Pass the Amazon Web Services AWS Certified Professional AIP-C01 Questions and answers with CertsForce

Amazon Bedrock Knowledge Bases is designed specifically for managed retrieval-augmented generation. A knowledge base connects source repositories to an embedding model and vector store. During ingestion, source content is transformed into numerical vector embeddings. At retrieval time, the query is similarly represented so the knowledge base can compare semantic similarity and return passages that are conceptually relevant rather than depending exclusively on exact keyword matches.

Amazon Bedrock supports managed data-source connectors for multiple repositories. The AWS documentation lists Amazon S3, Confluence, Microsoft SharePoint, Salesforce, web crawling, and custom data sources among supported connection patterns. These connectors reduce the amount of ingestion, crawling, and synchronization code an organization needs to maintain.

For Atlassian Confluence specifically, Bedrock can crawl supported Confluence content and supports incremental synchronization for added, modified, or deleted material. Current managed Confluence integration also supports crawling pages, blog posts, and attachments, subject to the documented connector limitations.

This architecture supplies the retrieval layer needed to augment an FM with source-grounded context. It centralizes retrieval semantics while letting the application use Bedrock ' s managed ingestion and retrieval capabilities instead of implementing its own embedding pipelines.

B explicitly uses keyword-oriented mappings and therefore does not meet the semantic-search requirement. C could technically implement RAG, but Lambda-based embedding generation, synchronization, and custom retrieval logic create precisely the operational burden the company wants to avoid. D is not an appropriate semantic RAG architecture because ordinary DynamoDB queries do not automatically produce vector-based semantic retrieval from unstructured documentation.

For an internal wiki not covered by a built-in connector, the knowledge-base custom data-source capability can be used while keeping the overall retrieval interface centralized. Therefore, A provides the closest fit to every stated architectural requirement.

==========

This error occurs because SCPs override IAM permissions, and the SCP currently blocks Bedrock inference calls that resolve to eu-west-3, even though the company intends to use cross-Region inference (CRI) from eu-central-1.

Amazon Nova Pro is not hosted in eu-central-1, so when invoked, Amazon Bedrock transparently routes the request to a supporting Region (such as eu-west-3) through CRI inference profiles. However, SCPs that restrict Regions or specific Bedrock resources will block this routing unless explicitly allowed.

Option B is required because the SCP must explicitly allow the eu.amazon.nova-pro-v1:0 inference profile, which is the Bedrock abstraction that enables CRI while preserving data residency guarantees. Without this, Bedrock cannot legally route the request.

Option E is also required to allow EU-scoped inference profiles rather than individual Regions. This preserves precise governance while allowing Bedrock-managed CRI routing within the EU boundary, ensuring no data leaves Europe.

Option A violates least-privilege and does not override SCPs. Option C breaks data residency by enabling direct eu-west-3 access. Option D does not resolve the SCP denial.

Therefore, Options B and E are the only combination that resolves the error while preserving governance and EU-only data residency.

Option A is the correct answer because Amazon Bedrock Flows is purpose-built to orchestrate generative AI workflows that combine data access, deterministic transformations, and model invocation with minimal operational overhead. The requirements explicitly state that the workflow must retrieve content from Amazon S3, extract a specific portion of a predefined template, send that portion to an Amazon Bedrock model, and store the model’s response back into the same S3 bucket. Amazon Bedrock Flows natively supports all of these steps.

By configuring S3 action nodes at the beginning and end of the flow, the workflow can retrieve the original communications and persist the reviewed output without custom code. The expression step allows deterministic parsing of a specific portion of the template, which is essential when only part of the message should be reviewed. This avoids relying on generative logic for parsing, which would be less predictable and harder to audit. The agent step is then used specifically for the review task, where the foundation model evaluates or modifies the extracted content.

Option B uses AWS Step Functions, which can achieve similar outcomes but requires more explicit orchestration logic and does not provide GenAI-native constructs such as expressions and agent steps in a single managed experience. Options C and D rely on Amazon Bedrock agents and AWS Lambda functions to handle parsing and data movement, which increases complexity, operational overhead, and maintenance burden.

Because Amazon Bedrock Flows directly integrates S3 actions, parsing expressions, and model review steps in a single managed workflow, Option A best meets the requirements with the least development and operational effort.

Option A is the correct solution because it relies on native Amazon Bedrock capabilities to deliver transparency, auditability, scalability, and low latency with minimal operational overhead. Amazon Bedrock Knowledge Bases provide a fully managed Retrieval Augmented Generation (RAG) implementation that automatically handles document ingestion, embedding, retrieval, and source attribution, enabling the application to cite authoritative content without building custom pipelines.

Enabling tracing for Amazon Bedrock Agents provides end-to-end visibility into agent reasoning steps, tool usage, and model interactions. This satisfies the requirement for comprehensive audit trails and supports regulatory review in financial services environments. Structured prompts further ensure that responses explicitly present reasoning and supporting evidence in a controlled, auditable format.

Using Amazon API Gateway and AWS Lambda allows the application to scale automatically to thousands of concurrent users without capacity planning. These services are designed for bursty workloads and can easily support the stated requirement of up to 10,000 concurrent users. Amazon CloudFront reduces latency by caching and accelerating content delivery, helping the application meet the strict 2-second response-time requirement.

Option B introduces a custom RAG pipeline with OpenSearch, increasing operational complexity and maintenance effort. Option C lacks native RAG integration and does not provide transparent reasoning or citation management. Option D focuses on offline compliance reporting rather than real-time transparency and low-latency responses.

Therefore, Option A best meets all requirements while minimizing infrastructure and operational overhead.

Option A is the correct solution because it directly addresses all identified failure modes while preserving the existing Step Functions–based orchestration architecture with minimal redesign.

Using Step Functions Map states enables parallel execution of secret resolution workflows, which improves refresh latency for short-lived and expiring secrets. This ensures that secrets are refreshed in time before downstream agents require them. Passing updated secret metadata through Lambda outputs guarantees that subsequent steps always consume the latest resolved values, preventing agents from using stale data even after drift alerts are generated.

Versioning prompt flows in AWS AppConfig is critical to resolving cascading failures caused by outdated templates. AppConfig natively supports version control, validation, staged rollout, and rollback of configuration artifacts. By gating prompt flows through AppConfig, the company can immediately roll back faulty templates and prevent agents from reusing outdated instructions.

This solution maintains clear separation of concerns: Step Functions handle orchestration and parallelism, Lambda handles secret retrieval and metadata propagation, and AppConfig governs prompt lifecycle management. No additional event pipelines or custom retry coordination layers are required.

Option B oversimplifies the architecture and does not address secret lifecycle or drift. Option C introduces event-driven ordering complexity without solving prompt versioning. Option D introduces unnecessary tooling and dynamic prompt generation risk.

Therefore, Option A best resolves performance, correctness, and stability issues while minimizing operational overhead.

Option A is the correct solution because it uses native Amazon Bedrock governance and evaluation capabilities to meet regulatory, performance, and deployment timeline requirements with the least operational overhead.

Amazon Bedrock guardrails provide built-in safety controls that enforce responsible AI policies directly during inference. Custom content filters and toxicity detection protect customer interactions and prevent disallowed investment guidance patterns without requiring custom application logic. Guardrails operate inline and are optimized for low latency, which helps meet the strict 200 ms response-time requirement.

Hallucination detection is addressed through Amazon Bedrock Model Evaluation, which supports automated evaluation at scale using LLM-as-a-judge techniques. This enables the company to detect factual inaccuracies and policy violations systematically, without building custom evaluation pipelines or requiring extensive human review. Evaluation outputs can be surfaced as metrics.

Storing all prompt-response pairs in Amazon DynamoDB provides a low-latency, highly scalable audit store that aligns with financial regulatory requirements. Using TTL enforces data retention policies automatically, reducing compliance risk and storage overhead.

Amazon CloudWatch custom metrics integrate seamlessly with existing compliance dashboards, allowing near–real-time monitoring of safety interventions, hallucination rates, and drift indicators. CloudWatch anomaly detection can be applied to these metrics to surface behavior changes quickly.

Option B relies on custom Lambda logic and S3-based auditing, increasing latency and operational complexity. Option C introduces additional services that increase setup time and may exceed the 60-day deployment window. Option D uses non–Bedrock-native monitoring and adds unnecessary infrastructure layers.

Therefore, Option A provides the most complete, compliant, and low-overhead governance solution for a regulated GenAI financial services application.

Option B is the correct solution because it delivers end-to-end governance, security, and auditability across Amazon Bedrock, Amazon Rekognition, and the underlying data layer while meeting strict privacy and compliance requirements.

Using IAM attribute-based access control (ABAC) allows the company to control access to foundation models and data based on department, role, or workload attributes rather than static permissions. This is critical for controlling FM access patterns at scale. Enforcing specific ModelId and GuardrailIdentifier values with IAM condition keys ensures that only approved models and guardrails are used, which directly supports secure model I/O and governance requirements.

Configuring VPC endpoints for Amazon Bedrock ensures that all model invocations remain on private AWS network paths, reducing data exfiltration risk and supporting privacy standards. AWS CloudTrail captures both management and data events, providing a definitive audit trail of who accessed which resources and when. Sending logs to CloudTrail Lake enables centralized, long-term, queryable auditing across services.

Amazon S3 server access logging adds file-level visibility into video archive access, which is essential for compliance and forensic analysis. Amazon CloudWatch alarms provide near real-time detection of anomalous or unauthorized activity across Amazon Bedrock, Amazon Rekognition, and AWS KMS.

Option A focuses primarily on model-level tracing but lacks comprehensive IAM governance and S3 access auditing. Option C provides partial controls but lacks identity-aware auditing and model governance. Option D focuses on anomaly detection and classification but does not explicitly control FM access patterns.

Therefore, Option B best satisfies all stated requirements in a unified, auditable, and security-first architecture.

Amazon CloudWatch provides the most integrated path for unifying technical and business metrics. By importing business metrics into CloudWatch (via custom metrics or metric streams), teams can build custom dashboards that provide a single pane of glass for both system health and conversion performance. Composite alarms allow stakeholders to be notified only when multiple conditions are met (e.g., high latency and dropping conversion rates), reducing alert fatigue. Applying anomaly detection to these metrics is essential for GenAI workloads because performance baselines can shift subtly; CloudWatch can automatically detect these deviations and trigger alerts through Amazon SNS . This solution provides comprehensive correlation and automated alerting with less operational complexity than managing external visualization servers (Option B) or multi-service analytics pipelines (Option C).

Option B is the best solution because it directly addresses the Step Functions 256 KB state payload quota by externalizing large intermediate artifacts to Amazon S3 and passing only lightweight references (URIs/keys) between states. This is a standard AWS pattern for workflows that produce large intermediate results, and it avoids introducing additional databases, compression logic, or cross-state-machine coordination that increases operational overhead.

In a multi-agent ReAct workflow, intermediate reasoning traces can be verbose and grow quickly as each agent produces chain-of-thought style artifacts, structured outputs, and supporting evidence. Step Functions is designed to orchestrate state transitions and pass JSON payloads, but large payloads should be stored outside the state machine and referenced by pointer values. Using Amazon S3 for intermediate outputs is operationally efficient because the application already uses S3 for storage, and S3 provides durable, low-cost storage with simple access patterns.

ResultPath and ResultSelector allow each state to store or reshape results so that only the required reference fields (such as s3Uri, object key, metadata, trace IDs) are forwarded to subsequent states. This preserves observability because the workflow can still log trace references, correlate steps with S3 objects, and store structured metadata for debugging. It also preserves the sequential validation design, keeping the existing ReAct pattern intact while preventing failures due to oversized payloads.

Option A adds additional services and read/write patterns that increase operational complexity. Option C introduces custom compression/decompression logic that is fragile, adds latency, and complicates troubleshooting. Option D increases orchestration overhead by splitting workflows and coordinating with events, which makes debugging harder and increases failure modes.

Therefore, Option B meets the payload limit requirement while keeping the architecture simple and observable.

The errors described indicate missing permissions at both the application orchestration and data access levels. The 400 Bad Authorization from BedrockAgentRuntime indicates the Lambda execution role lacks the identity permission to invoke the agent; adding bedrock:InvokeAgent and aoss:APIAccessAll (which allows the principal to interact with OpenSearch Serverless APIs) is necessary. The 403 Forbidden error from OpenSearch Serverless specifically relates to data-plane permissions. Unlike traditional OpenSearch, Serverless uses data access policies . To " manage collections at scale " automatically, a policy must be created that uses pattern-based resource rules (e.g., matching a prefix), ensuring that as new collections or indexes are created, the required principals (the Lambda role and the Bedrock service role) are granted the necessary access without manual policy updates for every new resource.