AIP-C01 practice question: Continuous monitoring for misuse, drift and policy violations
AI Safety, Security, and Governance A free question from our original AIP-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A mobile game studio runs a chat assistant that helps players with in-game questions, using a model on Amazon Bedrock with a guardrail attached. Some players try to use the assistant to generate abusive messages or to extract cheat codes.
The trust and safety team wants to know within minutes when the number of blocked requests jumps, because a coordinated campaign often starts with a burst of attempts. The on-call engineer must be paged automatically when that happens.
The monitoring must use the guardrail's own metrics, with no extra code in the game backend and no need to read the logs by hand.
Which approach meets these requirements?
Choose one answer.
AA. Export the invocation logs to Amazon S3 each day, query them with Amazon Athena every morning, and email the trust and safety team a list of the players whose requests were blocked most often.
BB. Create a CloudWatch alarm on the guardrail's intervention metric, with a threshold or an anomaly detection band, and send the alarm action to an SNS topic that pages the on-call engineer.
CC. Raise every content filter to HIGH strength so that fewer attempts reach the model, and review the monthly blocked-request totals in the billing console once the month closes.
DD. Add a Lambda function to the game backend that scores each reply with a second model, writes a row to Amazon DynamoDB for every exchange, and build a dashboard from that table.
Show the answer and explanation
Answer: B
A. Wrong: Daily exports and morning queries detect a burst hours after it starts, which is too slow for a coordinated campaign. Emailing a list also leaves the paging requirement unmet. Learn more: What is Amazon Athena? (opens in a new tab)
D. Wrong: The function works, but it adds a second model call and a database write to every exchange, which costs more and changes the game backend. It also reproduces metrics that the guardrail already publishes.
Explanation
The guardrail publishes intervention metrics to CloudWatch, so an alarm on those metrics can detect a burst within minutes without touching the game backend. Routing the alarm to an SNS topic pages the on-call engineer automatically. Daily log queries, stronger filters and custom scoring are slower, change the system, or do not alert anyone.
Want more on Continuous monitoring for misuse, drift and policy violations? The 5 full-length practice sets have 6 more Continuous monitoring for misuse, drift and policy violations questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →