ExamPark
Course menuSAP-C03

Exams / SAP-C03 / Generative AI and ML inference (Bedrock, SageMaker AI endpoints) / Question 1

SAP-C03 practice question: Generative AI and ML inference (Bedrock, SageMaker AI endpoints)

Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A car maker's dealer portal generates marketing text from vehicle specifications with Amazon Bedrock. Twelve application accounts, each with its own VPC, call the Bedrock runtime API, and the marketing team has approved only Bedrock-hosted foundation models.

The security team requires that these calls never cross the public internet, and every call must appear in the audit logs. The network team wants to avoid running a separate endpoint and DNS setup in each of the twelve VPCs.

Which solution meets these requirements at the LOWEST cost?

Choose one answer.

  1. A. Give each application VPC a NAT gateway and call the public Bedrock endpoint, limiting callers with IAM policies.
  2. B. Create an interface VPC endpoint for the Bedrock runtime in each application VPC, with an endpoint policy that limits the approved model ARNs.
  3. C. Create one interface VPC endpoint for the Bedrock runtime in a shared services VPC that the application VPCs reach through a transit gateway, with a private hosted zone that resolves the service name to it.
  4. D. Host comparable open-weight models on Amazon SageMaker AI real-time endpoints inside each application VPC, and have the portal call those endpoints over private subnets so that no request leaves the VPC or reaches the internet.
Show the answer and explanation

Answer: C

  • A. Wrong: The calls leave the VPC through a NAT gateway and travel over the public endpoint, which breaks the requirement that they never cross the internet. Adding IAM controls does not change the path.
  • B. Wrong: Interface endpoints keep traffic private, and endpoint policies can limit the models. Creating one endpoint in each of the twelve VPCs multiplies the hourly and data charges, and it adds a DNS setup to every VPC.
  • C. Right: Correct. One shared endpoint keeps the calls on private addresses and avoids paying for an endpoint in every VPC. The private hosted zone lets each application resolve the Bedrock runtime name to that shared endpoint.
  • D. Wrong: The calls stay private, but the marketing team approved only Bedrock-hosted foundation models. Running separate SageMaker AI endpoints in twelve accounts also adds hosting and operating work.

Explanation

A single shared interface endpoint, reached over the transit gateway with a private hosted zone, keeps the calls private and avoids duplicate endpoint charges. NAT routing uses the public endpoint, and per-VPC endpoints or self-hosted models break the cost or model requirements.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SAP-C03 practice examPractice Generative AI and ML inference (Bedrock, SageMaker AI endpoints)All Generative AI and ML inference (Bedrock, SageMaker AI endpoints) questions

Want more on Generative AI and ML inference (Bedrock, SageMaker AI endpoints)? The 5 full-length practice sets have 5 more Generative AI and ML inference (Bedrock, SageMaker AI endpoints) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets