Exams / AIP-C01 / Study guide / Filtering harmful input (Bedrock Guardrails content filters and denied topics)
Filtering harmful input (Bedrock Guardrails content filters and denied topics): AIP-C01 study notes and practice questions
What to know about Filtering harmful input (Bedrock Guardrails content filters and denied topics) for the AIP-C01 exam, from the AI Safety, Security, and Governance domain (20% of the exam guide), then 2 free questions to test it. Part of the AIP-C01 study guide.
AIP-C01 asks how to stop abusive, off-topic or manipulative user input from reaching a model, and which Bedrock control to attach at the input step. The right answer usually matches the kind of problem: a harmful subject, a banned topic, an exact word, or an attack on the system prompt.
Input filters in Bedrock Guardrails
Content filters detect hate, insults, sexual content, violence and misconduct in input. Each category has its own strength (NONE, LOW, MEDIUM or HIGH), so you can tune categories separately. See content filters.
Denied topics block a subject you describe in plain language, such as investment advice or diagnosing a medical condition. Use them for subjects the application must never discuss.
Word filters block exact custom words or phrases, such as competitor product names, plus a managed profanity list.
Prompt attack filter detects jailbreak and prompt injection attempts. It checks input only. See prompt attacks.
Image content filters screen images for harmful content when a request includes them.
Input tags and scope
With input tags, the guardrail evaluates only the tagged text, and the prompt attack filter needs tags to work with InvokeModel. With the Converse API, wrap the user’s message in a guard content block. Leave the system prompt untagged so it is not scanned and does not cause false positives. See input tagging.
Screening outside a Bedrock model call
The ApplyGuardrail API evaluates text without invoking a Bedrock model. Use it to screen input before a self-hosted model or a model on another platform, or to screen text in a custom workflow. The same guardrail policy applies, so one set of rules covers every model. See ApplyGuardrail.
Borderline cases
Some inputs need judgment, not a hard block. Keep clear violations on the fast guardrail path, and send unclear requests to an AWS Step Functions workflow that calls a Lambda classifier or pauses with a task token for a reviewer’s decision.
How to choose
Scenario wording
Choose
“Block hateful or violent user messages”
Content filters on input, with strength set per category
“Users must not get investment advice”
Denied topic with a plain-language definition and sample phrases
“Block competitor names and profanity”
Word filter with a custom list and the managed profanity list
“Users try to override the system instructions”
Prompt attack filter with input tags
“Screen input before a model hosted outside Bedrock”
ApplyGuardrail API
“Unclear inputs need a person to decide”
Step Functions workflow with a human approval callback
Common traps
Scanning the whole prompt without tags, so trusted system text is also checked and triggers false positives.
Using a denied topic for one word. Word filters fit exact terms, and denied topics fit subjects.
Setting every strength to HIGH on launch day instead of tuning in Detect mode with real traffic first.
Assuming the guardrail protects calls it never sees. Attach it to every invocation, or enforce its use with IAM (see defense in depth).
Filtering only input. Model output can still be harmful, so output needs its own check.
A media company runs a reader comment assistant on Amazon Bedrock. It summarizes thousands of reader comments on each news article and answers editors' questions about the coverage, using the Converse API with a guardrail attached.
Reader comments often contain hateful or threatening language. The moderation team needs that input blocked before it reaches the model, and the newsroom needs the guardrail to stay active on the summaries too.
Summaries of stories about wars, shootings and riots must still be generated, because they describe violence in factual terms and editors depend on them every day. A hostile comment must be stopped, but a factual news summary must not be refused.
Which guardrail configuration meets these requirements?
Choose one answer.
AA. Set the hate and violence content filters to HIGH strength for input and to MEDIUM strength for output, and keep the other categories at their defaults.
BB. Set the hate and violence content filters to HIGH strength for both input and output, and have the application retry any blocked summary with a rephrased prompt.
CC. Set the hate and violence content filters to LOW strength for input and output, and add a denied topic for violence that blocks requests about violent acts.
DD. Remove the content filters and add a custom word filter that lists offensive terms and violent phrases, which the moderation team keeps up to date.
Show the answer and explanation
Answer: A
A. Right: Content filters have separate input and output strengths, so the input side can be strict while the output side stays tolerant of factual reporting. A medium output strength still blocks harmful generated text while letting summaries of violent events through. The team should test these thresholds in Detect mode against sample stories before enforcing them. Learn more: Content filters in Amazon Bedrock Guardrails (opens in a new tab)
B. Wrong: HIGH output strength blocks many factual summaries of violent news, and retrying with a rephrased prompt adds latency and cost without a dependable fix. The stricter input setting is right, but the output setting breaks the requirement that editors still receive summaries.
Bedrock content filters take separate input and output strengths for each category, so the input side can be strict while the output side stays tolerant of factual news. Blanket strictness or a violence denied topic would block legitimate summaries, while low input strength and word lists would let hostile comments through.
A freight forwarder runs a shipment exception assistant on a self-hosted open-weight model. The model is deployed on a SageMaker AI real-time endpoint in the company's account, because the operations team fine-tuned it on internal incident reports and other systems call that endpoint directly.
Dispatchers type free-text questions that may include customer personal data, or attempts to make the model reveal internal information. The company wants the same content safety checks it uses with other models, applied in real time, but it cannot move the model into Amazon Bedrock.
The checks must screen what goes to the model and what comes back, and a blocked request must never reach the endpoint.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Run a nightly job that calls ApplyGuardrail on the previous day's logged prompts and sends a report to the operations manager, so that unsafe prompts are found and reviewed the next morning.
BB. Call ApplyGuardrail with the INPUT source on each dispatcher question before invoking the endpoint, and stop the request when the response shows that the guardrail intervened.
CC. Copy the guardrail's denied topics into the system prompt of the self-hosted model, so that the model is instructed to refuse those topics when it answers dispatchers.
DD. Import the model into Amazon Bedrock with Custom model import, attach the guardrail to the Converse calls, and point the other systems at the Bedrock endpoint instead of the SageMaker endpoint.
EE. Call ApplyGuardrail with the OUTPUT source on the model's reply before it is returned to the caller, and return the guardrail's output text in place of any reply that it blocks.
C. Wrong: A system prompt asks the model to refuse, but the model may still comply, and the guardrail's sensitive information checks are not reproduced. The option does not screen the endpoint's input or output in real time.
ApplyGuardrail evaluates text against a guardrail without invoking a model, so it can screen both the dispatcher's question before it reaches a self-hosted endpoint and the model's reply before it is returned. A nightly review is too late, a system prompt is not enforced, and moving the model to Bedrock breaks the stated requirement.
Want more on Filtering harmful input (Bedrock Guardrails content filters and denied topics)? The 5 full-length practice sets have 5 more Filtering harmful input (Bedrock Guardrails content filters and denied topics) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Filtering harmful input (Bedrock Guardrails content filters and denied topics)