Exams / SCS-C03 / Study guide / Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10)
Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10): SCS-C03 study notes and practice questions
What to know about Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10) for the SCS-C03 exam, from the Infrastructure Security domain (18% of the exam guide), then 1 free question to test it. Part of the SCS-C03 study guide.
These questions describe a generative AI application, such as a customer chatbot or an internal assistant that searches company documents, which must not leak data, go off topic, follow injected instructions or invent answers. You choose the control that fits the risk and the point in the flow where it runs.
What a guardrail filters
A guardrail is a set of policies that you version. Attach it to model calls with InvokeModel or Converse, or to an agent. Test the DRAFT version, then publish a numbered version for production.
Content filters block or flag hate, insults, sexual content, violence and misconduct, with separate strengths for input and output. The prompt attack filter detects jailbreaks and prompt injection, and it applies to input.
Denied topics block a subject that you describe in plain language, such as investment advice. Word filters block exact terms, such as profanity or a competitor’s name.
Sensitive information filters detect personally identifiable information and can block or mask it. Custom regular expressions cover your own identifiers.
Contextual grounding checks score whether a response is grounded in the retrieved source and relevant to the question. They are the main check for hallucinations in retrieval-augmented generation.
Automated reasoning checks verify a response against rules that you formalize, for answers that must be consistent with a policy.
ApplyGuardrail evaluates any text against a guardrail, including text from models hosted outside Bedrock. Read the ApplyGuardrail guide for how it works.
Map risks to controls
Prompt injection (OWASP LLM01): the prompt attack filter, plus least-privilege tool access. Guardrails reduce the risk; they do not remove it.
Sensitive information disclosure (LLM02): sensitive information filters on output.
System prompt leakage (LLM07): keep secrets and access rules out of the system prompt, and filter output as a second layer.
Excessive agency (LLM06): limit the agent’s IAM role and tools. A filter cannot undo an action the agent already took.
Improper output handling (LLM05): treat model output as untrusted in your own code.
A bank runs a customer-service assistant on Amazon Bedrock. Customers type questions into a chat window, and the assistant answers from the bank's public product pages. The security team has seen users paste text that tries to override the assistant's instructions, and users who ask for personal investment advice that the bank cannot give.
The assistant must block prompt attacks in user input, refuse personalized investment advice, and mask account numbers in every answer. The protection must be enforced by a Bedrock guardrail, not by the prompt text alone.
Which THREE guardrail settings should the team configure? (Choose three.)
Choose three answers.
AA. Add an instruction to the system prompt that tells the model to ignore any request to change its rules and to mask account numbers in its answers.
BB. Turn on the prompt attack content filter in the guardrail for user input, so that injected instructions are detected before the model receives them.
CC. Add a denied topic to the guardrail for personalized investment advice, with example phrases that describe the questions users ask.
DD. Have a Lambda function reject any user message that contains words such as invest, stock or fund, before the model is called.
EE. Add a sensitive information filter to the guardrail for account numbers, set to mask the value in model responses as well as in user input.
FF. Have a Lambda function mask account numbers with a regular expression in the user input only, and return the model answer unchanged.
Show the answer and explanation
Answers: B, C, E
A. Wrong: Instructions in the prompt can be overridden by a crafted input, and nothing checks the answer. The requirement says the protection must be enforced by a guardrail, not by the prompt text alone.
B. Right: Correct. The prompt attack filter in Bedrock Guardrails detects jailbreak and prompt injection attempts in user input. A system prompt cannot enforce this on its own, so the guardrail is the control that blocks the attempt. Learn more: Prompt injection in Amazon Bedrock (opens in a new tab)
C. Right: Correct. A denied topic blocks a subject from its description and examples, so paraphrased questions are caught too. The guardrail then returns a blocked message instead of advice. Learn more: Guardrails for Amazon Bedrock (opens in a new tab)
D. Wrong: Keyword checks miss paraphrased questions, such as asking about where to put savings, and they also block harmless messages. The denied topic in the guardrail handles meaning, not just words.
E. Right: Correct. A sensitive information filter detects identifiers such as account numbers and masks them, including in the model response. The masking happens in the guardrail, so it applies to every call that uses it. Learn more: Sensitive information filters (opens in a new tab)
F. Wrong: Masking only the input misses account numbers that appear in the model answer, which the requirement covers. The answers would still expose the numbers that the assistant retrieves.
Explanation
Bedrock Guardrails enforce policy outside the prompt. A prompt attack filter catches injection attempts in user input, a denied topic blocks paraphrased investment advice, and a sensitive information filter masks account numbers in responses. Prompt instructions, keyword lists and input-only masking each fail one of the stated requirements.
Want more on Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10)? The 5 full-length practice sets have 5 more Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Guardrails for generative AI applications (Bedrock Guardrails, OWASP LLM Top 10)