SCS-C03 practice question: Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10)
Infrastructure Security A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A bank runs a customer-service assistant on Amazon Bedrock. Customers type questions into a chat window, and the assistant answers from the bank's public product pages. The security team has seen users paste text that tries to override the assistant's instructions, and users who ask for personal investment advice that the bank cannot give.
The assistant must block prompt attacks in user input, refuse personalized investment advice, and mask account numbers in every answer. The protection must be enforced by a Bedrock guardrail, not by the prompt text alone.
Which THREE guardrail settings should the team configure? (Choose three.)
Choose three answers.
AA. Add an instruction to the system prompt that tells the model to ignore any request to change its rules and to mask account numbers in its answers.
BB. Turn on the prompt attack content filter in the guardrail for user input, so that injected instructions are detected before the model receives them.
CC. Add a denied topic to the guardrail for personalized investment advice, with example phrases that describe the questions users ask.
DD. Have a Lambda function reject any user message that contains words such as invest, stock or fund, before the model is called.
EE. Add a sensitive information filter to the guardrail for account numbers, set to mask the value in model responses as well as in user input.
FF. Have a Lambda function mask account numbers with a regular expression in the user input only, and return the model answer unchanged.
Show the answer and explanation
Answers: B, C, E
A. Wrong: Instructions in the prompt can be overridden by a crafted input, and nothing checks the answer. The requirement says the protection must be enforced by a guardrail, not by the prompt text alone.
B. Right: Correct. The prompt attack filter in Bedrock Guardrails detects jailbreak and prompt injection attempts in user input. A system prompt cannot enforce this on its own, so the guardrail is the control that blocks the attempt. Learn more: Prompt injection in Amazon Bedrock (opens in a new tab)
C. Right: Correct. A denied topic blocks a subject from its description and examples, so paraphrased questions are caught too. The guardrail then returns a blocked message instead of advice. Learn more: Guardrails for Amazon Bedrock (opens in a new tab)
D. Wrong: Keyword checks miss paraphrased questions, such as asking about where to put savings, and they also block harmless messages. The denied topic in the guardrail handles meaning, not just words.
E. Right: Correct. A sensitive information filter detects identifiers such as account numbers and masks them, including in the model response. The masking happens in the guardrail, so it applies to every call that uses it. Learn more: Sensitive information filters (opens in a new tab)
F. Wrong: Masking only the input misses account numbers that appear in the model answer, which the requirement covers. The answers would still expose the numbers that the assistant retrieves.
Explanation
Bedrock Guardrails enforce policy outside the prompt. A prompt attack filter catches injection attempts in user input, a denied topic blocks paraphrased investment advice, and a sensitive information filter masks account numbers in responses. Prompt instructions, keyword lists and input-only masking each fail one of the stated requirements.
Want more on Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10)? The 5 full-length practice sets have 5 more Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →