AIP-C01 practice question 5 of 15

A medical company is creating a generative AI (GenAI) system by using Amazon Bedrock. The system processes data from various sources and must maintain end-to-end data lineage. The system must also use real-time personally identifiable information (PII) filtering and audit trails to automatically report compliance. Which solution will meet these requirements?

Full set: 127 questions
Answer options
A: Use AWS Glue Data Catalog to register all data sources and track lineage. Use Amazon Bedrock Guardrails PII filters. Enable AWS CloudTrail logging for all Amazon Bedrock API calls with Amazon S3 integration. Use Amazon Macie to scan stored data for sensitive information and publish findings to Amazon CloudWatch Logs. Create CloudWatch dashboards to visualize the findings and generate automated compliance reports. Correct answer
B: Use AWS Config to track data source configurations and changes. Use AWS WAF with custom rules to filter PII at the application layer before Amazon Bedrock processes the data. Configure Amazon EventBridge to capture and route audit events to Amazon S3. Use Amazon Comprehend Medical with scheduled AWS Lambda functions to analyze stored outputs for compliance violations.
C: Use AWS DataSync to replicate data sources to track lineage. Configure Amazon Macie to scan Amazon Bedrock outputs for sensitive information. Use AWS Systems Manager Session Manager to log user interactions. Deploy Amazon Textract with AWS Step Functions workflows to identify and redact PII from generated reports.
D: Configure Amazon Athena to query data sources to analyze and report on data lineage. Use Amazon CloudWatch custom metrics to monitor PII exposure in Amazon Bedrock responses and establish AWS X-Ray tracing to generate an audit trail. Use an Amazon Rekognition Custom Labels model to detect sensitive information in the data that Amazon Bedrock processes.
Correct Answer:
A. Use AWS Glue Data Catalog to register all data sources and track lineage. Use Amazon Bedrock Guardrails PII filters. Enable AWS CloudTrail logging for all Amazon Bedrock API calls with Amazon S3 integration. Use Amazon Macie to scan stored data for sensitive information and publish findings to Amazon CloudWatch Logs. Create CloudWatch dashboards to visualize the findings and generate automated compliance reports.
Explanation

AWS Glue Data Catalog tracks tables, columns, and source objects, automatically recording end-to-end lineage that can be queried. Amazon Bedrock Guardrails provide real-time PII detection and block/mask actions on prompts and completions. AWS CloudTrail records every Bedrock API call, delivering immutable audit logs to Amazon S3. Amazon Macie continuously classifies and reports sensitive data in S3. Publishing Macie findings to CloudWatch and visualising them in dashboards supplies automated compliance evidence—satisfying lineage, real-time PII control, and audit-trail requirements.

Why Incorrect

B AWS Config tracks resource configuration, not data lineage; WAF rules cannot inspect Bedrock traffic. C DataSync copies data but does not provide lineage; Session Manager logs user shells, not Bedrock calls. D Athena only queries; CloudWatch custom metrics can’t guarantee PII filtering; Rekognition detects images, not textual PII.

References

1. AWS Glue Data Catalog Guide – “Lineage data”

2024-03-12

§“Understanding lineage graphs”.

2. Amazon Bedrock Developer Guide – “Using Guardrails for PII detection”

Rev. 2024-03-25.

3. AWS CloudTrail User Guide – “Logging Amazon Bedrock API calls”

2024-02-14

§“Data events”.

4. Amazon Macie User Guide – “Automated sensitive data discovery” & “Publishing findings to CloudWatch”

2024-03-01.

Keep practicing

Take the free AIP-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other AIP-C01 practice questions

Scroll to Top