SAP-C03 practice question: AI agents and RAG (AgentCore, Knowledge Bases) (2 of 2)
Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics firm is building a customer-support agent on Amazon Bedrock. The agent must choose which tools to call for each question: a shipment-tracking API in a private VPC, and a claims API that needs the customer's OAuth token. A customer may ask about only their own shipments.
The platform team wants the tool credentials kept out of the agent's code and configuration, and each conversation to run in its own isolated environment. Different customers must never share a session's memory or tool results.
Which TWO designs meet these requirements? (Choose two.)
Choose two answers.
AA. Store the tracking and claims API keys as plain environment variables in the agent's container image, and rotate them by rebuilding the image each month.
BB. Give the agent's execution role read access to the whole tracking database, and have the prompt tell the model to answer only about the customer's own shipments.
CC. Replace the agent with an AWS Step Functions workflow that calls the tracking API and then the claims API in a fixed order for every question, and use the model only to write the final reply.
DD. Host the agent on Amazon Bedrock AgentCore Runtime so that each conversation runs in its own isolated session, and pass the signed-in customer's identity to each tool call so that results are scoped to that customer's shipments.
EE. Expose the tracking and claims APIs as tools through Amazon Bedrock AgentCore Gateway. Use inbound authorization with the customer's OAuth token, and have AgentCore Identity hold the outbound credentials for the claims API.
Show the answer and explanation
Answers: D, E
A. Wrong: Keys in the image are visible to anyone who can read the image or its configuration, and monthly rebuilds do not isolate one customer's session from another. This breaks both the credential and the isolation requirements.
B. Wrong: A prompt instruction is not an access control. The execution role could read any customer's shipments, so one malformed prompt could expose another customer's data.
C. Wrong: This can keep the credentials in the workflow, but a fixed sequence removes the agent's ability to choose which tools to call for each question. The stem requires the agent to make that choice.
D. Right: Correct. AgentCore Runtime keeps each session isolated, and passing the caller's identity to the tools means results are scoped to that customer's shipments. Together with the gateway, this keeps credentials and data separate for each conversation.
E. Right: Correct. AgentCore Gateway turns the APIs into tools the agent can call, and the customer's token is checked on each call. Outbound credentials stay in AgentCore Identity, outside the agent's code.
Explanation
AgentCore Gateway and AgentCore Identity keep the tool credentials and the customer's token outside the agent, and AgentCore Runtime gives each conversation its own session with the caller's identity passed through. Hard-coded keys, a fixed workflow, and prompt-only restrictions each miss one requirement.
Want more on AI agents and RAG (AgentCore, Knowledge Bases)? The 5 full-length practice sets have 5 more AI agents and RAG (AgentCore, Knowledge Bases) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →