Skill 3.3.7: Manage prompts (for example, Amazon Bedrock Prompt Management)
| Question | Answer & Explanation |
|---|---|
| ### Question 1 - Decoupling Prompts from Application Code An AI engineering team has deployed a generative AI application that currently hardcodes system prompts and user prompts directly within the Lambda function code. Every time the prompt engineering team refines the prompt text, a full software development lifecycle (SDLC) release is required to update the production application. The team needs to decouple prompt updates from application code deployments with the least operational overhead while maintaining version control and auditability for prompt changes. Which solution meets these requirements? - A) Store the prompt text as environment variables in AWS Lambda and use AWS CodeDeploy to push new environment configurations. - B) Create an Amazon DynamoDB table to store prompt templates and query it at runtime using the Lambda function. - C) Use Amazon Bedrock Prompt Management to define, version, and store prompts as distinct resources, updating the application to invoke a specific prompt version or alias. - D) Store the prompt text as objects in Amazon S3 and have the Lambda function read the S3 object on every invocation. Select ONE that applies. |
Correct Answer: C Correct Answer Analysis: - C is Correct: Amazon Bedrock Prompt Management is explicitly designed to decouple prompts from application code. It allows teams to store prompts as standalone, versioned resources with variables. The application simply invokes the prompt by its ID and version/alias. This removes the need for application redeployments when a prompt changes, fulfilling the least operational overhead and auditability requirements. Distractor Analysis: - A is Incorrect: Using Lambda environment variables still requires a Lambda function update/deployment to change the prompt, which fails to decouple the prompt from the application SDLC. - B is Incorrect: Storing prompts in DynamoDB is a custom solution that requires the team to build their own versioning, auditability, and variant-comparison mechanisms, introducing unnecessary operational overhead. - D is Incorrect: Reading an S3 object on every invocation introduces latency and does not natively provide version comparison, variant testing, or the native integration that Bedrock Prompt Management offers. > Key Takeaway: Amazon Bedrock Prompt Management enables decoupling prompt engineering from application development by versioning prompts as independent resources invoked via API. |
| ### Question 2 - Automated Prompt Evaluation in CI/CD A machine learning team is building a CI/CD pipeline using AWS CodePipeline to manage updates to their generative AI application. When a new prompt version is created in Amazon Bedrock Prompt Management, the pipeline must automatically test it before routing any production traffic to the new version. The responses are non-deterministic, and the team must ensure the new prompt does not degrade response quality or increase toxicity compared to the current prompt. Which testing strategy should the team implement in the CodeBuild phase of the pipeline? - A) Execute a fixed golden dataset of prompts against both the current and new prompt versions, use an LLM-as-a-judge or evaluation metrics to score the responses, and block deployment if the new version scores lower than the threshold. - B) Assert that the exact string output of the new prompt version matches the exact string output of the current prompt version for a set of test queries. - C) Deploy the new prompt version to a small percentage of users (canary release) and monitor the application's API latency and 5XX error rates in Amazon CloudWatch. - D) Run unit tests on the Lambda function code that invokes the prompt to ensure the AWS SDK API calls are formatted correctly. Select ONE that applies. |
Correct Answer: A Correct Answer Analysis: - A is Correct: Because generative AI responses are non-deterministic, exact string matching is impossible. The correct approach is to use an automated evaluation framework (like Amazon Bedrock Model Evaluation or a custom LLM-as-a-judge script in CodeBuild) that compares semantic quality, toxicity, or accuracy against a baseline prompt version, blocking the pipeline if quality degrades. Distractor Analysis: - B is Incorrect: Generative models produce varying responses between runs; asserting exact string matches will cause false negatives and flaky pipelines. - C is Incorrect: Monitoring API latency and 5XX errors checks infrastructure health, not the semantic quality, hallucination rate, or toxicity of the generated text. - D is Incorrect: Unit testing the application code ensures the SDK is called correctly but provides zero insight into the behavior or quality of the prompt itself. > Key Takeaway: Non-deterministic generative AI responses must be evaluated in CI/CD using semantic scoring (e.g., LLM-as-a-judge) against a golden dataset, rather than exact string assertions. |
| ### Question 3 - Managing Prompt Variants for A/B Testing A marketing technology team is using Amazon Bedrock to generate ad copy. The prompt engineering team has drafted two different system instructions to see which one produces more persuasive copy. The team needs to test both sets of instructions simultaneously against the same underlying foundation model without creating separate application deployments or managing separate prompt files in their codebase. Which feature of Amazon Bedrock Prompt Management facilitates this requirement with the least operational overhead? - A) Create multiple Prompt resources in Bedrock, each containing one set of instructions, and hardcode both Prompt IDs in the application logic. - B) Use the Prompt Variants feature within a single Bedrock Prompt resource to define multiple configurations, and test them by invoking the specific variant. - C) Deploy two separate Amazon Bedrock Agents, each configured with a different system prompt, and use a Route 53 weighted routing policy to distribute traffic. - D) Store both instructions in an Amazon S3 bucket as JSON files and dynamically load them into the Lambda function environment before calling the Bedrock InvokeModel API.Select ONE that applies. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Bedrock Prompt Management allows teams to create multiple "variants" within a single prompt resource. This enables A/B testing of different prompts, model configurations, or parameters side-by-side without duplicating infrastructure or decoupling the prompt ID in the application code. Distractor Analysis: - A is Incorrect: While technically possible, creating multiple separate Prompt resources increases management overhead and requires hardcoding multiple IDs into the application, which violates the least operational overhead constraint. - C is Incorrect: Deploying separate Bedrock Agents or endpoints for simple prompt A/B testing introduces massive, unnecessary infrastructure overhead and complexity. - D is Incorrect: Storing instructions as JSON files in S3 and manually loading them bypasses the native versioning, variant testing, and evaluation features of Bedrock Prompt Management, leading to higher operational overhead. > Key Takeaway: Bedrock Prompt Management supports creating comparable variants within a single prompt resource, enabling efficient A/B testing of different instructions or models. |
| ### Question 4 - Event-Driven Prompt Updates from External Repositories An enterprise AI team maintains their prompt definitions as code in a GitHub repository hosted outside of AWS. When a prompt engineer pushes an update to the prompt template, the team wants an AWS CodePipeline to automatically trigger, retrieve the latest prompt text, and use the AWS CLI to create a new prompt version in Amazon Bedrock Prompt Management. The solution must strictly adhere to security policies that prohibit embedding long-lived credentials (like Personal Access Tokens) inside the pipeline definition or AWS CodeBuild environment variables. Which AWS service should be used to securely connect the pipeline to the external GitHub repository without storing static credentials? - A) AWS CodeCommit - B) AWS CodeConnections - C) AWS Systems Manager Parameter Store - D) AWS Secrets Manager Select ONE that applies. |
Correct Answer: B Correct Answer Analysis: - B is Correct: AWS CodeConnections (formerly AWS CodeStar Connections) creates a managed, secure connection between AWS CodePipeline and third-party Git repositories (like GitHub, GitLab, Bitbucket) using OAuth or GitHub App handshakes. This allows the pipeline to detect commits and fetch source code without embedding long-lived Personal Access Tokens in the pipeline definition. Distractor Analysis: - A is Incorrect: AWS CodeCommit is an AWS-native Git repository service; it is not used to connect to external repositories like GitHub. - C is Incorrect: While Parameter Store can store secrets, using it to pass a GitHub PAT to CodeBuild would still involve handling static credentials, which violates the security constraint. CodeConnections abstracts the credentials entirely. - D is Incorrect: Similar to Parameter Store, AWS Secrets Manager stores static credentials. The constraint requires avoiding embedded static credentials, which CodeConnections solves natively via OAuth. > Key Takeaway: Use AWS CodeConnections to securely integrate AWS CodePipeline with external Git repositories (e.g., GitHub) without embedding static Personal Access Tokens in pipeline definitions. |
| ### Question 5 - Cross-Account Prompt CI/CD Deployment A financial services company manages its AI workloads across three AWS accounts: Development, Staging, and Production. The team uses AWS CodePipeline in the Development account to orchestrate prompt updates. When a new prompt version passes evaluation in Staging, the pipeline must programmatically promote that exact prompt version to the Production account's Amazon Bedrock Prompt Management service. The solution must ensure secure cross-account access without storing static AWS access keys. Which combination of steps will fulfill these requirements? (Select TWO) - A) Create an IAM role in the Production account with permissions to manage Bedrock Prompts, and establish a trust relationship allowing the Staging account's CodePipeline service role to assume it. - B) Configure the Production Bedrock service to publicly expose its API endpoints over the internet so the Staging CodePipeline can access them without authentication. - C) In the Staging CodePipeline's Deploy stage, use an AWS CodeBuild action that uses aws sts assume-role to assume the Production account's IAM role, and then runs the aws bedrock create-prompt-version command.- D) Manually copy the prompt text from the Staging AWS Management Console and paste it into the Production AWS Management Console upon a successful pipeline run. - E) Use AWS IAM Identity Center to assign a developer SSO user, and manually execute the AWS CLI commands against the Production account from a local terminal. Select TWO that apply. |
Correct Answer: A and C Correct Answer Analysis: - A is Correct: Cross-account CI/CD requires establishing a trust relationship between the accounts. An IAM role in the Production account must grant the sts:AssumeRole permission to the Staging account's CI/CD execution role.- C is Correct: AWS CodeBuild can use the AWS STS AssumeRole API to programmatically obtain temporary credentials for the Production account and execute the AWS CLI command to create the new prompt version in Bedrock, automating the deployment securely without static keys.Distractor Analysis: - B is Incorrect: Exposing Bedrock API endpoints publicly without authentication is a severe security violation and is not technically feasible or supported for Bedrock Prompt Management APIs. - D is Incorrect: Manual copy-pasting introduces human error, operational overhead, and completely breaks the automated CI/CD pipeline principles. - E is Incorrect: Manual execution from a local terminal defeats the purpose of an automated CI/CD pipeline and does not provide an auditable, automated deployment mechanism. > Key Takeaway: Cross-account CI/CD for AWS resources like Bedrock Prompts is achieved securely using IAM cross-account trust policies and AWS STS AssumeRole within AWS CodeBuild. |
| ### Question 6 - Orchestrating Agent and Prompt Version Updates An AI team is using an Amazon Bedrock Agent to handle customer support queries. The agent's orchestration behavior is heavily influenced by its underlying orchestration prompt. The prompt engineering team has updated the system instructions in the Bedrock Prompt Management console to make the agent more concise. The team needs to deploy this updated prompt to the production agent with the ability to automatically roll back if the agent's behavior degrades, ensuring they can trace exactly which prompt version the agent is using. What is the most operationally efficient way to manage this update? - A) Edit the prompt text directly inside the existing Bedrock Agent configuration in the production environment and save the changes. - B) Create a new version of the prompt in Bedrock Prompt Management, update the Bedrock Agent to point to the new prompt version, create a new Agent version, and update the Agent alias to route traffic to the new version. - C) Store the new prompt text in an Amazon S3 bucket and update the Lambda function orchestrating the agent to fetch the text at runtime. - D) Delete the old prompt in Bedrock Prompt Management and create a new one with the same name, then manually update the agent. Select ONE that applies. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Versioning both the prompt and the agent ensures full traceability and auditability. By creating a new prompt version, pointing the agent to it, and creating a new Agent version and alias update, the team maintains an immutable record of what served traffic. If the behavior degrades, they can simply re-point the alias to the previous Agent/Prompt version for an instant rollback. Distractor Analysis: - A is Incorrect: Editing the prompt in place overwrites the previous configuration, destroying the ability to audit what was serving traffic previously and preventing an automated rollback to the previous prompt. - C is Incorrect: Bedrock Agents natively integrate with Bedrock Prompt Management. Storing the prompt in S3 and fetching it via Lambda bypasses the native agent orchestration capabilities and is highly inefficient. - D is Incorrect: Deleting the old prompt breaks lineage and auditability. It also breaks any application referring to the old prompt's ID or version. > Key Takeaway: When updating agent behavior via prompts, create new versions of the prompt and the agent, and manage traffic routing via aliases to preserve rollback capabilities and auditability. |
| ### Question 7 - Prompt Updates vs. Knowledge Base Re-indexing An enterprise RAG application uses Amazon Bedrock Knowledge Bases and Amazon Bedrock Prompt Management. The prompt engineering team has refined the system prompt to better instruct the foundation model on how to synthesize the retrieved context into an answer. The team needs to deploy this prompt update to production. They are concerned about cost and want to ensure this change does not trigger an expensive re-indexing of their massive document corpus stored in Amazon S3. Which statement correctly describes the operational impact of updating the prompt in this scenario? - A) Updating the prompt in Bedrock Prompt Management automatically triggers an incremental sync of the Bedrock Knowledge Base to ensure vectors match the new prompt. - B) Updating the prompt in Bedrock Prompt Management and routing the application to the new prompt version has no impact on the Bedrock Knowledge Base index, as vectors are generated from the source documents, not the prompt. - C) The team must trigger a full ingestion job in Bedrock Knowledge Bases to regenerate all vectors because the embedding model's context window has changed due to the new prompt. - D) The team must manually delete and recreate the OpenSearch Serverless collection to apply the new prompt instructions to the retrieved vectors. Select ONE that applies. |
Correct Answer: B Correct Answer Analysis: - B is Correct: In a RAG architecture, the vector index is generated by parsing and chunking the source documents, then passing those chunks through an embedding model. The system prompt is applied at generation time (inference) to instruct the LLM on how to use the retrieved context. Changing the prompt does not change the source documents or the vectors, so no re-indexing is required. Distractor Analysis: - A is Incorrect: Knowledge Base ingestion jobs are entirely independent of prompt updates. Changing a prompt does not trigger an S3 sync or vector regeneration. - C is Incorrect: The embedding model's context window is a property of the embedding model itself, not the text prompt used for generation. Re-indexing is only required if the chunking strategy, embedding model, or source documents change. - D is Incorrect: Deleting the OpenSearch collection would destroy the entire index, requiring a full and highly expensive re-ingestion job, which is completely unnecessary for a prompt change. > Key Takeaway: In RAG systems, prompt updates (generation logic) are decoupled from the vector index (retrieval logic); updating a prompt does not require re-indexing the knowledge base. |
| ### Question 8 - Dynamic Variables in Prompt Management CI/CD A software team is migrating a generative AI application to Amazon Bedrock Prompt Management. Currently, the application concatenates strings to build a prompt, injecting a user's profile data and recent purchase history dynamically at runtime. The team wants to define this prompt template in Bedrock Prompt Management and automate its deployment via AWS CodePipeline, ensuring the application can securely pass the dynamic user data during inference. How should the team configure the prompt in Bedrock Prompt Management to support dynamic runtime injection while allowing the template itself to be version-controlled in CI/CD? - A) Store the prompt template with hardcoded user data placeholders like "User: John Doe", and use a CodeBuild script to find-and-replace the text before invoking the model. - B) Define the prompt template using Bedrock Prompt Management variables (e.g., {{user_profile}} and {{purchase_history}}), and have the application pass these variables at runtime via the InvokeModel or Bedrock API parameters.- C) Create a separate prompt version for every unique user in the database and update the CI/CD pipeline to deploy all versions simultaneously. - D) Store the dynamic user data in AWS Secrets Manager and instruct Bedrock Prompt Management to automatically fetch the secrets during inference. Select ONE that applies. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Bedrock Prompt Management supports the use of variables (often denoted with double curly braces). This allows the prompt template to be versioned and stored statically in Bedrock, while the application injects the dynamic content (like user profiles) at runtime as API parameters. Distractor Analysis: - A is Incorrect: Hardcoding placeholders and performing find-and-replace in CodeBuild is a hacky, non-scalable approach that defeats the purpose of decoupling the prompt from the application. CodeBuild is for build-time execution, not runtime inference. - C is Incorrect: Creating a separate prompt version for every user is impossible to scale, violates the principle of template reusability, and would create millions of unusable versions. - D is Incorrect: AWS Secrets Manager is for storing static secrets, not dynamic, per-request user data. Bedrock Prompt Management does not natively integrate with Secrets Manager for runtime variable injection. > Key Takeaway: Use variables in Amazon Bedrock Prompt Management templates to decouple static prompt logic (versioned in CI/CD) from dynamic runtime context (injected at inference time). |
| ### Question 9 - Automating Prompt Release via EventBridge An AI operations team wants to strictly control when new prompt versions become active in production. They use Amazon Bedrock Prompt Management and require that newly created prompt versions remain in a "Draft" state until an automated AWS CodePipeline evaluation completes successfully. Once the pipeline verifies the prompt's quality, an event should trigger the promotion of the prompt to a production alias without manual intervention. Which AWS service can be used to automate the promotion step (updating the alias to point to the new version) upon successful completion of the CodePipeline evaluation? - A) AWS Lambda function invoked by an Amazon EventBridge rule that listens for CodePipeline execution state changes. - B) Amazon EC2 Auto Scaling group configured to run AWS CLI commands when the pipeline completes. - C) Amazon S3 Event Notifications configured to trigger an AWS Glue crawler. - D) AWS CloudTrail logs analyzed by Amazon Macie to detect pipeline completion. Select ONE that applies. |
Correct Answer: A Correct Answer Analysis: - A is Correct: Amazon EventBridge can listen for state changes in AWS CodePipeline (e.g., a stage succeeding). An EventBridge rule can be configured to trigger an AWS Lambda function that executes the UpdatePromptAlias (or equivalent API call) to route production traffic to the newly validated prompt version.Distractor Analysis: - B is Incorrect: Using EC2 Auto Scaling groups to run CLI commands for pipeline orchestration is an anti-pattern, introduces high operational overhead, and is not event-driven. - C is Incorrect: S3 Event Notifications are triggered by object-level operations in S3, not by CodePipeline state changes. Glue crawlers are for data cataloging, not prompt alias management. - D is Incorrect: Amazon Macie is a data security service for discovering sensitive data; it has no capability to orchestrate CodePipeline completions or Bedrock API actions. > Key Takeaway: Amazon EventBridge and AWS Lambda can be used to create event-driven automation for promoting Bedrock Prompt versions upon successful CI/CD pipeline execution. |
| ### Question 10 - Multi-Region Prompt Replication for DR A global financial institution operates a generative AI application across two AWS regions (us-east-1 and eu-west-1) for high availability and data residency compliance. The prompt engineering team updates prompts in us-east-1 and uses AWS CodePipeline to test and deploy them. To ensure both regions serve identical prompts during a disaster recovery (DR) failover, the team needs an automated mechanism to replicate approved Bedrock Prompt versions to the secondary region (eu-west-1) immediately after they are approved in the primary region. Which architectural approach provides the most automated and least operationally overhead solution for replicating the approved prompts? - A) Manually copy the prompt text from the us-east-1 console and paste it into the eu-west-1 console every Friday afternoon. - B) Use an Amazon EventBridge rule in us-east-1 to capture the prompt approval event, and trigger an AWS Step Function that invokes the Bedrock API in eu-west-1 (using cross-account/cross-region IAM roles) to create the identical prompt version. - C) Store the prompt definitions in an Amazon DynamoDB global table, and have a Lambda function in eu-west-1 poll the table for changes and manually call the Bedrock API. - D) Use AWS Database Migration Service (DMS) to replicate the prompt configurations from us-east-1 to eu-west-1. Select ONE that applies. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Using Amazon EventBridge to capture the approval event in the primary region and triggering an AWS Step Function provides a serverless, automated, and event-driven mechanism to replicate the prompt to the secondary region via cross-region API calls. This minimizes operational overhead and ensures exact replication upon approval. Distractor Analysis: - A is Incorrect: Manual copy-pasting is prone to human error, violates automation principles, and does not provide immediate replication upon approval. - C is Incorrect: Using DynamoDB as an intermediary requires building custom polling logic, increasing operational overhead. Bedrock Prompt Management does not natively integrate with DynamoDB for configuration replication. - D is Incorrect: AWS DMS is designed for migrating relational and NoSQL databases, not for replicating AWS service configurations like Bedrock Prompts. > Key Takeaway: Cross-region replication of AWS service configurations like Bedrock Prompts is best achieved using event-driven architectures (EventBridge and Step Functions) that execute API calls in the target region. |