ExamPark
Course menuAIP-C01

Exams / AIP-C01 / Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation) / Question 1

AIP-C01 practice question: Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation) (1 of 2)

AI Safety, Security, and Governance A free question from our original AIP-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A logistics startup runs a dispatch assistant in private subnets of its VPC. The subnets have no internet gateway and no NAT gateway, and the company's compliance rules forbid workload traffic from crossing the public internet.

The assistant calls a model on Amazon Bedrock to draft route summaries, and the security team wants those API calls to stay on the AWS network. Only the application's IAM role should be able to call Bedrock, and the model code cannot change.

The team needs a design that keeps Bedrock calls on private networking, adds the least cost, and exposes no public endpoint.

Which solution meets these requirements?

Choose one answer.

  1. A. Attach a NAT gateway in a public subnet, and restrict the application's security group to the published Bedrock IP address ranges, so that only Bedrock traffic leaves the VPC.
  2. B. Create an interface VPC endpoint for the Bedrock runtime API in the private subnets with private DNS enabled, and allow HTTPS to it from the application's security group.
  3. C. Connect the VPC to the corporate data center with a site-to-site VPN, and send the Bedrock calls through the data center's internet connection to the public Bedrock endpoint.
  4. D. Move the dispatch assistant into a public subnet with an internet gateway, and rely on TLS encryption and an API key to protect the Bedrock calls while they are in transit.
Show the answer and explanation

Answer: B

  • A. Wrong: A NAT gateway still sends the calls over the public internet, which the compliance rule forbids, and the published IP ranges change over time. The design also adds an hourly and per-gigabyte NAT charge.
  • B. Right: The interface endpoint uses AWS PrivateLink, so calls from the private subnets reach Bedrock without leaving the AWS network and without an internet gateway. The IAM role still controls which principal may call the API. Learn more: Use interface VPC endpoints (AWS PrivateLink) with Amazon Bedrock (opens in a new tab)
  • C. Wrong: The VPN adds hardware, routing and recurring cost, and the calls still reach the public Bedrock endpoint over the internet. It meets none of the stated requirements and adds another path to maintain.
  • D. Wrong: TLS encrypts the traffic, but the calls still cross the public internet, and the rule covers the network path as well as the content. A public subnet also exposes the workload to inbound traffic the team does not need.

Explanation

An interface VPC endpoint powered by AWS PrivateLink gives the private subnets a private path to Bedrock, so no traffic crosses the internet and no gateway or public IP is needed. NAT, VPN and public subnet designs all send the calls over the public internet, which the compliance rule forbids.

An interface VPC endpoint giving private subnets a path to an AWS service In private subnets with no NAT gateway, an application calls an AWS service by its normal name. Private DNS resolves the name to an interface endpoint in the subnets, which has an endpoint policy, and the traffic reaches the AWS service over the AWS network through PrivateLink. Private subnets, no NAT Application calls the normal service name Interface endpoint private DNS, endpoint policy AWS service PrivateLink
With private DNS, the Bedrock runtime name resolves to the endpoint, and the security group only needs to allow HTTPS to it.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free AIP-C01 practice examPractice Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation)All Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation) questions

Want more on Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation)? The 5 full-length practice sets have 6 more Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets