{"id":12574,"date":"2026-09-15T10:15:14","date_gmt":"2026-09-15T10:15:14","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=12574"},"modified":"2026-09-15T10:15:14","modified_gmt":"2026-09-15T10:15:14","slug":"amazon-aws-certified-generative-ai-developer-professional-aip-c01-practice-test-questions-and-exam-dumps-part20-q381-400","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/amazon-aws-certified-generative-ai-developer-professional-aip-c01-practice-test-questions-and-exam-dumps-part20-q381-400\/","title":{"rendered":"Amazon AWS Certified Generative AI Developer – Professional AIP-C01 Practice Test Questions and Exam Dumps Part20 Q381-400"},"content":{"rendered":"

View Full Amazon AWS Certified Generative AI Developer – Professional AIP-C01 Exam Dumps<\/a> and Practice Test Dumps<\/b><\/h2>\n

 <\/p>\n

Question 381<\/b><\/h3>\n

A developer wants to ensure that an AI application can identify whether a user’s request contains sensitive personal information before processing it. Which approach is most appropriate?<\/b><\/p>\n

    \n
  1. Increase the model temperature<\/span><\/li>\n
  2. Use input data classification and PII detection controls<\/span><\/li>\n
  3. Increase the vector database size<\/span><\/li>\n
  4. Disable request validation<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    Input data classification and PII detection can help identify sensitive information before it is processed by downstream AI components. Depending on the application’s requirements, detected data may be masked, removed, routed differently, or processed under stricter controls. This supports privacy and compliance requirements while reducing unnecessary exposure of personal information to foundation models. Developers should combine detection with authorization, encryption, logging controls, and data minimization. Detection alone does not guarantee protection because sensitive information can be missed, so multiple security layers are recommended.<\/span><\/p>\n

    Question 382<\/b><\/h3>\n

    A RAG application returns poor answers because the user’s question uses terminology different from the wording used in stored documents. Which technique can improve retrieval?<\/b><\/p>\n

      \n
    1. Query transformation or rewriting<\/span><\/li>\n
    2. Disable embeddings<\/span><\/li>\n
    3. Increase output temperature<\/span><\/li>\n
    4. Remove document metadata<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Query transformation can rewrite or expand a user’s query into a form that better matches the terminology and concepts present in the knowledge base. This can improve retrieval when users use abbreviations, informal language, synonyms, or terminology different from source documents. The transformed query can then be processed by the retrieval system to identify relevant content. Developers should evaluate whether query rewriting improves retrieval recall without introducing incorrect assumptions. It can be combined with embeddings, metadata filtering, hybrid search, and reranking for more effective retrieval.<\/span><\/p>\n

      Question 383<\/b><\/h3>\n

      A company wants an AI agent to perform an external action only when the requested operation matches a predefined set of permitted actions. Which approach provides the strongest control?<\/b><\/p>\n

        \n
      1. Allow the model to choose any API<\/span><\/li>\n
      2. Use an allowlist of approved operations enforced by the backend<\/span><\/li>\n
      3. Put the allowed operations only in the prompt<\/span><\/li>\n
      4. Increase the model context window<\/span><\/li>\n<\/ol>\n

        Correct Answer: 2<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        A backend-enforced allowlist restricts an agent to explicitly approved operations and provides a trusted security boundary outside the model. The model can request an operation, but the backend verifies that the requested action is permitted before execution. This is stronger than relying solely on system prompts because prompts can be misinterpreted or manipulated. Allowlisting is particularly valuable for agents that can modify records, send messages, make purchases, or access sensitive systems. Authorization, parameter validation, and audit logging should complement the allowlist.<\/span><\/p>\n

        Question 384<\/b><\/h3>\n

        A developer notices that an AI application’s model invocation costs have increased even though user traffic has remained stable. Which investigation should be performed first?<\/b><\/p>\n

          \n
        1. Check token usage and prompt-size changes<\/span><\/li>\n
        2. Change the DNS configuration<\/span><\/li>\n
        3. Increase the model temperature<\/span><\/li>\n
        4. Delete monitoring data<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Stable request volume does not necessarily mean stable inference cost. Increased prompt size, larger retrieved context, longer model outputs, or changes in model selection can increase token consumption and therefore affect costs. Developers should compare current token usage with historical baselines and examine prompt templates, retrieval behavior, output limits, and model routing. Caching and more efficient context selection may reduce unnecessary inference. Temperature does not directly explain increased token consumption, while DNS settings and deleting monitoring data do not address the underlying cost increase.<\/span><\/p>\n

          Question 385<\/b><\/h3>\n

          A developer wants to ensure that a knowledge base contains only the latest approved version of each policy document. Which ingestion practice is most useful?<\/b><\/p>\n

            \n
          1. Maintain document version metadata and remove or supersede obsolete versions<\/span><\/li>\n
          2. Duplicate every document during ingestion<\/span><\/li>\n
          3. Increase model temperature<\/span><\/li>\n
          4. Disable document identifiers<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Document version metadata helps a knowledge base distinguish current content from obsolete versions. During ingestion, the pipeline can identify newer versions and remove, replace, or mark older documents as inactive according to the application’s retrieval design. This reduces the risk that users receive outdated policy information. Version identifiers, timestamps, source identifiers, and lifecycle rules can help maintain index consistency. Developers should test update and deletion workflows carefully because stale vectors can remain available even after the original source document has changed.<\/span><\/p>\n

            Question 386<\/b><\/h3>\n

            A company wants to protect an AI application’s API from clients sending requests that exceed allowed payload sizes. Which control is most appropriate?<\/b><\/p>\n

              \n
            1. Payload validation and request-size limits<\/span><\/li>\n
            2. Higher model temperature<\/span><\/li>\n
            3. Larger embedding dimensions<\/span><\/li>\n
            4. Unlimited API requests<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Payload validation and request-size limits allow an application to reject oversized or malformed requests before they consume downstream resources. This protects API infrastructure, reduces unnecessary processing costs, and can help prevent denial-of-service conditions caused by excessively large inputs. API Gateway and application-level validation can be used as part of a layered approach. Limits should be selected according to legitimate business requirements and model capabilities. Authentication, authorization, throttling, and monitoring should also be applied because payload controls alone do not provide complete API security.<\/span><\/p>\n

              Question 387<\/b><\/h3>\n

              A developer needs an AI workflow to continue processing even if one noncritical task fails, while recording the failure for later investigation. Which design is most appropriate?<\/b><\/p>\n

                \n
              1. Fail the entire workflow immediately<\/span><\/li>\n
              2. Ignore the failure completely<\/span><\/li>\n
              3. Use controlled error handling with a failure branch<\/span><\/li>\n
              4. Retry the failed task forever<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Controlled error handling allows a workflow to distinguish critical failures from noncritical ones. If a noncritical task fails, the workflow can record the error, execute a fallback or compensation step, and continue when business requirements permit. Workflow orchestration services can provide retry and catch mechanisms for this purpose. Ignoring errors can hide important failures, while unlimited retries can create unnecessary cost and delays. The workflow should clearly define which failures permit continuation and which require termination, escalation, or manual intervention.<\/span><\/p>\n

                Question 388<\/b><\/h3>\n

                A company wants to prevent an AI agent from accessing a customer’s information unless the authenticated user has permission to view it. Where should the authorization decision be enforced?<\/b><\/p>\n

                  \n
                1. Only in the foundation model prompt<\/span><\/li>\n
                2. In trusted application or backend authorization logic<\/span><\/li>\n
                3. Only in the user’s browser<\/span><\/li>\n
                4. Only in the model’s temperature settings<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Authorization decisions should be enforced by trusted application or backend components because the model cannot be treated as a security boundary. The backend should determine the authenticated user’s identity, permissions, and requested resource before returning sensitive information to the agent. Prompt instructions can guide behavior but cannot reliably enforce access control. Browser-only controls are also insufficient because clients can potentially be manipulated. Authorization should be applied consistently across retrieval, tool execution, APIs, and data stores to prevent unauthorized information disclosure.<\/span><\/p>\n

                  Question 389<\/b><\/h3>\n

                  A RAG application uses semantic search but fails to retrieve documents containing exact product codes. Which retrieval strategy could improve this behavior?<\/b><\/p>\n

                    \n
                  1. Hybrid search combining semantic and keyword retrieval<\/span><\/li>\n
                  2. Increase model temperature<\/span><\/li>\n
                  3. Remove keyword fields<\/span><\/li>\n
                  4. Use only longer prompts<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Hybrid search combines semantic retrieval with keyword or lexical matching. This is useful when queries contain exact identifiers such as product codes, part numbers, account references, or technical terms that may not be represented optimally through semantic similarity alone. Keyword matching can capture exact terms while vector retrieval provides broader conceptual matching. The two result sets can then be combined or ranked. Developers should evaluate hybrid retrieval using representative queries because the ideal balance between lexical and semantic results depends on the application’s data and search requirements.<\/span><\/p>\n

                    Question 390<\/b><\/h3>\n

                    A developer wants to reduce the impact of a compromised AI agent that attempts to access AWS resources outside its intended function. Which measure is most effective?<\/b><\/p>\n

                      \n
                    1. Attach a narrowly scoped IAM role to the workload<\/span><\/li>\n
                    2. Give the agent AdministratorAccess<\/span><\/li>\n
                    3. Store root credentials in the prompt<\/span><\/li>\n
                    4. Disable CloudTrail<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      A narrowly scoped IAM role limits the resources and actions available to the AI workload. If an agent is compromised or manipulated, least-privilege permissions reduce the potential impact of unauthorized actions. The role should include only the permissions required for the application’s legitimate operations. AdministratorAccess and root credentials create excessive exposure and can turn a model-related security issue into a broader cloud compromise. CloudTrail should remain enabled where appropriate because audit records can help detect and investigate unauthorized activity.<\/span><\/p>\n

                      Question 391<\/b><\/h3>\n

                      A developer wants to identify whether a model’s responses contain harmful or prohibited content during evaluation. Which metric or evaluation category is most relevant?<\/b><\/p>\n

                        \n
                      1. Safety and toxicity evaluation<\/span><\/li>\n
                      2. Storage utilization<\/span><\/li>\n
                      3. DNS latency<\/span><\/li>\n
                      4. Database row count<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Safety and toxicity evaluation measures whether generated responses violate defined content policies or produce harmful material. Evaluation datasets can include normal requests, adversarial prompts, borderline cases, and known safety challenges. Results can help developers assess guardrails, model behavior, refusal patterns, and application-level controls before deployment. Safety evaluation should be performed alongside other quality measures such as relevance, factuality, and groundedness because a model can produce accurate answers that are still unsafe. The exact safety criteria should reflect the application’s users, risks, and organizational policies.<\/span><\/p>\n

                        Question 392<\/b><\/h3>\n

                        A company wants to make an AI application’s infrastructure reproducible across development, testing, and production environments. Which practice is most appropriate?<\/b><\/p>\n

                          \n
                        1. Infrastructure as code<\/span><\/li>\n
                        2. Manual configuration only<\/span><\/li>\n
                        3. Editing production resources directly<\/span><\/li>\n
                        4. Storing infrastructure settings in prompts<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Infrastructure as code defines infrastructure resources and configuration in version-controlled, repeatable definitions. This allows development, testing, and production environments to be created consistently and makes changes easier to review, audit, reproduce, and roll back. It can also help identify configuration drift between the intended and deployed environments. Manual configuration increases the risk of inconsistencies and undocumented changes. Infrastructure as code should be integrated with appropriate CI\/CD validation, security checks, approval processes, and state-management practices.<\/span><\/p>\n

                          Question 393<\/b><\/h3>\n

                          A developer needs to prevent a model from generating excessively long responses that increase latency and cost. Which control should be considered?<\/b><\/p>\n

                            \n
                          1. Output token limit<\/span><\/li>\n
                          2. Larger retrieval context<\/span><\/li>\n
                          3. Higher temperature<\/span><\/li>\n
                          4. Unlimited generation<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            An output token limit places an upper boundary on how much content the model can generate for a request. This can help control latency, inference cost, and response size. The limit should be large enough to support legitimate use cases without unnecessarily allowing very long outputs. Developers can also use concise prompting, structured output requirements, and application-level validation. Increasing retrieval context does not directly control generated length and can increase input costs. Output limits should be tested carefully because overly restrictive limits can truncate useful responses.<\/span><\/p>\n

                            Question 394<\/b><\/h3>\n

                            A company wants to make sure that an AI application’s deployment process automatically stops when security tests fail. Which CI\/CD practice is most appropriate?<\/b><\/p>\n

                              \n
                            1. Add automated security gates to the deployment pipeline<\/span><\/li>\n
                            2. Ignore test failures<\/span><\/li>\n
                            3. Deploy first and test months later<\/span><\/li>\n
                            4. Disable version control<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Automated security gates can prevent deployment when predefined security tests fail. A CI\/CD pipeline can evaluate IAM configuration, dependency vulnerabilities, infrastructure definitions, API security, prompt-related risks, or other application-specific controls before allowing production deployment. This creates a repeatable security checkpoint rather than depending entirely on manual review. The pipeline should clearly define which failures are blocking and retain test results for auditing. Security gates are especially valuable for AI applications because changes to tools, permissions, prompts, and retrieval components can introduce new attack paths.<\/span><\/p>\n

                              Question 395<\/b><\/h3>\n

                              A developer wants to determine whether a model’s answer is factually correct when compared with a trusted reference answer. Which evaluation category is most relevant?<\/b><\/p>\n

                                \n
                              1. Factuality or correctness<\/span><\/li>\n
                              2. Network throughput<\/span><\/li>\n
                              3. Storage capacity<\/span><\/li>\n
                              4. API endpoint count<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                Factuality or correctness evaluation determines whether a generated answer accurately represents the expected information. A trusted reference dataset can contain questions and validated answers against which model outputs are compared. Depending on the task, automated metrics, model-based evaluation, rule-based checks, or human review can be used. Developers should avoid relying on a single metric because factual correctness can differ from relevance, groundedness, and safety. Evaluation datasets should represent realistic production use cases and include difficult cases where models are more likely to hallucinate.<\/span><\/p>\n

                                Question 396<\/b><\/h3>\n

                                A company wants to make a frequently used AI response available faster without invoking the model every time an identical request is received. Which technique is most appropriate?<\/b><\/p>\n

                                  \n
                                1. Response caching<\/span><\/li>\n
                                2. Increase model size<\/span><\/li>\n
                                3. Increase retrieval depth indefinitely<\/span><\/li>\n
                                4. Disable authentication<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Response caching can store previously generated results and return them for repeated requests when the cached response is still valid. This can reduce model invocation costs and improve response latency. Cache keys should account for factors that affect the expected response, such as user identity, request parameters, model or prompt version, and relevant knowledge-base version. Expiration and invalidation policies are important when source information changes. Security controls must also ensure that a cached response is never returned to a user who is not authorized to access it.<\/span><\/p>\n

                                  Question 397<\/b><\/h3>\n

                                  A developer is troubleshooting why an agent sometimes uses an incorrect tool even though the correct tool is available. Which area should be investigated first?<\/b><\/p>\n

                                    \n
                                  1. Tool descriptions, schemas, and routing instructions<\/span><\/li>\n
                                  2. S3 storage class<\/span><\/li>\n
                                  3. KMS key rotation frequency<\/span><\/li>\n
                                  4. DNS TTL only<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    Agents use tool descriptions, schemas, available tool metadata, and instructions to determine which capability is appropriate for a task. Ambiguous descriptions, overlapping tool purposes, unclear parameter definitions, or incomplete routing instructions can cause an agent to select an incorrect tool. Developers should make tool names and descriptions precise, define expected inputs and outputs clearly, and reduce unnecessary overlap between tools. Evaluation should include ambiguous and adversarial requests to verify correct tool selection. Backend authorization must still prevent incorrect tool selection from causing unauthorized actions.<\/span><\/p>\n

                                    Question 398<\/b><\/h3>\n

                                    A RAG system’s source documents are updated frequently, but the retrieval index is refreshed only once per week. What is the primary concern?<\/b><\/p>\n

                                      \n
                                    1. Knowledge freshness<\/span><\/li>\n
                                    2. Model temperature<\/span><\/li>\n
                                    3. IAM username length<\/span><\/li>\n
                                    4. API domain naming<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      A weekly refresh can cause the retrieval system to provide outdated information when source documents change more frequently. Knowledge freshness is particularly important for applications involving policies, prices, product information, procedures, or other dynamic content. Developers should determine an appropriate synchronization frequency based on business requirements and may use event-driven ingestion for faster updates. The pipeline should also monitor ingestion failures and confirm that updated and deleted documents are reflected in the index. Fresh retrieval data helps reduce responses based on obsolete information.<\/span><\/p>\n

                                      Question 399<\/b><\/h3>\n

                                      A company wants to reduce the number of unnecessary model calls when an application receives duplicate requests within a short period. Which combination is most effective?<\/b><\/p>\n

                                        \n
                                      1. Caching and request deduplication<\/span><\/li>\n
                                      2. Larger prompts and higher temperature<\/span><\/li>\n
                                      3. Unlimited retries<\/span><\/li>\n
                                      4. More retrieved documents<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Caching and request deduplication can prevent multiple identical or equivalent requests from triggering unnecessary model invocations. A system can identify duplicate requests using a suitable request key and either return a valid cached result or allow one request to proceed while equivalent requests reuse its result. This can reduce cost, latency, and backend load. The design must account for authorization, personalization, source-data freshness, and model or prompt versions when determining whether results are reusable. Deduplication should not accidentally combine requests that require different responses.<\/span><\/p>\n

                                        Question 400<\/b><\/h3>\n

                                        A production AI application must balance response quality, latency, safety, and cost when selecting a foundation model. Which approach provides the strongest basis for the decision?<\/b><\/p>\n

                                          \n
                                        1. Choose the most expensive model automatically<\/span><\/li>\n
                                        2. Select the model with the largest context window<\/span><\/li>\n
                                        3. Evaluate candidate models against representative workloads and defined business metrics<\/span><\/li>\n
                                        4. Select the newest model without testing<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 3<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Foundation model selection should be based on measured performance against the application’s actual requirements. A representative evaluation workload can compare quality, groundedness, safety, latency, throughput, token usage, and cost across candidate models. The best model is not necessarily the largest, newest, or most expensive option. Different workloads may also benefit from model routing rather than a single model. Evaluation should include normal requests, difficult cases, safety scenarios, and production-like traffic patterns. This provides evidence for selecting a model that meets business requirements while controlling operational costs.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Amazon AWS Certified Generative AI Developer – Professional AIP-C01 Exam Dumps and Practice Test Dumps   Question 381 A developer wants to ensure that an AI application can identify whether a user’s request contains sensitive personal information before processing it. Which approach is most appropriate? Increase the model temperature Use input data classification […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/12574"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=12574"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/12574\/revisions"}],"predecessor-version":[{"id":12576,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/12574\/revisions\/12576"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=12574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=12574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=12574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}