Amazon Web Services AIP-C01 - AWS Certified Generative AI Developer - Professional

Option A provides the most complete, AWS-native defense-in-depth solution for protecting against prompt injection attacks while meeting audit and resiliency requirements. Amazon Bedrock guardrails are designed specifically to enforce safety policies on both user inputs and model outputs, including protections against prompt injection and jailbreak attempts.

Setting content filters to high increases sensitivity to malicious or manipulative inputs. Guardrail profiles allow the same guardrail configuration to be applied consistently across multiple Regions, enabling cross-Region inference and failover without configuration drift. This directly satisfies the requirement for regional resilience.

Amazon CloudWatch Logs captures detailed guardrail intervention events, including when content is blocked, modified, or flagged. Custom metrics derived from these logs enable fine-grained auditing, alerting, and reporting on safety enforcement actions. This provides a more detailed audit trail of safety interventions than API-level logs alone.

Option B adds WAF protection but lacks detailed guardrail intervention logging. Option C introduces additional services and custom logic that increase complexity and may miss model-specific injection patterns. Option D references replication concepts that are not aligned with Bedrock guardrail operational models and relies on word filters, which are insufficient against sophisticated prompt injection techniques.

Therefore, Option A best meets the requirements for layered protection, auditability, and cross-Region resilience using managed Amazon Bedrock safety controls.

Option B is the best fit because hierarchical chunking is designed to preserve local detail while keeping broader document context available during retrieval, which directly addresses the problem of questions spanning methodology, results, and discussion. In large scientific papers, a single answer often depends on linked paragraphs across adjacent sections. If the knowledge base retrieves only small, isolated chunks, the RAG system can cite text that is semantically close to a query term but not contextually correct, producing inconsistent answers and irrelevant citations.

With hierarchical chunking, the knowledge base creates child chunks that are small enough for high-precision vector similarity matching, such as 200 tokens, which improves the likelihood that the retrieved text is tightly related to the user’s query. At the same time, each child chunk is associated with a larger parent chunk, such as 1,000 tokens, which retains the surrounding narrative and section-level context. This structure helps the retrieval pipeline return passages that include the relevant subsection plus the explanatory framing that prevents misinterpretation, which is especially important in scientific writing where methods, results, and discussion are interdependent.

The configured overlap further reduces boundary effects where key statements split across chunks. This improves continuity for paragraphs that bridge sections, such as a results paragraph that references the methodological setup or a discussion paragraph interpreting a specific metric.

Option A can improve consistency slightly, but fixed-size chunking still risks separating related paragraphs and does not provide a built-in mechanism to retrieve broader context linked to precise matches. Option C can create more meaningful boundaries, but it does not guarantee the parent-level context that hierarchical chunking provides at retrieval time. Option D increases operational burden and is not practical at the scale of 25 million

Option C directly addresses both retrieval relevance and performance scalability. Fixed token chunking breaks semantic continuity in legal texts, causing incomplete context retrieval and degraded response quality. By switching to semantic chunking—based on legal arguments, clauses, or sections—the application preserves contextual integrity, improving retrieval accuracy and reducing hallucinations.

Regenerating embeddings aligned with the new chunk structure also improves vector search efficiency, reducing unnecessary comparisons and helping control latency as the dataset scales.

Option A increases cost and latency without fixing the core issue. Option B removes dynamic reasoning, which defeats the purpose of a legal RAG system. Option D discards vector semantics entirely and is unsuitable for nuanced legal research. Therefore, Option C is the correct and scalable solution.

Option A best meets the combined requirements of low latency, stability, and validated safety controls by using purpose-built Amazon Bedrock features designed for production GenAI operations. The company’s latency target of under 1 second and its observation of degradation during spikes strongly indicate capacity and throughput variability. Provisioned throughput for Amazon Bedrock is intended to deliver more predictable performance by reserving inference capacity for a chosen model, reducing throttling risk and stabilizing response times under load. This directly improves operational consistency across Regions where on-demand capacity can vary.

The requirement to “block unsafe or hallucinated recommendations” is most directly addressed by Amazon Bedrock Guardrails. Guardrails provide managed safety enforcement, including sensitive information controls and configurable content policies. Using semantic denial rules enables the application to prevent unsafe guidance such as dangerous brewing temperatures or other harmful procedural instructions, enforcing safety at the model boundary rather than relying on downstream filtering.

The remaining requirement is “99.5% output consistency for identical inputs.” While generative models can be probabilistic, production systems achieve practical consistency by controlling prompt versions, inputs, and policy behavior. Amazon Bedrock Prompt Management supports controlled prompt lifecycle practices, including versioning and approval workflows, which reduce unintended drift across deployments and Regions. By ensuring the same approved prompt templates and parameters are used consistently, the company can materially improve repeatability for the same structured inputs and retrieval context, which is essential in multi-stage prompt chains.

The other options are incomplete. B improves experimentation and observability but does not enforce safety controls or stabilize latency. C can improve performance, but it does not provide validated safety enforcement at inference time. D can help retrieval relevance, but it does not address unsafe outputs or inference stability. Therefore, A is the only option that simultaneously targets predictable latency, governance of prompt behavior, and strong safety controls within Amazon Bedrock.

Option D is the correct solution because it directly addresses all three requirements: high retrieval accuracy, hallucination detection, and reduced human review costs. AWS recommends a layered evaluation strategy for high-stakes domains such as healthcare, where generative outputs must be both accurate and safe.

Using an automated LLM-as-a-judge evaluation enables scalable, consistent assessment of generated responses for factual grounding, relevance, and hallucination risk. This automated screening significantly reduces the number of responses that require manual inspection. Only responses that fall below defined quality thresholds or exhibit ambiguous behavior are escalated to targeted human reviews, which optimizes review effort and cost.

The use of Amazon Bedrock built-in evaluations provides standardized metrics specifically designed for RAG systems, including retrieval precision, faithfulness to source documents, and hallucination rates. These evaluations integrate directly with Amazon Bedrock knowledge bases and models, eliminating the need to build and maintain custom evaluation pipelines.

Option A focuses on entity extraction confidence, which does not reliably detect hallucinations in generative text. Option B requires maintaining and scaling a separate fine-tuned evaluation model, increasing complexity and cost. Option C is useful for regression testing but cannot detect hallucinations in real-world, open-ended clinical queries.

Therefore, Option D provides the most effective and operationally efficient approach to maintaining clinical-grade accuracy while minimizing human review effort.

Option B is the correct solution because Amazon Bedrock Knowledge Bases with the RetrieveAndGenerate API provide a fully managed Retrieval Augmented Generation (RAG) capability that directly addresses grounding, citation, and hallucination prevention with the least operational overhead.

Amazon Bedrock Knowledge Bases automatically manage document ingestion, chunking, embedding, retrieval, and ranking from approved data sources. When used with the RetrieveAndGenerate API, the model is constrained to generate responses only from retrieved, approved clinical documentation, significantly reducing the risk of hallucinations or unsupported claims. The API also returns explicit source citations, which satisfies regulatory and clinical transparency requirements without requiring custom comparison or validation logic.

This approach aligns with AWS best practices for healthcare GenAI workloads, where correctness and traceability are critical. Because retrieval and generation are tightly integrated, the system avoids multi-step orchestration, custom verification pipelines, or additional compute layers that would increase latency and maintenance burden.

Option A introduces Amazon Kendra and custom post-processing logic, increasing operational complexity. Option C focuses on entity extraction rather than controlled knowledge grounding and does not guarantee citation or hallucination prevention. Option D requires manual orchestration between retrieval and generation and custom verification logic, which increases development and maintenance effort.

Therefore, Option B delivers accurate, grounded, and cited clinical recommendations with minimal infrastructure and operational overhead.

Option C is the correct solution because it uses a single, well-tuned Amazon Bedrock guardrail that applies different actions to different content types, which is the recommended approach for minimizing false positives while enforcing strong policy controls.

Setting content filters to medium rather than high reduces overblocking of benign customer conversations while still preventing harmful content. Amazon Bedrock guardrails are designed to balance precision and recall, and medium sensitivity is commonly recommended for customer-facing financial services use cases.

Denied topics explicitly prevent the assistant from discussing investment advice, which is a regulatory requirement. Including definitions and sample phrases improves detection accuracy and reduces ambiguity.

Sensitive information filters support different actions per context. Masking PII in responses preserves conversational usefulness for legitimate customer support while preventing exposure of sensitive data. Blocking sensitive financial information in inputs prevents downstream processing of disallowed content before it reaches the foundation model.

Critically, enabling both input and output evaluation ensures that guardrails are applied consistently at every stage of interaction. Custom blocked messages and audit logging provide clear compliance evidence for regulators and internal audits.

Option A causes excessive false positives by blocking all PII outright. Option B introduces unnecessary complexity and is not how Bedrock guardrails are intended to be applied. Option D uses orchestration logic that Bedrock guardrails already handle natively.

Therefore, Option C best satisfies enforcement, flexibility, auditability, and accuracy requirements.

Option D best satisfies all functional, performance, and governance requirements while minimizing architectural complexity. The requirement explicitly states that all filtering must complete before content reaches the foundation model, which rules out asynchronous or streaming-based approaches that could delay enforcement.

Amazon Comprehend supports toxicity detection, prompt safety classification, and PII detection with entity redaction as managed capabilities. Running these filters in parallel ensures low end-to-end latency, which is essential for customer-facing communication platforms. Parallel execution avoids the cumulative latency that would be introduced by sequential pipelines.

Toxicity detection identifies offensive or abusive content early. Prompt safety classification detects requests for unethical, harmful, or manipulative advice, which directly addresses inappropriate advice solicitation requirements. PII detection with entity redaction ensures that customer privacy is preserved before data is sent to the FM, preventing sensitive information from being processed or echoed in generated responses.

Configuring thresholds allows fine-grained control over sensitivity while maintaining acceptable false-positive rates. Using CloudWatch metrics and alarms enables continuous monitoring of filtering behavior and intervention rates without adding custom routing or human review pipelines that would slow responses.

Option A lacks PII redaction. Option B introduces unnecessary model-building complexity and delayed PII checks. Option C adds sequential latency and introduces human review routing, which violates the response-time requirement.

Therefore, Option D provides the most robust, performant, and AWS-aligned layered content filtering solution.

Option A is the correct answer because Amazon Bedrock Flows is purpose-built to orchestrate generative AI workflows that combine data access, deterministic transformations, and model invocation with minimal operational overhead. The requirements explicitly state that the workflow must retrieve content from Amazon S3, extract a specific portion of a predefined template, send that portion to an Amazon Bedrock model, and store the model’s response back into the same S3 bucket. Amazon Bedrock Flows natively supports all of these steps.

By configuring S3 action nodes at the beginning and end of the flow, the workflow can retrieve the original communications and persist the reviewed output without custom code. The expression step allows deterministic parsing of a specific portion of the template, which is essential when only part of the message should be reviewed. This avoids relying on generative logic for parsing, which would be less predictable and harder to audit. The agent step is then used specifically for the review task, where the foundation model evaluates or modifies the extracted content.

Option B uses AWS Step Functions, which can achieve similar outcomes but requires more explicit orchestration logic and does not provide GenAI-native constructs such as expressions and agent steps in a single managed experience. Options C and D rely on Amazon Bedrock agents and AWS Lambda functions to handle parsing and data movement, which increases complexity, operational overhead, and maintenance burden.

Because Amazon Bedrock Flows directly integrates S3 actions, parsing expressions, and model review steps in a single managed workflow, Option A best meets the requirements with the least development and operational effort.

Option B meets the requirement to combine scalable automated evaluation with targeted human oversight using managed AWS GenAI capabilities. Amazon Bedrock evaluations enable systematic, repeatable quality assessment across large volumes of interactions. Using an LLM-as-a-judge approach with a strong evaluator model such as Anthropic Claude Sonnet allows the company to automatically score outputs for dimensions like factual accuracy, conversational appropriateness, and policy alignment. This directly supports “automated quality evaluations at scale” without building custom scoring models.

However, financial recommendations add higher risk because regulatory compliance requires additional enforcement beyond general quality scoring. Amazon Bedrock guardrails provide a dedicated policy enforcement layer that can block or intervene when responses violate compliance constraints. Guardrails are particularly important for preventing disallowed financial guidance patterns and ensuring consistent behavior across deployments.

The requirement also calls for “targeted human reviews of critical interactions.” Amazon Augmented AI (A2I) is a managed human review service that supports routing specific items to human reviewers based on rules or confidence thresholds. In this design, the system can automatically send only high-risk or policy-flagged interactions to qualified financial experts for review, keeping human effort focused where it matters most while maintaining scale.

Option A is not scalable because it requires manual review of all responses. Option C relies on static rules and end-user feedback, which is insufficient for regulatory compliance and factual accuracy assurance. Option D provides monitoring but not structured quality evaluation or policy enforcement.

Therefore, Option B provides the most complete, AWS-aligned solution for scalable evaluation plus human oversight in a regulated financial context.