Skill 1.1.1: Extract data from data sources

Question 1 - IAM Least Privilege for SageMaker Training Job Access to S3

A financial services company is building a fraud detection model using Amazon SageMaker. The data science team needs to run a training job that reads training data from a specific S3 bucket (s3://fraud-data-2024/) and writes model artifacts to a separate S3 bucket (s3://fraud-models/).

The security team has mandated that least privilege access must be enforced, meaning the training job should have access to only the specific data files required for training and the exact model output prefix—nothing more.

Which TWO IAM policy statements should the ML engineer include in the training job's execution role to meet these requirements? (Select TWO)

A) A statement allowing s3:GetObject on arn:aws:s3:::fraud-data-2024/* and another statement allowing s3:PutObject on arn:aws:s3:::fraud-models/training-output/*
B) A statement allowing s3:ListBucket on arn:aws:s3:::fraud-data-2024 and another statement allowing s3:ListBucket on arn:aws:s3:::fraud-models
C) A statement allowing s3:GetObject, s3:PutObject, and s3:DeleteObject on arn:aws:s3:::fraud-data-2024/* and arn:aws:s3:::fraud-models/*
D) A statement allowing s3:* on both buckets to ensure the training job never fails due to permission issues
E) A statement allowing sagemaker:CreateTrainingJob on arn:aws:sagemaker:*:*:*

Click to reveal Answer & Explanation

Correct Answers: A and B

Correct Options Analysis

A is Correct: This statement grants precisely the object-level access needed: read access (s3:GetObject) to the training data bucket and write access (s3:PutObject) only to the specific output prefix in the model artifacts bucket. This demonstrates least privilege by scoping to exact prefixes.
B is Correct: s3:ListBucket is required at the bucket level (without the /* suffix) so the SageMaker training job can enumerate the objects in the bucket to locate training files. This is a frequently overlooked but necessary permission for S3 access.

Distractor Analysis

C is Incorrect: This statement is overly broad because it includes full access to all objects in the training data bucket (s3:DeleteObject on fraud-data-2024/*), which allows deletion of production data—a risk that violates least privilege. It also grants broader access than needed by not scoping the output prefix.
D is Incorrect: s3:* provides administrative-level access, including s3:DeleteBucket, which is clearly excessive and violates the principle of least privilege.
E is Incorrect: sagemaker:CreateTrainingJob is not needed in the execution role because this action is performed by the caller who initiates the training, not by the role assumed during training execution.

Key Takeaway: For S3 access in SageMaker roles, always separately grant s3:GetObject/s3:PutObject at object level (bucket/*) and s3:ListBucket at bucket level—and scope to exact prefixes.

Question 2 - VPC Interface Endpoints for Private SageMaker Endpoint

A healthcare organization is deploying a SageMaker hosted endpoint for a patient risk prediction model. The endpoint must be completely isolated from the public internet to comply with HIPAA data privacy regulations.

The inference application runs on Amazon ECS tasks in a private subnet, and the model artifacts are stored in Amazon S3. The organization's infrastructure uses a multi-VPC architecture with no NAT Gateway in the private subnet.

Which combination of configurations should the ML engineer implement to ensure the endpoint operates securely? (Select TWO)

A) Create an interface VPC endpoint (PrivateLink) for com.amazonaws.region.sagemaker.runtime in the private subnet to route InvokeEndpoint traffic over the AWS network backbone
B) Create an interface VPC endpoint for com.amazonaws.region.sagemaker.api to pull the model artifact into the endpoint
C) Add an Internet Gateway to the private subnet so the ECS tasks can reach the SageMaker endpoint public URL
D) Configure a security group on the SageMaker endpoint that only allows inbound TCP traffic on port 443 from the ECS task security group
E) Set up an S3 Gateway endpoint in the VPC so the SageMaker endpoint can access model artifacts over the private network

Click to reveal Answer & Explanation

Correct Answers: A and D

Correct Options Analysis

A is Correct: An interface VPC endpoint for sagemaker.runtime allows the ECS tasks to invoke the SageMaker endpoint over AWS PrivateLink, keeping traffic off the public internet—this is the correct way to reach a deployed endpoint from a private subnet.
D is Correct: A security group restricting inbound traffic to port 443 from the specific ECS task security group enforces that only the intended application can call the endpoint, implementing network-level least privilege.

Distractor Analysis

B is Incorrect: sagemaker.api endpoint is for control-plane operations (like CreateEndpoint, DescribeEndpoint), not for pulling model artifacts. Model artifacts are loaded by the managed SageMaker endpoint service, which handles its own storage access—you do not need a VPC endpoint for this. Additionally, there is no such valid PrivateLink endpoint for artifact retrieval.
C is Incorrect: Adding an Internet Gateway would defeat the entire isolation requirement—it makes the subnet publicly routed, violating HIPAA-compliant network isolation. This is exactly what must be avoided.
E is Incorrect: While S3 Gateway endpoints are valid for private connectivity to S3, the SageMaker endpoint does NOT need this. The endpoint's managed infrastructure loads artifacts from S3 on the service side, not from within your VPC. The question specifically asks about endpoint isolation, not how the endpoint retrieves model data.

Key Takeaway: Use sagemaker.runtime interface endpoints for inference traffic from private subnets, and always pair with restrictive security group rules—never open an Internet Gateway to solve private connectivity.

Question 3 - CloudTrail Data Events for Bedrock Invocation Auditing

A multinational enterprise uses Amazon Bedrock to power an internal customer support chatbot. An internal audit requires comprehensive logging of all model invocation calls (including prompts and responses) to track who invoked which model, when, and from where.

The existing CloudTrail trail has only management events enabled by default. The security team needs to ensure that all model invocations across all Regions are captured and no sensitive data is exposed in the logs.

Which action should the ML engineer take to meet this requirement?

A) Create a new CloudTrail trail with data events enabled for Amazon Bedrock, and use CloudTrail event selectors to filter events by model ID
B) Modify the existing trail to include data events for Amazon Bedrock InvokeModel and Converse APIs, ensuring the trail is a multi-Region trail, and enable KMS encryption on the log storage bucket
C) Configure AWS Config rules to record all Bedrock InvokeModel API calls and store them in S3—no changes needed to the existing CloudTrail trail
D) Enable CloudTrail Lake with managed data events for Bedrock to query historical invocations

Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

B is Correct: Bedrock InvokeModel and Converse are classified as data events (data-plane operations). Enabling data events on the existing trail ensures these API calls are captured. Making it a multi-Region trail guarantees coverage across all Regions. KMS encryption protects the logs (which may contain sensitive data) at rest.

Distractor Analysis

A is Incorrect: Creating a new trail is unnecessary when the existing trail can be modified. Additionally, event selectors for data events don't filter by model ID—they filter by resource type or event category, not by individual model identifiers.
C is Incorrect: AWS Config tracks resource configuration state and compliance rules—it does not record individual API call data such as model invocations. This is a fundamental misunderstanding of AWS Config's purpose.
D is Incorrect: While CloudTrail Lake does support logging data events and querying, it requires specific event data store configuration. The simpler and more direct path for this requirement is to modify the existing trail. The question also specifically mentions "the existing trail was created without additional configuration," pointing to modifying it.

Key Takeaway: Bedrock InvokeModel/Converse calls are data events and must be explicitly enabled—default trails only capture management events.

Question 4 - Bedrock Guardrails Sensitive Information Filter for PII

A retail e-commerce company is building a virtual shopping assistant using Amazon Bedrock that answers customer questions about products. During testing, the assistant sometimes returns customer order numbers and phone numbers in its responses.

The company's data protection policy requires comprehensive PII protection—customer account numbers, credit card details, and personal information must not appear in model outputs under any circumstances. The solution must be fully managed with minimal operational overhead.

Which configuration should the ML engineer implement?

A) Deploy an AWS Lambda function between the application and Bedrock that uses regular expressions to redact PII from model responses before returning them to the user
B) Create a Bedrock Guardrail with a sensitive information filter that detects and blocks PII patterns like credit card numbers, phone numbers, and custom regex patterns for customer IDs, and apply it to the model invocation
C) Write application-level code that checks for pii_detection = True in the invoke_model method and manually masks the sensitive fields
D) Configure Amazon Cognito to encrypt responses before they reach the end user

Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

B is Correct: Amazon Bedrock Guardrails provides native sensitive information filters that detect PII such as credit card numbers, SSNs, phone numbers, and custom regex patterns (e.g., internal customer ID format). The filter can block or mask the sensitive content before the response is returned. This is a fully managed service with zero custom code and minimal operational overhead.

Distractor Analysis

A is Incorrect: Building a Lambda function with custom regex introduces operational complexity—you must maintain and update regex patterns as PII definitions evolve. The question explicitly requests a fully managed solution with minimal operational overhead, which is what Guardrails provides out of the box.
C is Incorrect: There is no pii_detection parameter in invoke_model. This is a fabricated feature—a distractor designed to sound plausible but does not exist in the Bedrock API.
D is Incorrect: Amazon Cognito manages user authentication and JWTs, not response-level content filtering or PII redaction. It is an identity service, not a data protection or content filtering service.

Key Takeaway: Bedrock Guardrails filters PII at the API layer, requiring no custom code—apply a sensitive information filter to block or mask protected data in both prompts and responses.

Question 5 - Least Privilege for Bedrock Model Access

A startup is using Amazon Bedrock and needs to give a group of data scientists access to invoke two foundation models: Anthropic Claude 3 Sonnet and Amazon Titan Text for a text summarization project.

The security team requires that data scientists cannot invoke any other model available in Bedrock (including future model releases), and they should not have access to create or modify any Bedrock infrastructure.

Which IAM policy should the ML engineer attach to the data scientists' IAM role?

A) Allow bedrock:InvokeModel with a Resource element specifying both model ARNs, and deny all other Bedrock actions by not including them
B) Allow bedrock:* on all resources but add a Deny policy for other model ARNs
C) Allow bedrock:InvokeModel and bedrock:ListFoundationModels with no Resource restriction
D) Allow bedrock:InvokeModel on all models and use a permission boundary to restrict access to infrastructure actions

Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

A is Correct: The IAM policy explicitly allows bedrock:InvokeModel on only the two specified model ARNs (e.g., arn:aws:bedrock:region::foundation-model/anthropic.claude-3-sonnet and arn:aws:bedrock:region::foundation-model/amazon.titan-text). Since IAM is deny-by-default, any other model is automatically refused. No additional Deny statement is needed.

Distractor Analysis

B is Incorrect: bedrock:* grants excessive permissions beyond just invocation—it could include actions like DeleteCustomModel or other control-plane operations. Adding a Deny policy for other model ARNs creates a whack-a-mole situation where you must continuously update deny lists for every new model Amazon releases. The principle of least privilege demands an allow list, not a deny list.
C is Incorrect: bedrock:ListFoundationModels with no resource restriction allows the scientists to discover and attempt to invoke all available models. This violates the least privilege specification.
D is Incorrect: Allowing bedrock:InvokeModel on all models defeats the purpose of restricting model access. Permission boundaries restrict what can be granted, but they don't automatically limit the scope of the explicit InvokeModel grant.

Key Takeaway: Use precise Resource ARNs in allow statements for Bedrock model access—IAM is deny-by-default, so listing only the required models enforces least privilege.

Question 6 - AWS Secrets Manager for API Key Rotation

An enterprise is migrating a legacy ML application to AWS. The application calls a third-party LLM API that requires a static API key for authentication. The key expires every 90 days and the current system stores it hardcoded in the application code.

The security team requires that credentials are never stored in code, images, or environment files, and that rotation is automated with zero manual intervention.

Which solution should the ML engineer implement?

A) Store the API key in AWS Secrets Manager with automatic rotation configured using a Lambda function that calls the third-party service's key rotation endpoint, and have the application retrieve the secret at runtime using secretsmanager:GetSecretValue
B) Store the API key in an S3 bucket encrypted with SSE-KMS and have the application read it at startup
C) Generate a long-term API key and embed it in the container image using build arguments—the image is stored in a private ECR repository
D) Use IAM Roles Anywhere to issue temporary credentials for the third-party API

Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

A is Correct: AWS Secrets Manager natively supports automated rotation via a Lambda function that calls the third-party API's rotation endpoint. The application retrieves the secret at runtime with GetSecretValue, eliminating hardcoded credentials. This meets both requirements: no credentials in code/images, and fully automated rotation.

Distractor Analysis

B is Incorrect: Storing the API key in S3, even with KMS encryption, does not solve the rotation automation problem. There is no built-in mechanism for scheduled rotation in S3—you would have to build a separate rotation pipeline. Also, retrieving from S3 at startup still exposes the key in application memory, and the solution lacks the secret rotation capability of Secrets Manager.
C is Incorrect: Embedding credentials in a container image via build arguments is explicitly against the security policy stated in the scenario ("credentials must never be stored in code, images"). Even in a private ECR repository, this is a red flag for security audits.
D is Incorrect: IAM Roles Anywhere is for AWS services that support IAM authentication via temporary credentials in non-AWS environments. A third-party LLM API that requires a static API key does not support IAM-style temporary credentials.

Key Takeaway: For third-party static API keys, use Secrets Manager with rotation logic—never hardcode credentials, and build a Lambda that rotates keys before expiry.

Question 7 - Amazon Inspector for Container Image Scanning in ML Pipelines

A company uses SageMaker Pipelines to build, train, and deploy ML models. The pipeline builds a custom training container image and pushes it to Amazon ECR. Before the image is used for training, the security team wants automated vulnerability scanning that checks for known CVEs in the base image and installed packages, and blocks the pipeline if critical vulnerabilities are found.

Which service should the ML engineer integrate into the pipeline?

A) Amazon CodeGuru Profiler, which will analyze runtime performance and identify memory leaks in the training container
B) Amazon Inspector with ECR container image scanning enabled—configured to continuously scan images and surface findings in Amazon Inspector and AWS Security Hub
C) AWS Config with custom rules to detect vulnerable packages in ECR images
D) Amazon GuardDuty with EKS Runtime Monitoring enabled

Click to reveal Answer & Explanation

Correct Answer: B

Correct Options Analysis

B is Correct: Amazon Inspector provides container image scanning for ECR. It scans the image layers, including base OS and third-party packages, against CVE databases. It supports automated scans triggered on image push, continuous scanning, and integration with Security Hub and EventBridge to create CI/CD gates. This is the correct service for vulnerability scanning of container images.

Distractor Analysis

A is Incorrect: CodeGuru Profiler is a performance profiling tool that identifies CPU/memory hotspots and thread safety issues in running applications. It does not scan container images for known package vulnerabilities (CVEs)—that is a fundamentally different capability.
C is Incorrect: AWS Config evaluates resource configuration compliance against rules (e.g., "is this ECR repository using KMS encryption?"). It does not have the ability to inspect container image layers or query CVE databases.
D is Incorrect: GuardDuty is a threat detection service for security monitoring (e.g., identifying malicious IPs, unusual API calls). EKS Runtime Monitoring monitors Kubernetes clusters for runtime threats, not container image vulnerability scanning.

Key Takeaway: Amazon Inspector is the AWS-native service for container image vulnerability scanning in CI/CD pipelines—use it to gate deployments on CVE findings.

Question 8 - VPC Isolation for SageMaker Notebook vs Training

A manufacturing company is building a predictive maintenance ML model using SageMaker Notebook Instances for interactive exploration and SageMaker Training Jobs for distributed training. The data science environment currently runs in a public subnet with internet access, which violates a new security policy.

The new policy requires that:

SageMaker Notebooks must be inaccessible from the public internet.
Training jobs must run in a private network with no direct internet access.
Both must be able to access sensitive data in Amazon S3 and call Amazon Bedrock for synthetic data generation.

Which configuration meets all these requirements? (Select TWO)

A) Move the Notebook Instance to a private subnet with no public IP, and connect to it using a VPC interface endpoint for sagemaker.api
B) Configure a VPC Gateway endpoint for S3 and an interface endpoint for bedrock in each private subnet so resources can reach these services without traversing the internet
C) Add a NAT Gateway to the private subnet and route all traffic through it—this provides the private connectivity needed for S3 and Bedrock
D) Attach an Auto Scaling group to the training jobs to automatically shift traffic to a public subnet when private connectivity fails
E) Create a single security group for both notebooks and training jobs that allows inbound traffic on ports 22 (SSH) and 8888 (Jupyter) from 0.0.0.0/0

Click to reveal Answer & Explanation

Correct Answers: A and B

Correct Options Analysis

A is Correct: Placing Notebook Instances in a private subnet with no public IP makes them inaccessible externally. VPC PrivateLink endpoints for sagemaker.api (control-plane) and sagemaker.runtime (if used for real-time prediction) allow the notebook to interact with SageMaker APIs over the private network.
B is Correct: A VPC Gateway endpoint for S3 allows private network access to data storage, and an interface endpoint for Bedrock (com.amazonaws.region.bedrock) allows private invocation of foundation models. Both are required for the specified workloads without internet access.

Distractor Analysis

C is Incorrect: A NAT Gateway provides outbound internet access, but the goal is to eliminate internet access altogether. For S3 and Bedrock, VPC endpoints provide private connectivity without a NAT. The scenario explicitly says "no direct internet access."
D is Incorrect: There is no Auto Scaling group mechanism for SageMaker training jobs. This is a fabricated feature. Even if such a feature existed, routing to a public subnet would violate the security policy.
E is Incorrect: Allowing inbound traffic from 0.0.0.0/0 on SSH (port 22) and Jupyter (port 8888) exposes the notebook and training environment to the entire internet. This is precisely what the new security policy prohibits.

Key Takeaway: For network isolation, use VPC Gateway endpoints for S3 and interface endpoints for Bedrock/SageMaker APIs, and place notebooks in private subnets—never create permissive 0.0.0.0/0 security groups.

Question 9 - Distinguishing CloudTrail vs Config vs Inspector vs GuardDuty

A cloud security team at an enterprise is building a comprehensive monitoring framework for their SageMaker ML platform. They have three distinct requirements:

Requirement A: Detect when someone deletes a SageMaker endpoint or modifies a model's IAM permissions.
Requirement B: Track changes to SageMaker endpoint configurations over time and flag if any endpoint is marked "publicly accessible."
Requirement C: Detect if an external IP is making unusual API calls to the SageMaker service (e.g., high-volume model invocation from a foreign IP).

Which service should be used for Requirement C specifically?

A) AWS CloudTrail with data events enabled
B) AWS Config with a custom rule for endpoint configuration drift
C) Amazon GuardDuty with S3 protection and EKS runtime monitoring
D) Amazon Inspector with continuous network reachability scanning

Click to reveal Answer & Explanation

Correct Answer: C

Correct Options Analysis

C is Correct: Amazon GuardDuty is a threat detection service that continuously monitors for malicious or unauthorized activity across AWS accounts. It can detect unusual API call patterns, anomalous invocation behavior, and potentially compromised credentials by analyzing VPC Flow Logs, DNS logs, CloudTrail events, and other telemetry. Detecting high-volume model invocations from foreign IPs is a classic GuardDuty threat detection scenario.

Distractor Analysis

A is Incorrect: CloudTrail records API activity (who called what, when, from where) for auditability. It does not analyze traffic patterns or detect anomalies—it simply logs events. Detecting "unusual" API calls requires active anomaly detection, which is GuardDuty's job, not CloudTrail's.
B is Incorrect: AWS Config tracks configuration state over time and evaluates compliance rules (e.g., "is this endpoint publicly accessible?"). It does not analyze network traffic or detect unusual API call patterns from external IPs.
D is Incorrect: Amazon Inspector scans container images and EC2 instances for software vulnerabilities and network exposure risk. It does not provide threat detection for unusual API call patterns.

Key Takeaway: GuardDuty analyzes telemetry for anomalies and threat patterns, CloudTrail logs API activity for audit, Config tracks configuration drift, and Inspector scans for software vulnerabilities—each serves a distinct security purpose.

Question 10 - Bedrock Guardrails Contextual Grounding for RAG Hallucination Prevention

A legal research firm has built a Retrieval-Augmented Generation (RAG) application using Amazon Bedrock Knowledge Bases to answer questions about case law. During evaluation, the model sometimes generates answers that cite legal precedents not present in the retrieved passages—essentially fabricating supporting evidence.

The firm requires that the model never return answers unsupported by the retrieved legal documents. The solution must be implemented using Bedrock Guardrails with minimal custom code.

Which Guardrails capability should the ML engineer configure?

A) A denied topic policy that blocks all responses in the "legal" category
B) A sensitive information filter that masks case numbers and court names
C) A contextual grounding check that evaluates whether the generated response is factually supported by the retrieved source passages
D) An Automated Reasoning check that debugs the RAG retrieval logic to ensure vectors are correctly indexed

Click to reveal Answer & Explanation

Correct Answer: C

Correct Options Analysis

C is Correct: Contextual Grounding checks in Bedrock Guardrails are specifically designed for RAG applications. They detect hallucinated or fabricated content by checking whether model responses are factually grounded in the reference passages (the retrieved context). If the model generates claims not supported by the source material, the filter flags or blocks the response. This directly addresses the legal firm's requirement to prevent fabricated legal citations.

Distractor Analysis

A is Incorrect: Denied topic policies block conversations about specific subject areas entirely. Blocking the "legal" category would prevent all legal Q&A—defeating the purpose of the application. The firm wants answers about case law, but only answers grounded in retrieved documents, not a complete refusal.
B is Incorrect: Sensitive information filters detect and mask PII like credit card numbers, SSNs, or custom patterns. While case numbers and court names potentially fall under this category, masking them does not prevent the model from fabricating legal precedents or hallucinating unsupported claims.
D is Incorrect: Automated Reasoning checks validate whether a response is consistent with formally expressed rules (mathematical or logical rules), not whether it matches retrieved source material. Additionally, "debugging RAG retrieval logic" is not a Bedrock Guardrails feature—this option conflates two unrelated concepts.

Key Takeaway: For RAG applications, use contextual grounding checks in Bedrock Guardrails to detect and block hallucinated or unsupported responses; denied topic filters block entire subject areas, not factual errors.

Question 11 - Secrets Management and IAM Roles for Bedrock Production Access

A production application on AWS Fargate calls Amazon Bedrock to power a real-time recommendation engine. The application is deployed via CI/CD and uses the AWS SDK.

The security audit found that the application currently stores a long-term Bedrock API key in an environment variable. The auditor requires that temporary credentials be used for production access to Bedrock.

Which change should the ML engineer implement?

A) Replace the long-term key with an IAM role assigned to the Fargate task (taskRoleArn), and grant the role bedrock:InvokeModel on the specific foundation model ARN—the SDK will automatically retrieve temporary credentials from the task metadata endpoint
B) Create a short-term API key using bedrock:GenerateApiKey and update the environment variable before each deployment
C) Store the long-term key in AWS Systems Manager Parameter Store and have the application retrieve it at runtime
D) Use AWS Single Sign-On to federate access and generate a temporary token for each user calling the application

Click to reveal Answer & Explanation

Correct Answer: A

Correct Options Analysis

A is Correct: Assigning an IAM role to the Fargate task (taskRoleArn) and allowing bedrock:InvokeModel on the specific model ARN provides automatic temporary credentials that rotate without manual intervention. The AWS SDK running in the task automatically retrieves credentials from the task metadata endpoint (169.254.170.2). No static keys are stored anywhere. This is the production best practice for AWS-native services.

Distractor Analysis

B is Incorrect: There is no bedrock:GenerateApiKey API. While Amazon Bedrock does support API keys via the console for exploration/development, generating short-term keys for production use still leaves static credentials that must be manually rotated—defeating the purpose of the audit remediation.
C is Incorrect: Parameter Store (even with SecureString) merely relocates the static key elsewhere. It does not provide temporary credentials or automatic rotation. The underlying credential remains a long-term static secret.
D is Incorrect: AWS SSO federates user access, not application access. The scenario is about a production application (machine-to-machine), not a human user authenticating to a web app. The correct solution for application-level access is an IAM role, not SSO federation.

Key Takeaway: For production Bedrock access, always use IAM roles with temporary credentials—never store API keys in environment variables, Parameter Store, or Images, regardless of how they are encrypted.

Question 12 - Multi-Layer Security Strategy Combining Guardrails and VPC

A fintech startup is deploying an Amazon Bedrock-based financial advice assistant. The application must:

Network isolation: The Bedrock API must be called over private network without internet traversal.
Content filtering: The model must not provide investment recommendations involving cryptocurrencies.
Data protection: Users' bank account numbers must be masked in model responses.
Auditability: All model invocations must be logged for regulatory compliance.

Which combinations of services satisfy requirements 1 and 2? (Select TWO)

A) Create a VPC interface endpoint for bedrock and configure the application to use this endpoint for all InvokeModel calls
B) Configure a Guardrail with a denied topic for "cryptocurrency investment" and apply it to the model invocation
C) Enable CloudTrail data events on the existing trail—this captures model invocation details including the content of prompts and responses
D) Use Amazon Inspector to scan the application container image before each deployment
E) Store user bank account data in DynamoDB with AES-256 client-side encryption using the AWS Encryption SDK

Click to reveal Answer & Explanation

Correct Answers: A and B

Correct Options Analysis

A is Correct: A VPC interface endpoint for Bedrock (com.amazonaws.region.bedrock) allows InvokeModel calls to travel entirely over AWS PrivateLink without traversing the public internet. This satisfies Requirement 1 (network isolation).
B is Correct: A Bedrock Guardrail with a denied topic for "cryptocurrency investment" blocks the model from generating responses related to cryptocurrency investments. Denied topics can be custom-defined to include organizational restrictions. This satisfies Requirement 2 (content filtering).

Distractor Analysis

C is Incorrect: CloudTrail data events satisfy Requirement 4 (auditability), which is not part of the question. This option addresses logging and auditing, not network isolation or content filtering.
D is Incorrect: Amazon Inspector scans containers for software vulnerabilities (CVEs). It has nothing to do with network isolation or content filtering of model responses.
E is Incorrect: Encryption protects sensitive data at the storage layer, but it does not mask bank account numbers in model responses (Requirement 3). What is needed is a sensitive information filter in Bedrock Guardrails, not just storage encryption.

Key Takeaway: Security requirements map to distinct AWS controls: VPC endpoints for network isolation, Guardrails denied topics for content filtering, Guardrails sensitive filters for PII masking, and CloudTrail data events for audit logging.