QuiztudyPREMIUM
🌍 All Study Guides📊 Dashboard📰 Blog💡 About
AWS Certified AI Practitioner • STUDY MODE

Practice Quiz

QUESTION 1 OF 6

A highly regulated financial company wants to use Amazon Bedrock but must ensure that third-party model providers have absolutely no access to their proprietary prompts, completions, or system logs. How does Amazon Bedrock isolate and protect this data from model providers?

A
Amazon Bedrock performs a deep copy of the model provider's inference and training software to run it in Model Deployment Accounts owned and operated solely by the Amazon Bedrock service team.Correct Answer
B
Amazon Bedrock routes all customer prompts through the customer's own local VPC where the model provider's software is installed and managed by the customer.
C
Amazon Bedrock requires model providers to access customer accounts via read-only IAM roles to inspect logs and completions.
D
Amazon Bedrock encrypts prompts at rest using AWS KMS keys, which model providers must request authorization from the customer to decrypt.
Explanation:

Under the Amazon Bedrock data protection architecture, model providers do not have any access to Amazon Bedrock logs, customer prompts, or completions. This is because Amazon Bedrock performs a deep copy of the model provider's inference and training software and deploys it in Model Deployment Accounts owned and operated solely by the Amazon Bedrock service team.

QUESTION 2 OF 6

When establishing secure data communication and storage practices in Amazon Bedrock, which of the following is a requirement or recommendation specified for customers?

A
Customers must use SSL/TLS to communicate with AWS resources, where TLS 1.2 is required and TLS 1.3 is recommended.Correct Answer
B
Customers must input all sensitive and confidential diagnostic logs into resource tags or free-form text Name fields.
C
Customers must manage and configure the security of the underlying global infrastructure running Amazon Bedrock.
D
Customers must host the deep-copied model provider inference software inside their own self-managed AWS accounts.
Explanation:

For secure communication with AWS resources, Amazon Bedrock requires TLS 1.2 and recommends TLS 1.3. Additionally, customers should avoid putting sensitive information in tags/free-form fields, AWS is responsible for global infrastructure, and model provider software is run in accounts owned solely by the Bedrock service team.

QUESTION 3 OF 6

A company wants to establish private connectivity between their AWS VPC and Amazon Bedrock. The design must ensure that VPC instances can invoke Bedrock models without using public IP addresses, an internet gateway, or a NAT device. Additionally, the developer wants to avoid making any application code changes, meaning the application must automatically route API calls through the private connection using Bedrock's standard regional DNS names. Which configuration meets all of these requirements?

A
Establish an AWS PrivateLink interface endpoint for Amazon Bedrock and ensure private DNS is enabled on the endpoint.Correct Answer
B
Create an AWS PrivateLink interface endpoint for Amazon Bedrock but leave private DNS disabled, making no code changes.
C
Set up a NAT Gateway in the VPC and configure the instances with public IP addresses to route traffic to Bedrock.
D
Establish an AWS Direct Connect connection to route all Bedrock API traffic and update the application code to use custom VPC endpoint URLs.
Explanation:

AWS PrivateLink allows you to create a private connection between your VPC and Amazon Bedrock without needing public IP addresses, an internet gateway, a NAT device, a VPN connection, or an AWS Direct Connect connection. Enabling private DNS on the interface endpoint routes Bedrock VPC API traffic automatically using standard regional DNS names without requiring code changes; otherwise, you would have to explicitly specify the custom VPC endpoint URL in your application code.

QUESTION 4 OF 6

A security administrator needs to control access to Amazon Bedrock from within a corporate VPC. They have established an interface VPC endpoint for Amazon Bedrock. By default, the interface endpoint allows full access to the service. The administrator wants to restrict access so that only specific IAM principals can perform specific actions through this endpoint. How can the administrator accomplish this?

A
Attach a custom IAM endpoint policy to the interface VPC endpoint that specifies permitted principals, actions, and resources.Correct Answer
B
Configure an internet gateway and route tables to restrict traffic from unauthorized VPC instances.
C
Enable private DNS on the endpoint and rely on regional DNS mapping to automatically filter unauthorized IAM principals.
D
Recreate the interface endpoint using service names that do not contain 'runtime' to automatically prevent model execution actions.
Explanation:

To manage and restrict access to Amazon Bedrock through an interface endpoint, you can attach a custom IAM endpoint policy. This policy specifies the permitted principals, actions, and resources, replacing the default policy that allows full access.

QUESTION 5 OF 6

A company is designing a secure network architecture to allow EC2 instances in a private VPC subnet to access Amazon Bedrock. Under strict security requirements, the instances must not have public IP addresses, and the VPC must not have an internet gateway, NAT device, VPN, or Direct Connect connection. Additionally, the company must restrict and control access to Amazon Bedrock by specifying permitted principals and actions directly on the VPC interface endpoint connection. Which solution meets these requirements?

A
Create an interface VPC endpoint (AWS PrivateLink) for Amazon Bedrock and attach a custom endpoint policy to the endpoint.Correct Answer
B
Deploy a NAT Gateway within the VPC and apply IAM role-based trust policies directly on the EC2 instances.
C
Establish an AWS Direct Connect connection with an internet gateway and configure bucket policies to restrict access.
D
Configure public IP addresses on the EC2 instances and route traffic through a default route to an internet gateway.
Explanation:

AWS PrivateLink allows the creation of a private connection between a VPC and Amazon Bedrock, enabling access without using an internet gateway, NAT device, VPN, or Direct Connect connection, and without requiring public IP addresses on instances. To restrict and control this access, a custom endpoint policy (an IAM resource) can be attached to the interface endpoint to specify allowed principals, actions, and resources.

QUESTION 6 OF 6

When establishing a private connection to Amazon Bedrock using AWS PrivateLink, what is the direct operational difference between enabling and disabling private DNS on the interface endpoint?

A
With private DNS enabled, API calls automatically route through the endpoint using standard service DNS names. With private DNS disabled, the VPC endpoint URL must be explicitly specified.Correct Answer
B
With private DNS enabled, all endpoints automatically resolve to FIPS-compliant service names. With private DNS disabled, non-FIPS endpoints are resolved.
C
With private DNS enabled, no custom endpoint policy is supported. With private DNS disabled, custom IAM endpoint policies are mandatory.
D
With private DNS enabled, EC2 instances require public IP addresses. With private DNS disabled, instances must use private IP addresses.
Explanation:

If private DNS is enabled, all Amazon Bedrock API calls from within the VPC automatically route through the endpoint using standard service DNS names (such as bedrock-runtime.region.amazonaws.com) without any code changes. If private DNS is not enabled, the VPC endpoint URL must be explicitly specified in the API calls.

Ready to test your recall?

A highly regulated financial company wants to use Amazon Bedrock but must ensure that third-party model providers have absolutely no access to their proprietary prompts, completions, or system logs. How does Amazon Bedrock isolate and protect this data from model providers?

A
Amazon Bedrock performs a deep copy of the model provider's inference and training software to run it in Model Deployment Accounts owned and operated solely by the Amazon Bedrock service team.
B
Amazon Bedrock routes all customer prompts through the customer's own local VPC where the model provider's software is installed and managed by the customer.
C
Amazon Bedrock requires model providers to access customer accounts via read-only IAM roles to inspect logs and completions.
D
Amazon Bedrock encrypts prompts at rest using AWS KMS keys, which model providers must request authorization from the customer to decrypt.

How confident are you in this answer?