity and custom blocklists, and enable contextual grounding checks that score responses against source documents to reduce hallucinations. Guardrails evaluates both the input prompt and the model output, so a blocked topic in the user request is refused before it ever reaches the model, and a policy-violating response is intercepted before it reaches the user. Crucially, Guardrails is model-agnostic — the same guardrail can be applied across Claude, Llama, Titan, and others through the ApplyGuardrail API or the InvokeModel and Converse calls. That matches the scenario's requirements exactly: managed, no custom filtering code, topic and PII control, works on prompts and responses. IAM controls who can call the API, not what content flows through it, so it cannot enforce semantic rules like 'no competitor discussion.'
Why the other options are wrong
IAM policies authorize API actions, principals, and resources. They cannot inspect prompt text or model output for semantic content like competitor names or medical advice. IAM is necessary for access control but is the wrong layer for content policy enforcement.
CloudTrail records that an API call happened and, with Bedrock model invocation logging, can capture prompts and responses for audit. It is a detective control, not a preventive one — it does not block or mask content in real time, which is what the legal mandate requires.
AWS WAF protects HTTP endpoints you own (CloudFront, ALB, API Gateway) with rules on request patterns. It is not designed to inspect Bedrock API payloads or model responses, and it does not understand denied topics or PII semantics the way Guardrails does.
Matching GenAI threats to the right AWS control
On AIF-C01, security questions usually describe a threat and ask you to pick the control. The trick is to map the threat to the correct layer of the stack. Identity and access lives in IAM. Use IAM policies to decide which principals can call bedrock:InvokeModel, which models they can access through resource-level permissions on foundation model ARNs, and which knowledge bases or agents they can use. Network isolation lives in VPC endpoints and AWS PrivateLink. Interface VPC endpoints for Bedrock keep traffic off the public internet and let you enforce endpoint policies, which is typical for regulated workloads. Data protection at rest uses AWS KMS. Bedrock encrypts custom models, fine-tuning data, agent sessions, and knowledge base vectors with AWS owned keys by default, and you can bring a customer managed KMS key for stricter control and key rotation. Data privacy during training and inference is handled by AWS policy: prompts and completions sent to Bedrock are not used to train the base foundation models, and customers keep ownership of their data. Content safety lives in Bedrock Guardrails — denied topics, content filters, sensitive information filters, word filters, and contextual grounding checks. Auditability lives in CloudTrail and in Bedrock model invocation logging, which can deliver full prompt and response payloads to Amazon S3 or CloudWatch Logs for review. Prompt injection defense is a layered problem: Guardrails filters known-bad instructions, least-privilege IAM limits what tools an agent can call, and system prompts plus input validation reduce blast radius. When you see a scenario, ask which layer the control has to act at — identity, network, data, content, or audit — and the answer usually falls out.
Ready to see how you'd score?
Take the free practice quiz and find out which AWS Certified AI Practitioner domains you need to focus on. No signup required.
Practice 5 similar questions
Same cert, same or adjacent domain. Use these after reviewing the explanation.