Preventing harmful or unwanted output: AIP-C01 study notes and practice questions
What to know about Preventing harmful or unwanted output for the AIP-C01 exam, from the AI Safety, Security, and Governance domain (20% of the exam guide), then 1 free question to test it. Part of the AIP-C01 study guide.
AIP-C01 asks how to keep a generative application from showing harmful, private or unsafe content, and from acting on unsafe model output. Most questions give a symptom, such as a response that leaks a phone number or a model that writes a destructive query, and ask for the control that stops it.
Filtering model output
Guardrail content filters, denied topics and sensitive information filters also apply to output. When a response is blocked, Bedrock returns the blocked output message you configured instead of the model text. For sensitive information, choose the action per entity:
Mask (anonymize) replaces the detected value with a placeholder and keeps the rest of the answer.
Block replaces the whole response, for content that must never be shown.
For streaming responses, a guardrail can filter synchronously, which holds each chunk until it is checked, or asynchronously, which sends text sooner and checks it in the background. Choose synchronous when a policy must never show a violating chunk, or when PII must be masked, which asynchronous mode does not support. See streaming behavior and handling harmful content.
Deterministic output for actions
Prompt instructions such as “only write safe SQL” are not a control. When a model’s output drives an action, treat it as data, not as code to run. For text-to-SQL, let the model choose from validated query templates or fill named parameters, run the query under a read-only database role, and validate the result before execution. Structured output with a schema and a server-side validator follows the same principle.
Measuring quality and toxicity
Filters block at runtime, while evaluations measure quality over time. Bedrock evaluations can use an LLM as a judge to score a sample of responses for harmfulness and other responsible AI metrics. Run these on a representative dataset before release and on sampled traffic afterward. A judge score does not stop a live response by itself.
Detect before you enforce
Run a new guardrail in Detect mode first. It records what would have been blocked without changing the response. Review those results with real or realistic traffic, adjust thresholds and topics, then switch to block or mask.
How to choose
Scenario wording
Choose
“Show a safe message instead of a harmful answer”
Output guardrail with blocked output messaging
“Hide phone numbers but still answer the question”
Sensitive information filter with the mask action
“Any policy violation means no answer at all”
Block action
“Model writes SQL against a database”
Validated templates or parameterized queries with a read-only role
“Score toxicity across a large sample of answers”
LLM-as-a-judge evaluation
“See what would be blocked before enforcing”
Detect mode
Common traps
Trusting the prompt to keep SQL safe. Validation and least privilege are the controls.
Mask when the content must never appear. Masking keeps the rest of the answer, so use block for disallowed content.
Using evaluations as a runtime block. Evaluation jobs measure quality; guardrails enforce it.
Choosing asynchronous streaming for strict policies, because text may reach the user before the check finishes.
Filtering input only and assuming model output is safe.
A regional bank runs a loan explainer assistant for its website. It drafts plain-language explanations of mortgage terms and fees for customers, using a model on Amazon Bedrock through the Converse API.
The compliance team bans the assistant from giving personal investment advice, and a generated reply that does so must never reach a customer. When a reply is blocked, the customer must see an approved message from the bank instead of a generic model error.
The compliance team also wants a weekly count of blocked replies, without building any custom scanning code.
Which solution meets these requirements with the LEAST custom code?
Choose one answer.
AA. Add an instruction to the system prompt that forbids investment advice, write every reply to Amazon S3, and have the compliance team review a sample of those files each week for policy violations.
BB. Pass each generated reply through an AWS Lambda function that searches for a list of banned phrases, and return a fixed message from the function whenever one of the phrases matches.
CC. Create a guardrail with an investment advice denied topic, and attach it to the Converse calls so that it checks only the customer's question, refusing unsafe questions before the model runs.
DD. Create a guardrail with an investment advice denied topic and the bank's approved text as its blocked output message, attach it to Converse, and chart its CloudWatch metrics.
Show the answer and explanation
Answer: D
A. Wrong: A system prompt instruction asks the model to behave, but it is not an enforced control, so a reply can still break the rule. Weekly sampling also finds violations only after customers have already read them, so it misses the in-line blocking requirement.
B. Wrong: The Lambda function blocks replies in line, but phrase matching misses advice written in other words and needs constant upkeep. It also means writing and maintaining custom scanning code, which the bank wants to avoid.
A guardrail's denied topic applies to model replies as well as user inputs, so unsafe advice is blocked before a customer sees it. The blocked output message supplies the approved wording, and the guardrail metrics give the weekly count without custom code. A system prompt and sampled logs are not enforced controls, and an input-only check never inspects the reply.
Want more on Preventing harmful or unwanted output? The 5 full-length practice sets have 5 more Preventing harmful or unwanted output questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →