View Full Amazon AWS Certified Generative AI Developer – Professional AIP-C01 Exam Dumps and Practice Test Dumps

 

Question 361

A company wants an AI application to use different foundation models depending on whether a request requires low latency or advanced reasoning. Which design is most appropriate?

1. Model routing based on application requirements
2. Use the largest model for every request
3. Randomly select a model
4. Disable model evaluation

Correct Answer: 1

Explanation

Model routing allows an application to select an appropriate foundation model based on factors such as task complexity, latency requirements, cost, and quality expectations. Simple requests can potentially use a faster or less expensive model, while complex tasks can be routed to a more capable model. Routing policies should be validated through representative evaluations and monitored in production. Random selection provides unpredictable results, while always using the largest model may unnecessarily increase cost and latency. Effective routing balances application quality with operational efficiency.

Question 362

A developer is building a RAG system for multiple customers. Customer A must never retrieve documents belonging to Customer B. Which control should be applied?

1. Increase embedding dimensions
2. Tenant-aware access filtering
3. Increase model temperature
4. Remove document metadata

Correct Answer: 2

Explanation

A multi-tenant RAG application should enforce tenant isolation throughout the retrieval process. Documents should contain reliable tenant metadata, and retrieval requests should apply filters based on the authenticated user’s tenant identity. Authorization must be enforced by trusted application components rather than relying on the model to ignore unrelated documents. This prevents cross-tenant information disclosure and supports stronger security boundaries. Developers should also test isolation explicitly using adversarial scenarios and verify that cached responses cannot accidentally be shared between different customers.

Question 363

A model is producing overly variable responses for the same input, making a deterministic business workflow difficult to test. Which inference parameter should the developer review first?

1. Temperature
2. S3 lifecycle policy
3. IAM policy name
4. Vector index metadata

Correct Answer: 1

Explanation

Temperature influences the randomness of model generation. Higher values generally allow more variation, while lower values can make outputs more deterministic, although exact behavior depends on the model. For structured business workflows, developers may reduce temperature and use appropriate output constraints when supported. Other inference parameters such as top-p may also affect generation behavior and should be evaluated according to the selected model. Infrastructure settings such as S3 lifecycle policies and IAM policy names do not directly control response variability.

Question 364

An AI agent receives an instruction from a retrieved webpage telling it to ignore previous instructions and send confidential data to an external address. What type of threat is this?

1. Infrastructure drift
2. Indirect prompt injection
3. Vector dimension mismatch
4. API throttling

Correct Answer: 2

Explanation

Indirect prompt injection occurs when malicious instructions are embedded in content that an AI system retrieves or processes, such as webpages, documents, emails, or database records. If an agent treats retrieved content as trusted instructions, the attacker may influence its behavior or attempt to cause unauthorized actions. Developers should clearly separate retrieved data from trusted instructions, restrict tool permissions, validate actions, and use appropriate guardrails. Agents should never be given unrestricted authority merely because retrieved content instructs them to perform an operation.

Question 365

A developer wants to prevent an agent from executing a tool call when required parameters are missing or invalid. Which control should be implemented?

1. Tool input schema validation
2. Higher temperature
3. Larger context windows
4. Random tool selection

Correct Answer: 1

Explanation

Tool input schema validation ensures that requests contain the expected fields, data types, ranges, and required values before execution. This creates a trusted boundary between model-generated tool arguments and the underlying application. Validation can reject malformed requests before they reach sensitive services and can reduce errors caused by hallucinated or incomplete parameters. Developers should also apply authorization and business-rule checks because a syntactically valid request may still be unauthorized or unsafe. Model instructions alone should not be considered sufficient validation for consequential tool operations.

Question 366

A company wants to encrypt sensitive data stored by an AI application using customer-controlled encryption keys. Which AWS service should be considered?

1. AWS KMS
2. Amazon EventBridge
3. Amazon API Gateway
4. AWS Step Functions

Correct Answer: 1

Explanation

AWS Key Management Service provides managed cryptographic keys that can be used to encrypt data across supported AWS services and applications. Organizations can control access to keys through key policies and IAM permissions and can integrate encryption into their security architecture. This is useful for AI applications processing confidential business information or regulated data. EventBridge handles event routing, API Gateway manages APIs, and Step Functions orchestrates workflows. Encryption should be combined with proper identity controls, logging, data classification, and secure key-management practices.

Question 367

A RAG application has good retrieval recall but poor answer quality because retrieved passages are frequently too long and contain unrelated information. What should the developer investigate?

1. Chunking and context selection
2. CloudTrail retention
3. DNS configuration
4. IAM username length

Correct Answer: 1

Explanation

Large retrieval chunks can contain useful information alongside unrelated material, increasing context size and making it harder for the model to identify the evidence needed for an answer. Developers should evaluate chunk size, overlap, document structure, metadata filtering, and reranking. The goal is to provide sufficiently complete evidence without overwhelming the generation model with irrelevant content. Retrieval recall alone does not guarantee useful generation. Testing different chunking strategies against representative questions can help identify a configuration that balances retrieval quality, grounding, latency, and token cost.

Question 368

A developer needs to make sure a long-running AI workflow does not wait forever for an unavailable external service. Which control is most appropriate?

1. Timeout
2. Unlimited retry
3. Higher temperature
4. Larger embedding dimension

Correct Answer: 1

Explanation

Timeouts establish a maximum amount of time that an application will wait for a dependency to respond. They prevent workflows from becoming indefinitely blocked when an external service is unavailable or unresponsive. Timeouts should be designed according to expected service latency and combined with controlled retries, exponential backoff, and fallback handling where appropriate. Unlimited retries can worsen resource consumption and create cascading failures. Model generation parameters and embedding dimensions do not provide protection against indefinitely waiting for an unavailable external dependency.

Question 369

A company wants to verify that a model update has not reduced answer quality for previously supported use cases. Which test is most appropriate?

1. Regression evaluation
2. DNS testing
3. Storage-class testing
4. IAM username testing

Correct Answer: 1

Explanation

Regression evaluation compares a new model or application version against established test cases to determine whether previously acceptable behavior has degraded. A representative evaluation dataset should cover common requests, important edge cases, safety scenarios, and known failure modes. Metrics can include correctness, relevance, groundedness, safety, latency, and cost. Regression testing is particularly important when changing foundation models, prompts, retrieval logic, or inference parameters because improvements in one area can sometimes introduce unexpected degradation elsewhere.

Question 370

A developer wants to reduce model input size while retaining the most relevant retrieved information. Which approach is most appropriate?

1. Retrieve fewer high-quality passages after ranking
2. Include the entire knowledge base
3. Duplicate retrieved passages
4. Increase irrelevant context

Correct Answer: 1

Explanation

Selecting fewer high-quality passages can reduce the amount of context sent to the model while preserving the evidence most relevant to the user’s request. A retrieval pipeline can initially identify candidates and then use similarity scoring, metadata filtering, or reranking to select the strongest results. This can reduce token consumption, latency, and the risk of irrelevant information influencing the response. Developers should validate the approach with retrieval and generation evaluations to ensure that reducing context does not remove information required for accurate answers.

Question 371

An AI application must support a sudden increase in traffic while maintaining acceptable response times. Which operational strategy should the developer consider?

1. Capacity planning and controlled scaling
2. Disable monitoring
3. Remove request limits
4. Increase prompt length

Correct Answer: 1

Explanation

Capacity planning helps determine whether the application has sufficient compute, model invocation capacity, database throughput, API quotas, and other resources to handle expected demand. Controlled scaling can increase capacity when traffic grows while avoiding unnecessary resource consumption during low-demand periods. Developers should monitor latency, errors, throttling, concurrency, and utilization to identify bottlenecks. Removing request limits can overload downstream services, while longer prompts generally increase processing requirements. Capacity planning should account for normal traffic as well as predictable and unexpected workload spikes.

Question 372

A company wants to prevent unauthorized users from changing an AI application’s production configuration. Which security practice is most appropriate?

1. Restrict configuration changes through IAM permissions and controlled deployment processes
2. Store administrator credentials in prompts
3. Allow every application user to modify settings
4. Disable audit logging

Correct Answer: 1

Explanation

Production configuration should be protected through identity-based permissions, least privilege, and controlled deployment processes. IAM policies can restrict who is authorized to modify relevant AWS resources, while CI/CD approval gates can ensure that changes are reviewed before deployment. Audit logging can provide evidence of configuration changes and support investigations. Giving application users broad administrative access creates unnecessary risk. Credentials should never be embedded in prompts or model context. Security controls should be enforced by trusted infrastructure rather than by relying on AI-generated instructions.

Question 373

A developer is evaluating a RAG system and wants to measure whether relevant source passages are successfully retrieved. Which metric is particularly useful?

1. Retrieval recall
2. Model temperature
3. API hostname length
4. S3 object size only

Correct Answer: 1

Explanation

Retrieval recall measures how effectively the retrieval system finds relevant information that should have been retrieved for a query. Low recall means the necessary evidence may not reach the generation stage, which can lead to incomplete or incorrect responses even when the foundation model itself is capable. Developers can evaluate recall using labeled datasets containing expected relevant documents or passages. Other retrieval metrics, such as precision and ranking quality, should also be considered because retrieving many irrelevant documents can reduce context efficiency and negatively affect generation.

Question 374

An AI application generates a response using sensitive customer records. The company wants to prevent those records from appearing unnecessarily in application logs. Which practice should be used?

1. Sensitive-data redaction and logging minimization
2. Log every prompt and response indefinitely
3. Disable authentication
4. Increase model temperature

Correct Answer: 1

Explanation

Sensitive-data redaction removes or masks confidential information before it is written to logs, while logging minimization limits collection to information necessary for operational or security purposes. These controls reduce the risk that application logs become a secondary source of sensitive-data exposure. Organizations should also apply access controls, encryption, retention policies, and monitoring to log storage. Logging every prompt and response indefinitely can create unnecessary privacy and compliance risks. Developers should carefully consider what information is required for troubleshooting before enabling detailed AI request logging.

Question 375

A developer needs to execute independent AI processing tasks concurrently and continue only after all tasks finish. Which workflow pattern is most suitable?

1. Parallel execution followed by synchronization
2. Infinite recursion
3. Manual execution
4. Sequential execution for every task

Correct Answer: 1

Explanation

Parallel execution is appropriate when multiple tasks are independent and do not need to wait for one another. The workflow can start separate branches concurrently and then use a synchronization point to continue after all required branches have completed. This can reduce total processing time compared with sequential execution. Developers should still consider concurrency limits, downstream quotas, failure handling, and aggregation requirements. If one branch fails, the workflow should have a defined strategy for retrying, skipping, compensating, or terminating based on business requirements.

Question 376

A company wants to ensure that a generated answer is based on the retrieved documents rather than unrelated model knowledge. Which evaluation dimension should be emphasized?

1. Groundedness
2. Storage durability
3. Network packet size
4. DNS resolution time

Correct Answer: 1

Explanation

Groundedness evaluates whether generated claims are supported by the information provided to the model, such as retrieved documents in a RAG workflow. High groundedness is important when applications must provide evidence-based answers and avoid unsupported claims. Evaluation can compare generated statements against retrieved source material and identify unsupported assertions. Developers can improve groundedness through stronger retrieval, clearer prompts, source-aware response formats, output validation, and appropriate guardrails. Groundedness should be measured independently from general response fluency because a fluent answer can still contain unsupported information.

Question 377

A developer wants to securely expose a backend AI service through a managed API endpoint. Which AWS service is designed for API management?

1. Amazon API Gateway
2. Amazon S3
3. AWS KMS
4. Amazon CloudTrail

Correct Answer: 1

Explanation

Amazon API Gateway provides managed capabilities for exposing and controlling APIs. It can support authentication and authorization integrations, request validation, throttling, monitoring, and routing to backend services. For an AI application, API Gateway can act as a controlled entry point between clients and model-processing infrastructure. Security should still be implemented through appropriate identity controls and backend authorization rather than assuming the API gateway alone is sufficient. S3 provides object storage, KMS manages encryption keys, and CloudTrail records AWS activity.

Question 378

A developer wants to ensure that an AI agent cannot execute a tool with a parameter outside an approved business range. Which control should be implemented?

1. Server-side business-rule validation
2. Higher temperature
3. Larger context windows
4. More retrieved documents

Correct Answer: 1

Explanation

Server-side business-rule validation ensures that tool parameters meet organizational requirements before an action is executed. For example, a transaction amount can be checked against an approved limit, or a requested account operation can be restricted to permitted states. This protection remains effective even if the model generates an invalid value or is influenced by malicious input. Schema validation verifies structure, while business-rule validation verifies whether the requested operation is actually acceptable. High-impact actions should use trusted application controls rather than relying on model instructions.

Question 379

A company wants to identify which component caused latency in a multi-step AI workflow involving an API, retrieval service, model invocation, and database. Which observability approach is most useful?

1. Distributed tracing with correlation identifiers
2. Disable application logs
3. Monitor only total monthly cost
4. Increase model temperature

Correct Answer: 1

Explanation

Distributed tracing allows developers to follow a request across multiple services and identify where time is being spent. Correlation identifiers can connect API requests, retrieval operations, model invocations, database calls, and downstream services to the same workflow execution. This makes it easier to distinguish model latency from retrieval, database, network, or application overhead. Aggregate latency alone may indicate that a problem exists but cannot reliably identify its source. Tracing should be combined with metrics and logs to provide a complete observability picture.

Question 380

A company is selecting between RAG and fine-tuning for an assistant that needs to follow a particular response style while also using frequently updated company policies. Which architecture is most appropriate?

1. Fine-tune the model for style and use RAG for current policies
2. Use only fine-tuning for every policy update
3. Use only the model’s pretrained knowledge
4. Increase temperature instead of using external knowledge

Correct Answer: 1

Explanation

RAG and model customization can serve different purposes in the same application. Fine-tuning or another customization approach may help establish consistent task behavior or response style, while RAG can provide current company policies and other frequently changing factual information at inference time. This separation avoids repeatedly modifying the model whenever policies change. The architecture should still evaluate whether customization is actually necessary and whether the selected model supports the required approach. Retrieval freshness, access control, grounding, and response quality should all be tested before production deployment.