ExamPark
Course menuAIF-C01

Exams / AIF-C01 / Securing AI systems / Question 4

AIF-C01 practice question: Securing AI systems (4 of 5)

Security, Compliance, and Governance for AI Solutions A free question from our original AIF-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

An e-commerce company's AI agents call refund tools through Amazon Bedrock AgentCore Gateway.

Security requires a fixed rule: a refund tool may run only when the refund is under $200 and the customer is verified, whatever a user or prompt says. The rule must be enforced outside the model's own reasoning.

Which approach meets this?

Choose one answer.

  1. A. Attach an AgentCore Policy to the Gateway with a Cedar rule for the refund tool that checks the amount and verified status.
  2. B. Add the rule to the agent's system prompt, then test in evaluation runs that the model refuses refunds above $200.
  3. C. Enable a Bedrock Guardrails denied topic for refunds, so the model is blocked from discussing refunds at all.
  4. D. Have a Lambda function ask the model to check each refund against the rule, then call the tool only if it agrees.
Show the answer and explanation

Answer: A

  • A. Right: Correct. AgentCore Policy checks each agent-to-tool request against Cedar rules at the Gateway before the tool runs, and it denies any request that no permit rule allows. Learn more: Getting started with Policy in AgentCore (opens in a new tab)
  • B. Wrong: The model still reads the system prompt, so a crafted user message can override it. Passing tests show typical behavior, not a guarantee.
  • C. Wrong: Guardrails filters content in model inputs and outputs. It does not check the amount or the customer's status before a refund tool is called.
  • D. Wrong: This keeps the decision inside the model's reasoning, which the requirement rules out. The model could be manipulated, or it could simply be wrong.

Explanation

Policy in Amazon Bedrock AgentCore works outside the agent, so it enforces tool rules on every request regardless of how the model is prompted. Rules are written in Cedar and attached to a Gateway. This question tests choosing deterministic enforcement over approaches that rely on the model's behavior.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free AIF-C01 practice examPractice Securing AI systemsAll Securing AI systems questions

Want more on Securing AI systems? The 5 full-length practice sets have 22 more Securing AI systems questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets