AIP-C01 Exam Questions & Answers

Option D is the correct solution because Amazon Q Developer customizations are designed to incorporate organization-approved knowledge and coding guidance without requiring per-project changes. A customization can point Amazon Q Developer to curated internal sources such as approved libraries, coding standards, architectural patterns, and proprietary techniques. This allows the assistant's suggestions to align with company policies and preferred implementations consistently across teams and repositories.

The key requirement is that the company does not want to make project-level modifications. Options A, B, and C all require adding files or repositories into the project workspace, which directly violates this constraint. They also rely on developer behavior to ''use workspace context,'' which is harder to enforce and can lead to inconsistent adherence to standards.

With a customization, the organization centrally manages and updates approved resources. This reduces operational overhead because updates to libraries, patterns, or guidelines propagate automatically to developers using the customization, without requiring changes to each project. This is especially valuable for a new team, where consistent enforcement of approved practices is important to reduce compliance risk, security issues, and inconsistent code style.

Additionally, customizations support governance by allowing the company to standardize how Amazon Q Developer responds, ensuring that suggestions reflect approved internal content rather than generic public patterns.

Therefore, Option D best satisfies the requirement for centralized enforcement of approved resources with minimal ongoing management and no project-level modifications.

Option A is the correct solution because it uses native Amazon Bedrock governance and evaluation capabilities to meet regulatory, performance, and deployment timeline requirements with the least operational overhead.

Amazon Bedrock guardrails provide built-in safety controls that enforce responsible AI policies directly during inference. Custom content filters and toxicity detection protect customer interactions and prevent disallowed investment guidance patterns without requiring custom application logic. Guardrails operate inline and are optimized for low latency, which helps meet the strict 200 ms response-time requirement.

Hallucination detection is addressed through Amazon Bedrock Model Evaluation, which supports automated evaluation at scale using LLM-as-a-judge techniques. This enables the company to detect factual inaccuracies and policy violations systematically, without building custom evaluation pipelines or requiring extensive human review. Evaluation outputs can be surfaced as metrics.

Storing all prompt-response pairs in Amazon DynamoDB provides a low-latency, highly scalable audit store that aligns with financial regulatory requirements. Using TTL enforces data retention policies automatically, reducing compliance risk and storage overhead.

Amazon CloudWatch custom metrics integrate seamlessly with existing compliance dashboards, allowing near--real-time monitoring of safety interventions, hallucination rates, and drift indicators. CloudWatch anomaly detection can be applied to these metrics to surface behavior changes quickly.

Option B relies on custom Lambda logic and S3-based auditing, increasing latency and operational complexity. Option C introduces additional services that increase setup time and may exceed the 60-day deployment window. Option D uses non--Bedrock-native monitoring and adds unnecessary infrastructure layers.

Therefore, Option A provides the most complete, compliant, and low-overhead governance solution for a regulated GenAI financial services application.

Option C is the correct solution because it provides a secure, scalable, and standards-compliant way to expose an MCP server to an AI agent while enforcing strong user authorization. The Model Context Protocol supports HTTP-based transports for remote MCP servers, making Streamable HTTP the appropriate choice when the server is hosted as a managed service rather than a local process.

Hosting the MCP server in AWS Lambda enables automatic scaling and cost-efficient execution. By placing Amazon API Gateway in front of the Lambda function, the company creates a secure, managed HTTP endpoint that the AI agent can invoke reliably. This architecture cleanly separates transport, authentication, and business logic, which aligns with AWS serverless best practices.

Using Amazon Cognito to enforce OAuth 2.1 ensures that only authenticated and authorized users can access the MCP server. This satisfies security and compliance requirements when the MCP server handles sensitive user information. Cognito integrates natively with API Gateway, removing the need for custom authentication logic and reducing operational overhead.

Option A lacks user-level authorization controls. Option B and Option D rely on STDIO transport, which is intended for local or tightly coupled processes and is not suitable for distributed, serverless architectures. Option D also introduces security risks by handling credentials through environment variables.

Therefore, Option C best meets the requirements for secure access control, scalability, and correct MCP integration in an AWS-based AI agent architecture.

Option A is the most comprehensive and architecturally aligned solution for meeting end-to-end data lineage, real-time PII filtering, and automated compliance reporting requirements in a medical GenAI system built on Amazon Bedrock. Each requirement maps directly to a managed AWS service that is purpose-built for governance, security, and compliance.

AWS Glue Data Catalog is designed to register datasets across multiple sources and maintain metadata that supports lineage tracking. By cataloging all inputs that flow into the Bedrock-based system, the organization can trace how data moves from ingestion through processing and storage, which is essential for regulatory audits in healthcare environments.

For real-time PII filtering, Amazon Bedrock Guardrails provide native PII detection and filtering during model inference. Guardrails operate inline with model invocation, ensuring sensitive information is blocked or redacted before responses are returned to users. This satisfies the requirement for real-time protection rather than post-processing analysis.

AWS CloudTrail delivers a complete audit trail of all Amazon Bedrock API calls, including InvokeModel requests and configuration changes. Storing these logs in Amazon S3 enables long-term retention and supports compliance audits. CloudTrail ensures traceability of who accessed the system, when, and how it was used.

To strengthen compliance monitoring, Amazon Macie continuously scans stored data for sensitive information and automatically classifies findings. Publishing Macie findings to Amazon CloudWatch Logs and visualizing them through dashboards enables near-real-time visibility into compliance posture and supports automated reporting workflows.

The other options fall short. Option B performs PII filtering at the application edge rather than at inference time and relies on scheduled analysis instead of real-time enforcement. Option C focuses on replication and document processing rather than inline GenAI governance. Option D uses services that are not designed for PII detection in text-based GenAI workflows and lacks native lineage tracking.

Therefore, A best fulfills all stated requirements using AWS-recommended governance and security capabilities.

Option C is the correct solution because it provides near real-time monitoring, hallucination detection, and cost anomaly awareness using built-in Amazon Bedrock and Amazon CloudWatch capabilities, with minimal custom development.

By configuring Amazon Bedrock invocation logging with text output logging, the company captures detailed prompt and response data for auditing and analysis without building custom logging pipelines. This data is stored in Amazon S3, providing durable storage for compliance and retrospective investigation.

Using Amazon Bedrock guardrails with contextual grounding checks allows the application to automatically detect hallucinations by verifying whether generated summaries are grounded in the provided clinical documents. This is the AWS-recommended approach for hallucination detection in RAG and summarization workloads and avoids the need to maintain custom evaluation models or pipelines.

Creating Amazon CloudWatch anomaly detection alarms for InputTokenCount and OutputTokenCount metrics enables automatic detection of abnormal token usage patterns that often correlate with runaway prompts, inefficient summarization, or prompt injection attempts. Anomaly detection adapts dynamically to usage trends, making it more effective than static thresholds for early cost warnings.

Option A introduces batch analytics with Glue and Athena, which is not near real time and increases operational overhead. Option B requires managing evaluation jobs and Lambda-based notification logic. Option D focuses on infrastructure-level monitoring and offline dashboards rather than near real-time GenAI quality and cost signals.

Therefore, Option C best meets the requirements with the least operational effort and maintenance overhead.