AWS Certified Generative AI Developer – Professional — Practice Set 1

Question 1

A machine learning engineer at a financial services company is selecting a supervised learning algorithm to predict whether a loan application will default. The training dataset contains 500,000 labeled records with 40 features including credit score, debt-to-income ratio, employment history, and loan amount. The business requires an interpretable model that risk analysts can audit and explain to regulators. Which algorithm BEST meets these requirements?

Accepted Answer

Logistic regression provides direct coefficient-level interpretability — regulators can see exactly how each feature contributes to the prediction, which satisfies auditability requirements without additional tooling. A deep neural network maximizes accuracy but is inherently a black box, which fails the regulatory interpretability requirement. XGBoost with SageMaker Clarify offers interpretability, but logistic regression is the BEST choice when interpretability is the primary constraint alongside a labeled dataset. Unsupervised clustering is inappropriate here because the dataset already has labels (default/no default), making this a supervised classification problem.

Question 2

A machine learning engineer is evaluating a binary classification model that detects fraudulent transactions. The dataset is highly imbalanced: 99% of transactions are legitimate and 1% are fraudulent. The model achieves 99% overall accuracy on the test set. The business requirement is to catch as many fraudulent transactions as possible even at the cost of some false positives. Which metric should the engineer use to MOST accurately evaluate model performance for this use case?

Accepted Answer

Recall (sensitivity) measures what fraction of actual fraud cases the model catches, which directly aligns with the business goal of minimizing missed fraud even at the cost of false positives. Overall accuracy is misleading on imbalanced datasets — a model that always predicts 'legitimate' achieves 99% accuracy while catching zero fraud cases. Precision focuses on avoiding false positives, which is the opposite of the stated business priority. Specificity measures true negative rate for the majority class, which is not relevant to the fraud detection objective.

Question 3

A data scientist at a retail company is training a product recommendation model on Amazon SageMaker. During training, the model achieves 95% accuracy on the training set but only 62% accuracy on the validation set. The model has 200 million parameters but the training dataset contains only 50,000 records. The team needs to improve generalization without collecting more data. Which approach MOST effectively addresses this problem?

Accepted Answer

The large gap between training accuracy (95%) and validation accuracy (62%) with a high parameter-to-data ratio is a classic overfitting scenario. L2 regularization penalizes large weights, dropout randomly disables neurons during training, and data augmentation synthetically increases effective dataset size — together these are the standard techniques to combat overfitting. Increasing epochs and learning rate would worsen overfitting by allowing the model to memorize the training data even more. Switching to a larger model would increase the parameter-to-data ratio, making overfitting worse. Removing features would reduce model information but does not address the fundamental overfitting cause.

Question 4

An organization is building a customer churn prediction pipeline on AWS. The raw data resides in Amazon S3 and includes structured transaction records with 15% missing values in key feature columns. The team wants to automate feature engineering and model training with minimal code. The pipeline must scale to process 10 TB of data monthly. Which AWS service combination is MOST appropriate for this use case?

Accepted Answer

Amazon SageMaker Data Wrangler provides a low-code interface for handling missing values and feature transformations at scale; SageMaker Autopilot automates algorithm selection and hyperparameter tuning; SageMaker Pipelines orchestrates the end-to-end workflow — together they satisfy the minimal-code and scalability requirements. AWS Lambda has a 15-minute execution limit and 10 GB memory cap, making it unsuitable for 10 TB monthly processing. Amazon EMR with custom EC2 training requires significant custom code, contradicting the minimal-code requirement. Exporting data from Athena to RDS before training adds unnecessary latency and cost without solving the missing values problem.

Question 5

A machine learning engineer is designing a real-time inference pipeline for a fraud detection model deployed on Amazon SageMaker. The model receives 10,000 transactions per second at peak load with latency requirements under 50 ms at the 99th percentile. The model is a 2 GB XGBoost ensemble. Cost is a secondary concern but availability must be 99.99%. Current deployment uses a single ml.c5.4xlarge instance which saturates at 4,000 TPS. Which deployment configuration BEST meets the requirements?

Accepted Answer

Auto scaling with a minimum of 2 instances across two Availability Zones ensures both high availability (99.99% requires multi-AZ) and the throughput capacity to handle 10,000 TPS at 50 ms p99 latency — a well-tuned ml.c5.4xlarge handles ~4,000 TPS, so 3+ instances at peak provides headroom. Elastic inference accelerators accelerate GPU-based deep learning models, not XGBoost CPU inference. SageMaker serverless inference has cold start latency that would violate the 50 ms p99 requirement and is not designed for 10,000 sustained TPS. Pre-computing fraud scores is not feasible because the input space of transaction features is not enumerable and transactions are real-time events with unique parameters.

Question 6

A developer is building a customer service chatbot using a large language model through Amazon Bedrock. The chatbot must answer questions about the company's product catalog, which is updated weekly. The developer wants the chatbot to respond accurately about current products without retraining the model. Which approach BEST meets these requirements?

Accepted Answer

RAG with Amazon Bedrock Knowledge Bases retrieves relevant product information at inference time from a vector store (Amazon OpenSearch Serverless), allowing the catalog to be updated weekly without any model retraining. The retrieved context is injected into the prompt, ensuring factual accuracy about current products. Fine-tuning weekly is prohibitively expensive and slow, and bakes knowledge into model weights rather than keeping it updatable. Embedding the full catalog as a system prompt would exceed token context limits for large catalogs and increase latency and cost on every request. Amazon Lex without a foundation model cannot handle natural language understanding for diverse customer questions.

Question 7

An organization wants to compare foundation models available through Amazon Bedrock to select the MOST cost-effective option for a document summarization workload. The documents average 3,000 words each. The team processes 50,000 documents per month and the summaries need to be coherent but do not require specialized domain knowledge. Latency requirements are relaxed — batch processing within 24 hours is acceptable. Which model selection approach is MOST cost-effective?

Accepted Answer

Amazon Bedrock model evaluation allows systematic comparison of quality metrics across models with different pricing tiers; choosing the smallest model that meets quality thresholds optimizes cost without sacrificing adequacy for general summarization. Defaulting to Titan Premier without benchmarking may not be optimal since other models could provide better quality-per-dollar for this workload. Claude 3 Opus is the most expensive Anthropic model and its advanced reasoning capabilities are unnecessary for standard document summarization. Deploying on SageMaker JumpStart with dedicated instances introduces fixed instance costs that exceed per-token pricing at 50,000 documents/month if utilization is not near 100%.

Question 8

A generative AI developer is building a code generation assistant using Amazon Bedrock. During testing, the model frequently generates syntactically valid code that solves the wrong problem or misinterprets ambiguous requirements. The developer wants to improve the model's ability to ask clarifying questions before generating code and to break complex problems into sub-steps. No fine-tuning budget is available. Which prompt engineering technique MOST effectively addresses this behavior?

Accepted Answer

Chain-of-thought prompting with few-shot examples explicitly teaches the model to decompose problems into reasoning steps and ask clarifying questions before writing code — directly targeting the observed failure mode without any fine-tuning cost. Setting temperature to 0.0 produces deterministic outputs but does not change the model's problem-solving strategy; it will still misinterpret ambiguous requirements, just consistently. Increasing max_tokens gives the model more output space but does not instruct it to reason differently. A negative system prompt that returns errors for ambiguous requirements would make the assistant unusable, as most real-world requirements contain some ambiguity.

Question 9

A machine learning engineer is designing a generative AI application that uses Amazon Bedrock to generate personalized marketing emails. The marketing team requires that every email contain the company's legal disclaimer as the final paragraph, a specific greeting format, and the customer's name in the first sentence. The prompt must also be protected from customer-provided inputs that could override these instructions. Which Amazon Bedrock feature BEST enforces these structural requirements?

Accepted Answer

Amazon Bedrock prompt management supports structured prompt templates with system-level segments that take precedence over user-turn content, preventing prompt injection from customer inputs. Combining this with output validation ensures structural compliance before the email is sent. Simple prompt templates with variable substitution do not inherently protect against prompt injection — a malicious customer input can still override instructions in many models. Guardrails content filters detect policy violations (toxicity, PII, etc.) but are not designed to enforce output structure requirements. Storing structure in DynamoDB adds operational complexity and still passes everything through the user-turn, remaining vulnerable to prompt injection.

Question 10

A developer is implementing a multi-turn conversational AI assistant using Amazon Bedrock. Users have conversations that can span 30–40 exchanges before reaching a conclusion. The developer notices that the model begins to lose context and contradict earlier statements after approximately 15 exchanges, and that each request is becoming very expensive because the full conversation history is sent every time. Which approach MOST effectively addresses both the context loss and cost issues?

Accepted Answer

Sliding window with summarization preserves the semantic content of earlier conversation turns in compressed form while keeping token counts manageable, directly solving both the context loss problem (summary retains key facts) and the cost problem (fewer tokens per request). Limiting to 15 turns degrades user experience and does not solve the problem. Retrieving only the last 5 messages loses the early context that the model was contradicting, making the context loss problem worse. Switching to a larger context window model addresses context loss but worsens cost — sending 40 turns of history in every request at a higher per-token price of a premium model is the most expensive option.

Question 11

A generative AI developer at a legal firm is evaluating whether to fine-tune a foundation model or use in-context learning for a contract clause classification task. The task requires classifying 47 specific clause types defined in the firm's internal taxonomy. The firm has 800 labeled contract examples distributed unevenly across clause types (some types have only 5 examples). The application must respond in under 2 seconds. The team has a one-time budget of $15,000 for development. Which approach BEST meets all constraints?

Accepted Answer

Few-shot in-context learning with dynamic example selection via semantic similarity avoids fine-tuning costs entirely while enabling classification across all 47 types — retrieving the most similar labeled examples for each inference call compensates for the small per-class dataset. With only 5 examples for some classes, fine-tuning risks severe overfitting on underrepresented types. Fine-tuning Claude on Amazon Bedrock is not supported in the same way as Amazon Titan and other supported models, and the small dataset size (especially 5 examples per rare class) makes fine-tuning unreliable. Fine-tuning Amazon Titan with augmentation for 47 classes from 800 examples would require careful implementation and may consume the $15,000 budget in training costs without guaranteed quality improvement. A BERT classifier could work but requires labeled data for all 47 classes and introduces infrastructure management overhead.

Question 12

A machine learning engineer is evaluating embedding models for a semantic search system built on Amazon Bedrock Knowledge Bases. The system needs to retrieve relevant passages from a corpus of 2 million technical documents averaging 500 words each. The retrieval quality measured by Mean Reciprocal Rank (MRR) must exceed 0.82. The system must respond in under 300 ms for 95% of queries. The engineer has benchmarked three embedding models and found that a larger model achieves MRR 0.87 but 350 ms p95 latency, while a smaller model achieves MRR 0.79 but 180 ms p95 latency. Which action should the engineer take?

Accepted Answer

The smaller model meets the latency requirement (180 ms vs 300 ms threshold) but falls short on quality (MRR 0.79 vs 0.82 target). HyDE (Hypothetical Document Embeddings) is a query expansion technique where the model generates a hypothetical answer to the query, embeds it, and uses that richer embedding for retrieval — this consistently improves MRR by 0.05–0.10 on technical corpora, which would close the gap. The larger model already exceeds both the 300 ms latency threshold (350 ms) and the MRR target (0.87), so approaches A, B, and C focus on optimizing the larger model. A flat index has higher retrieval latency than HNSW for large corpora, making option A counterproductive. CloudFront caches HTTP responses but cannot cache semantic search queries effectively because each natural language query has a unique vector. Pre-filtering with optimized HNSW could reduce latency but may not be sufficient to bring 350 ms below 300 ms at p95.

Question 13

A company is building an AI assistant for its HR department using Amazon Bedrock Agents. The assistant must be able to answer questions about company policies (stored in a SharePoint knowledge base), look up employee vacation balances (from an internal HR API), and submit vacation requests on behalf of employees. The assistant must only submit requests after explicit employee confirmation. Which Amazon Bedrock feature BEST implements the confirmation requirement?

Accepted Answer

Amazon Bedrock Agents support a return-of-control mechanism where an action group can return a confirmation prompt to the human user before executing a consequential action — the agent pauses, presents the details to the user, and only proceeds after the user confirms. This is the native, purpose-built mechanism for human-in-the-loop approval. A Lambda confirmation email adds asynchrony and does not block execution pending a response; the API could still be called before the user replies. An SQS queue adds manual human approval by a separate approver, not the requesting employee's confirmation, and introduces significant latency. Guardrails content filters are designed for blocking harmful content, not for implementing business workflow confirmation logic.

Question 14

A machine learning engineer is fine-tuning a foundation model on Amazon Bedrock to improve its performance on medical diagnosis support. The training dataset consists of 50,000 de-identified patient case summaries with associated diagnoses. After fine-tuning, the model shows improved accuracy on the medical task but the engineer discovers the model now frequently refuses to answer non-medical questions that it previously handled well. Which problem has occurred and what is the MOST appropriate remediation?

Accepted Answer

Catastrophic forgetting occurs when fine-tuning on a narrow domain causes a model to overwrite the general-knowledge weights it acquired during pre-training, resulting in degraded performance on out-of-domain tasks. The standard remedy is mixed-dataset fine-tuning that interleaves domain-specific examples with general instruction-following examples to preserve broad capabilities. Data poisoning refers to intentionally malicious training data — the patient records are de-identified and legitimate, not poisoned. Reducing epochs with higher learning rate would make training less stable and would not address the domain narrowing. Reward hacking is a reinforcement learning phenomenon; this was supervised fine-tuning, not RLHF.

Question 15

An organization is building a multi-modal generative AI application that ingests scanned PDF contracts and extracts structured information including party names, effective dates, payment terms, and governing law clauses. The extracted data must be stored in Amazon DynamoDB with 99.9% field accuracy. The contracts vary significantly in formatting. Which Amazon Bedrock architecture BEST meets the accuracy and structure requirements?

Accepted Answer

Multi-modal foundation models on Amazon Bedrock can process PDF images directly, preserving visual layout context that plain text extraction loses — this is critical for contracts where formatting conveys meaning (tables, headers, signature blocks). Structured output enforcement with a JSON schema ensures the model always returns the required fields in a consistent format that can be directly validated and written to DynamoDB. Amazon Textract with raw text prompt is limited to text-only models that lose layout context, reducing accuracy on variably formatted contracts. Amazon Comprehend entity recognition does not recognize domain-specific contract entities like payment terms or governing law clauses. Fine-tuning on 1,000 examples is insufficient for the diversity of contract formats and adds development overhead without the accuracy guarantee of structured output schemas.

Question 16

A developer is building an Amazon Bedrock Agent that orchestrates multiple tools: a web search tool, a calculator tool, and a database query tool. During testing, the agent sometimes selects the wrong tool for a given task, calls tools with incorrect parameters, and occasionally loops between tools without making progress. The developer wants to improve agent reliability without changing the underlying foundation model. Which combination of changes MOST effectively improves agent reliability? (Choose TWO.)

Accepted Answer

Detailed action group descriptions directly address wrong tool selection — the agent uses these descriptions during planning to decide which tool matches the task, so more specific descriptions improve selection accuracy. Descriptive Lambda error messages address incorrect parameter calls — when the agent receives a clear error explaining the expected format, it can self-correct on the next iteration without looping endlessly. Increasing max orchestration steps does not fix wrong tool selection or bad parameters; it just allows more failed attempts. Guardrails are not designed to enforce agent behavior patterns. Switching to a larger model changes the foundation model, which the question explicitly rules out, and is the most expensive remediation.

Question 17

A machine learning engineer is designing a RAG system for a pharmaceutical company's drug interaction database containing 500,000 documents. Users ask clinical questions requiring synthesis of information from multiple documents simultaneously. Benchmarking shows that naive top-K retrieval (K=5) achieves MRR 0.71 but clinicians require MRR ≥ 0.85 for safety-critical use. The documents contain dense technical terminology and numerical data. Infrastructure cost must remain under $0.05 per query. Which retrieval strategy MOST effectively meets the quality requirement?

Accepted Answer

Hybrid search combines the strengths of dense retrieval (semantic similarity for conceptual matches) and sparse BM25 (exact keyword matching for drug names and numerical values) — particularly important for pharmaceutical terminology where exact term matching matters as much as semantic meaning. Cross-encoder reranking on the top-20 candidates significantly improves precision by scoring query-document pairs jointly, which consistently boosts MRR by 0.10–0.15 in domain-specific corpora. Increasing K to 50 sends too many tokens to the model (exceeding cost budget and potentially context limits) without improving precision. Switching to a biomedical embedding model would help but requires re-embedding 500,000 documents (significant one-time cost) and alone may not close the full 0.14 MRR gap. The agentic retrieval loop in option D could improve multi-document synthesis but at high latency and per-query cost that may exceed the $0.05 budget.

Question 18

A company is using Amazon Bedrock to build a code review assistant that analyzes pull requests and suggests improvements. The assistant must understand the company's internal coding standards, which are documented in 200 pages of internal guidelines not present in the foundation model's training data. The team has 2,000 labeled examples of good and bad code reviews aligned with the internal standards. Total inference budget is $500/month for an estimated 10,000 code reviews per month. Fine-tuning budget is $5,000 one-time. Which approach BEST balances quality, cost, and the coding standards requirement?

Accepted Answer

Combining fine-tuning with RAG provides complementary benefits: fine-tuning teaches the model the style, format, and judgment patterns of the company's code reviews using the 2,000 labeled examples, while RAG injects the specific applicable guideline sections for each review without exceeding context limits. This hybrid approach maximizes quality at the $5,000 fine-tuning budget. Fine-tuning alone (option A) teaches patterns but cannot inject the 200 pages of specific rule text; the model must memorize rules during fine-tuning, which is unreliable for detailed compliance. RAG alone (option B) without fine-tuning means the model may not follow the company's review style or judgment criteria embedded in the 2,000 examples. Claude 3 Opus with 200-page system prompts would exceed context limits and cost approximately $2,000–3,000/month for 10,000 reviews, well over the $500 budget.

Question 19

A machine learning engineer is deploying a generative AI application using Amazon Bedrock that generates product descriptions for an e-commerce platform. The descriptions must be reviewed by the marketing team before publishing. The marketing team reviews 500 descriptions daily but can only process 200 per day manually. The engineer needs to prioritize which AI-generated descriptions require human review versus which can be published automatically. Which approach MOST effectively implements this selective human review pipeline?

Accepted Answer

Using a secondary Bedrock classification call to score quality and brand alignment creates an intelligent triage layer: high-confidence, clearly aligned descriptions are auto-published, while ambiguous or low-quality ones are routed to Amazon SageMaker Ground Truth (a human review and annotation service), staying within the 200/day human capacity. SQS with dead letter queue just queues the overflow with no intelligence — descriptions are still delayed and no prioritization occurs. A/B testing publishing 40% automatically without quality filtering could publish poor descriptions, damaging brand reputation. Amazon Rekognition performs image and video content moderation, not text quality or brand alignment evaluation for product descriptions.

Question 20

A company is deploying an Amazon Bedrock application that assists human resources professionals in screening job applications. During testing, the team discovers the model more frequently rates applications from candidates with non-Western names as less qualified than equally credentialed candidates with Western names. The application will be used for hiring decisions affecting thousands of candidates. Which action should the team take FIRST before deployment?

Accepted Answer

Deploying a model with known demographic bias in hiring creates serious legal exposure under employment discrimination law and causes real harm to candidates. Halting deployment and conducting a formal fairness audit with SageMaker Clarify to quantify disparate impact across groups is the required first step before any remediation or release. A disclaimer does not mitigate the actual bias or legal liability — recruiters may still over-rely on AI recommendations. Retraining with oversampling addresses one bias signal (name frequency in training data) but does not guarantee removal of all demographic biases, and should follow the audit. Removing names (option D) is a reasonable partial mitigation that addresses the discovered signal but does not address other potential proxies for demographics that may still be in the data.

Question 21

An organization has deployed an Amazon Bedrock application that generates medical information summaries for patients. Post-deployment monitoring reveals the model occasionally generates plausible-sounding but medically inaccurate statements — a behavior known as hallucination. Patient safety is paramount. Which set of controls MOST comprehensively addresses hallucination risk in this high-stakes medical context?

Accepted Answer

For safety-critical medical information, a layered defense is required: RAG grounds responses in verified medical literature (reducing hallucination at the source), Guardrails grounding checks automatically detect claims not supported by retrieved context (catching residual hallucinations), and human clinician review provides the final safety net for patient-facing content. Temperature 0.0 makes outputs deterministic but does not prevent hallucination — models hallucinate at temperature 0 when they lack knowledge of a topic. Amazon Comprehend Medical cannot synthesize summaries or explain complex medical information; it extracts clinical entities from existing text. Self-critique with a second model call can catch some inaccuracies but the second model shares the same hallucination failure mode and cannot reliably distinguish truth from confident-sounding errors without grounded references.

Question 22

A machine learning engineer is building a generative AI application that summarizes customer support call transcripts. The transcripts contain customers' names, phone numbers, addresses, and payment information. The summarization model is accessed via Amazon Bedrock and the summaries are stored in Amazon S3. The privacy team requires that no PII appear in the stored summaries. Which approach MOST effectively prevents PII from being stored in the summaries?

Accepted Answer

Amazon Bedrock Guardrails with PII sensitive information filters provides automated detection and redaction at both the input and output layers: it prevents PII from reaching the model in the input AND blocks PII from appearing in generated summaries before they are stored — providing defense-in-depth. Amazon Comprehend pre-redaction only addresses the input; if the model infers or reconstructs PII patterns from context (e.g., referencing 'the customer' whose details appeared earlier in the conversation), the output could still contain PII. Encryption at rest (option C) protects stored data from unauthorized access but does not prevent PII from being written to the summaries in the first place. Prompt instructions are unreliable for privacy enforcement — models do not consistently follow all instructions, especially for implicit PII.

Question 23

A company is deploying a generative AI model using Amazon Bedrock for employee performance evaluations. The model will analyze employee work history, peer feedback, and project outcomes to generate written performance assessments. The legal team requires auditability: every AI-generated assessment must be traceable to the specific data points used to generate it, and employees must be able to contest any evaluation they believe is inaccurate. Which architectural controls MOST effectively satisfy these legal requirements?

Accepted Answer

Full traceability requires model invocation logging (capturing exact inputs and outputs), RAG citations (linking each claim in the assessment to the specific retrieved data point), and a human re-evaluation path for contestation via SageMaker Ground Truth. Together these satisfy both the auditability requirement (what data drove the assessment) and the contest right (a defined process for human override). CloudWatch Logs of API payloads alone provide data storage but no citation trail linking assessment claims to source data points. Fine-tuning on historical examples embeds evaluation patterns in model weights with no traceable connection to the specific data used for each employee — this cannot satisfy citation-level auditability. AWS CloudTrail logs API metadata (who called what when) and Amazon Macie scans for sensitive data; neither addresses the requirement for per-assessment data source traceability.

Question 24

A financial services company is using Amazon Bedrock to build a generative AI application that processes customer financial data for investment recommendations. The company is subject to SEC regulations requiring that AI-generated recommendations be explainable, that customer data not leave regulated AWS regions, and that all model access be restricted to authorized financial advisors only. Which combination of controls MOST comprehensively addresses all three regulatory requirements?

Accepted Answer

Option C addresses all three requirements: regulated region deployment ensures data residency compliance; IAM policies restricting InvokeModel to an advisors group enforces access control with auditability; RAG with citations provides the explainability required by SEC (each recommendation is grounded in specific cited sources); invocation logging to encrypted S3 satisfies audit trail requirements. Option B's GovCloud region is appropriate for U.S. government workloads and adds unnecessary cost for SEC-regulated private financial firms. A system prompt instruction for explanations (option A) is unreliable and does not constitute regulatory-grade explainability. AWS PrivateLink and VPC security groups (option D) control network-level access but do not address data residency at the service level or provide the citation-level explainability required.

Question 25

A machine learning engineer is designing the security posture for an Amazon Bedrock application that processes confidential merger and acquisition documents for a consulting firm. The application uses Amazon Bedrock Knowledge Bases with Amazon OpenSearch Serverless. Multiple client engagements run on the same infrastructure and documents from different clients must never be accessible across engagements. The firm requires that all data be encrypted with client-specific keys and that any model invocation be logged for billing attribution. Which architecture MOST effectively enforces client data isolation and auditability?

Accepted Answer

Separate Knowledge Bases instances with dedicated OpenSearch Serverless collections per client enforces hard infrastructure-level isolation — there is no code path by which a query for client A can retrieve documents belonging to client B. Client-specific CMKs mean even AWS cannot cross-decrypt client data. IAM policies scoped to engagement-specific ARNs enforce least-privilege access. Invocation logging with engagement ID tags enables per-client billing attribution. Metadata filters (option A) are a soft control applied at query time; a misconfigured filter or an application bug can leak cross-client documents, which is unacceptable for M&A confidentiality. Relying on the model itself to restrict output based on document tags (option C) is a prompt-level soft control with no infrastructure-level isolation. Amazon Macie and GuardDuty (option D) are detective controls that would discover a breach after the fact — they do not prevent cross-client data access.

AIP-C01 — AWS Certified AI Practitioner – Generative AI Developer