AIP-C01 practice question: Prompt injection and jailbreak defense
AI Safety, Security, and Governance A free question from our original AIP-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A legal research firm runs a contract review assistant. Associates upload agreements and type questions, and the assistant answers from the uploaded text using a model on Amazon Bedrock.
Uploaded documents come from outside parties, and some contain hidden instructions such as an order to ignore the firm's rules and reveal internal prompts. The firm's system prompt holds trusted instructions that must not be flagged, and the firm does not want to build its own classifier.
The guardrail must flag injection and jailbreak attempts in the associate's question and in the uploaded document text, while the trusted system prompt is left out of that check.
Which configuration meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Set the prompt attack filter's input strength to NONE, and rely on the output content filters to catch any injected instructions that influence the model's reply.
BB. Add denied topics for phrases such as ignore previous instructions, plus a word filter with the same phrases, so that an attack is blocked whenever those exact words appear in the input.
CC. Turn on the prompt attack filter at HIGH input strength, and wrap the question and the uploaded document text, but not the system prompt, in guardContent blocks.
DD. Host a custom injection classifier on a SageMaker AI real-time endpoint, call it before every Bedrock request, and block any request that the classifier scores as an attack.
Show the answer and explanation
Answer: C
A. Wrong: Output filters examine the reply, not the instruction that caused it, and a prompt leak or unwanted tool action can happen before any reply is written. Turning the prompt attack filter off removes the check that the firm needs for injection. Learn more: Prompt attacks in Amazon Bedrock Guardrails (opens in a new tab)
C. Right: The prompt attack filter detects jailbreaks, prompt injection and prompt leakage, and input tagging with guardContent blocks in the Converse request limits its check to the untrusted content. The trusted system prompt is not evaluated, and the firm needs only guardrail configuration and no custom classifier. Learn more: Apply tags to user input to filter content (opens in a new tab)
D. Wrong: A custom classifier can work, but the firm would have to train, host and tune it, which adds the operational overhead that a managed guardrail avoids. It also puts a second model on the request path that the firm must keep current.
Explanation
The prompt attack filter detects jailbreaks, prompt injection and prompt leakage in input, and tagging the associate's question and document text focuses the check on untrusted content while leaving the system prompt out. Keyword lists miss rephrased attacks, output filters never see the instruction, and a custom classifier adds hosting and tuning work.
Want more on Prompt injection and jailbreak defense? The 5 full-length practice sets have 7 more Prompt injection and jailbreak defense questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →