AIP-C01 practice question: Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation) (2 of 2)
AI Safety, Security, and Governance A free question from our original AIP-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A cable broadband provider runs a billing dispute agent built with an open-source agent framework on Amazon Bedrock AgentCore. The agent answers customer questions by calling tools that read invoices and payment history.
The invoice and payment data sit in an Amazon Aurora PostgreSQL cluster in private subnets of the provider's VPC. The security team forbids any public endpoint for that database, so the tools must reach the cluster without exposing it to the internet.
The design must keep the data path private end to end, use IAM for access to the tools, and reuse the tool code that is already written as AWS Lambda functions.
Which solution meets these requirements?
Choose one answer.
AA. Enable public access on the Aurora cluster, restrict its security group to the AgentCore service IP address ranges, and require a database password stored in AWS Secrets Manager for every query.
BB. Place the tool Lambda functions in private subnets of the VPC with access to the database port, register them in AgentCore Gateway, and let the gateway invoke them with IAM.
CC. Export the invoice and payment tables to a public Amazon S3 bucket each night, so that the agent reads the files directly and never connects to the database.
DD. Keep the tool Lambda functions outside the VPC, connect them to Aurora over its public endpoint with IAM database authentication, and enforce TLS on every connection.
Show the answer and explanation
Answer: B
A. Wrong: A public endpoint is exactly what the security team forbids, even with a restricted security group and a stored password. The service IP ranges also change over time, so the allow list would need constant updates.
B. Right: The functions reach Aurora over private addresses, so the database never needs a public endpoint. AgentCore Gateway exposes the functions as tools and invokes them with IAM, so the agent's identity controls access. Learn more: Amazon Bedrock AgentCore Gateway (opens in a new tab)
C. Wrong: A public bucket exposes customer invoices and payment history to the internet, which is a serious breach of the security requirement. Nightly copies also make the agent answer from stale data.
D. Wrong: IAM authentication and TLS protect the connection, but the traffic still uses a public endpoint, which the security team forbids. Moving the functions out of the VPC removes the private path that the requirement needs. Learn more: Giving Lambda access to resources in a VPC (opens in a new tab)
Explanation
Lambda functions in private subnets reach Aurora over private addresses, so the database needs no public endpoint. AgentCore Gateway exposes those functions as tools and invokes them with IAM. Public endpoints, public buckets and public connections all break the security rule, even when they are protected by passwords, IAM or TLS.
Want more on Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation)? The 5 full-length practice sets have 6 more Isolating GenAI workloads (VPC endpoints, IAM, Lake Formation) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →