ExamPark
Course menuDVA-C03

Exams / DVA-C03 / AI service access and data privacy / Question 2

DVA-C03 practice question: AI service access and data privacy (2 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A logistics company runs a Lambda function in private subnets of its VPC. The function calls a model on Amazon Bedrock and also reads an Amazon RDS database in the same VPC.

Security policy forbids any route from these subnets to the internet, so the function must reach Bedrock privately. The SDK code should not need a different endpoint URL, and the security team wants the Bedrock access limited to the model-invocation actions the function needs.

Which solution meets these requirements?

Choose one answer.

  1. A. Create an interface VPC endpoint for bedrock-runtime, turn on private DNS, and attach an endpoint policy that allows only the model-invocation actions the function needs.
  2. B. Attach a NAT gateway in a public subnet, and route the private subnets' default traffic through it so the function can reach the public Bedrock endpoint for model calls.
  3. C. Create an interface endpoint for the bedrock service name, and point the function's model calls at that endpoint.
  4. D. Move the function outside the VPC so it can reach the public Bedrock endpoint, and connect to the database through its public address.
Show the answer and explanation

Answer: A

  • A. Right: Correct. An interface endpoint for bedrock-runtime gives the function a private path to the runtime API with no internet route. Private DNS keeps the standard service name in the SDK, and an endpoint policy narrows the Bedrock actions allowed through it. Learn more: Use interface VPC endpoints (AWS PrivateLink) with Amazon Bedrock (opens in a new tab)
  • B. Wrong: A NAT gateway gives the subnets a route to the internet, which the security policy forbids. It would work for reachability, but it breaks the stated constraint.
  • C. Wrong: The bedrock service name is a separate endpoint from bedrock-runtime. Model calls are served by the bedrock-runtime endpoint, so this route would not carry them.
  • D. Wrong: Running outside the VPC means the database must have a public route, which the security policy also rules out. The option fails the no-internet rule and the private database access.

Explanation

An interface VPC endpoint for bedrock-runtime lets the function reach model calls over private connectivity, with no internet route. Private DNS lets the SDK keep the standard service name, so the code does not change. An endpoint policy can restrict which Bedrock actions pass through the endpoint.

An interface VPC endpoint giving private subnets a path to an AWS service In private subnets with no NAT gateway, an application calls an AWS service by its normal name. Private DNS resolves the name to an interface endpoint in the subnets, which has an endpoint policy, and the traffic reaches the AWS service over the AWS network through PrivateLink. Private subnets, no NAT Application calls the normal service name Interface endpoint private DNS, endpoint policy AWS service PrivateLink
Private DNS keeps the SDK's normal Bedrock name, and the endpoint policy limits calls to model invocation.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice AI service access and data privacyAll AI service access and data privacy questions

Want more on AI service access and data privacy? The 5 full-length practice sets have 11 more AI service access and data privacy questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets