AIP-C01 practice question: Audit logging and source traceability (invocation logging, CloudTrail, Data Catalog)

AI Safety, Security, and Governance A free question from our original AIP-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.

A credit union uses Amazon Bedrock models in three applications: a card dispute assistant, a branch advisor tool and a collections email drafter. A member has complained about something they were told, and the compliance team must find exactly what the model received and returned.

Regulators require the credit union to keep each prompt and each response for seven years, encrypted, and to search them by member account. The team wants the complete content of every model call, including calls from applications it has not yet built.

The records must be inexpensive to keep for seven years and queryable with standard SQL when a complaint arrives. The team should not need to change every application.

Which solution meets these requirements at the LOWEST long-term cost?

Choose one answer.

A. Turn on AWS CloudTrail for the account, keep its records for seven years in an encrypted S3 bucket, and query the logs with Amazon Athena whenever a complaint is received.
B. Turn on model invocation logging for Amazon Bedrock with text data delivered to an encrypted S3 bucket that has a seven-year lifecycle rule, and query the stored records with Amazon Athena.
C. Write each prompt and response from the three applications to Amazon CloudWatch Logs with a three-day retention setting, and export the logs to a data warehouse once a month for the compliance team.
D. Use AWS Config to record every configuration change to the Bedrock resources, and keep that configuration history for seven years in an encrypted S3 bucket for the compliance team.

Show the answer and explanation

Answer: B

A. Wrong: CloudTrail records who called the Bedrock API and when, but it does not record the prompt or response text, so the compliance team could not see what the model said. The logs answer who-and-when questions, not what-was-said questions. Learn more: Monitor Amazon Bedrock API calls using CloudTrail (opens in a new tab)
B. Right: Invocation logging captures the prompt and response text for each model call in the account and Region, so no application changes are needed. An S3 bucket with a lifecycle rule keeps seven years of records inexpensively, and Athena searches them with SQL. Learn more: Monitor model invocation using CloudWatch Logs and Amazon S3 (opens in a new tab)
C. Wrong: A three-day retention setting deletes records long before the seven-year requirement, and each application would need changes to write them. A monthly export also leaves recent calls out of the record.
D. Wrong: AWS Config records the configuration of resources such as guardrails and endpoints, not the content of each model call. The credit union needs the prompts and responses themselves, which this history does not contain.

Explanation

Model invocation logging is an account-level setting that stores the text of each prompt and response, so applications need no changes. An encrypted S3 bucket with a seven-year lifecycle rule keeps storage inexpensive, and Athena queries the records with SQL. CloudTrail and AWS Config record calls and configuration rather than content, and short log retention loses the records.

AIP-C01 practice question: Audit logging and source traceability (invocation logging, CloudTrail, Data Catalog)

Explanation

Study

Keep practicing