AI agents and RAG (AgentCore, Knowledge Bases): SAP-C03 study notes and practice questions
What to know about AI agents and RAG (AgentCore, Knowledge Bases) for the SAP-C03 exam, from the Architecture Design and Implementation Built for the Cloud domain (25% of the exam guide), then 2 free questions to test it. Part of the SAP-C03 study guide.
SAP-C03 asks how to build an assistant that answers from company documents with citations, and how to run agents that call internal APIs safely at scale.
RAG with Bedrock Knowledge Bases
Ingestion: connect a data source (such as S3, web crawler, Confluence, SharePoint or Salesforce), parse it, split it into chunks, create embeddings with an embedding model and write them to a vector store. Sync jobs pick up new and changed documents.
Chunking strategies:
Strategy
Fits
Default
About 300 tokens, keeping sentences whole
Fixed-size
You set chunk size and overlap
Hierarchical
Small child chunks for precise matching, parent chunks returned for context
Semantic
Splits by meaning; costs extra model calls
None
Each file is one chunk, or you chunk in a custom Lambda transformation
Vector stores: OpenSearch Serverless, OpenSearch Service managed clusters, Amazon S3 Vectors (low-cost storage for large vector sets), Aurora PostgreSQL (pgvector), Neptune Analytics for GraphRAG (relationships between entities), and third-party Pinecone, Redis Enterprise Cloud and MongoDB Atlas. Knowledge Bases can also query structured data stores by turning natural language into SQL.
Retrieval:Retrieve returns chunks; RetrieveAndGenerate returns an answer with citations. Improve quality with hybrid search (semantic plus keyword), metadata filtering (for example by department or document date, also used for per-user access), reranking models and query decomposition.
Agents with Amazon Bedrock AgentCore
AgentCore runs agents built with any framework (Strands Agents, LangGraph, CrewAI and others) and any model.
Service
Does
Runtime
Serverless hosting; each session runs in an isolated microVM, sessions up to 8 hours; MCP and A2A protocols
Gateway
Turns APIs, Lambda functions and services into MCP tools; connects to existing MCP servers
Memory
Short-term memory within a conversation and long-term memory across sessions
Identity
Agent identity and authentication to tools and identity providers, acting on behalf of users
Policy
Deterministic limits on tool calls through Gateway, written as natural-language or Cedar-compatible rules
Code Interpreter, Browser
Sandboxed code execution and a managed browser
Observability, Evaluations
OpenTelemetry traces and automated quality assessment
How to choose
Scenario wording
Choose
“Answer from internal documents with citations, fully managed”
Bedrock Knowledge Bases
“Answers must respect which documents each user may see”
Metadata filters on retrieval tied to user attributes
“Questions span relationships between entities”
GraphRAG with Neptune Analytics
“Billions of vectors, lowest storage cost”
S3 Vectors
“Expose existing REST APIs as agent tools”
AgentCore Gateway
“Isolate each user’s agent session”
AgentCore Runtime
“Agent must remember preferences across sessions”
AgentCore Memory
Common traps
Fine-tuning to add fresh or private facts, when RAG keeps answers current without retraining.
Huge chunks that dilute relevance, or tiny ones that lose context (hierarchical chunking solves both).
Hand-built tool servers on EC2 instead of AgentCore Gateway.
Letting an agent hold broad, long-lived credentials rather than scoped identities and policies.
Forgetting to re-sync the knowledge base after documents change.
A news publisher keeps a four-million-article archive as text files in Amazon S3. About 1,500 new articles arrive each day, and reporters need answers to research questions that cite the exact articles used.
Each article carries a licensing country. A reader may see only the articles licensed for their country, and new articles must be searchable within 30 minutes of publication. The publisher wants to avoid building and tuning its own embedding and indexing pipeline.
Which solution meets these requirements?
Choose one answer.
AA. Create a Bedrock knowledge base with the S3 bucket as its data source, store each article's licensing country as metadata, and run ingestion on a schedule. Pass a metadata filter for each reader's country when retrieving passages, and return citations.
BB. Fine-tune a foundation model on the archive every month in Amazon SageMaker AI, include the licensing country in the training text, and answer questions from the fine-tuned model without retrieval.
CC. Build a Lambda function that splits each new article into passages, creates embeddings with a Bedrock embedding model and stores them in a self-managed vector index, then sends the top passages to a Bedrock model with each question.
DD. Put the full text of every article that a reader may see into the prompt of each question, and send the request to a Bedrock model with the largest context window it offers.
Show the answer and explanation
Answer: A
A. Right: Correct. The knowledge base handles chunking, embedding and vector storage for the archive, and scheduled ingestion keeps new articles current. Metadata filters enforce the licensing rule at retrieval time, and the answer includes citations to the articles used.
B. Wrong: A monthly retrain cannot make articles searchable within 30 minutes, and a model does not return a citation to the source article. Fine-tuning also adds training work the publisher does not want to own.
C. Wrong: This design can meet the citation and freshness needs, but the publisher would build and tune the embedding and indexing pipeline itself. That is the work the publisher wants to avoid.
D. Wrong: Passing the whole archive in each prompt is far more costly than retrieving only the relevant passages, and it can exceed the model's context window. It also leaves no per-article citation trail for the reporters.
Explanation
A managed knowledge base covers ingestion, vector storage and citations, and metadata filters enforce the licensing rule at query time. Fine-tuning, a custom pipeline and whole-archive prompts each fail the freshness, effort or cost requirements.
A logistics firm is building a customer-support agent on Amazon Bedrock. The agent must choose which tools to call for each question: a shipment-tracking API in a private VPC, and a claims API that needs the customer's OAuth token. A customer may ask about only their own shipments.
The platform team wants the tool credentials kept out of the agent's code and configuration, and each conversation to run in its own isolated environment. Different customers must never share a session's memory or tool results.
Which TWO designs meet these requirements? (Choose two.)
Choose two answers.
AA. Store the tracking and claims API keys as plain environment variables in the agent's container image, and rotate them by rebuilding the image each month.
BB. Give the agent's execution role read access to the whole tracking database, and have the prompt tell the model to answer only about the customer's own shipments.
CC. Replace the agent with an AWS Step Functions workflow that calls the tracking API and then the claims API in a fixed order for every question, and use the model only to write the final reply.
DD. Host the agent on Amazon Bedrock AgentCore Runtime so that each conversation runs in its own isolated session, and pass the signed-in customer's identity to each tool call so that results are scoped to that customer's shipments.
EE. Expose the tracking and claims APIs as tools through Amazon Bedrock AgentCore Gateway. Use inbound authorization with the customer's OAuth token, and have AgentCore Identity hold the outbound credentials for the claims API.
Show the answer and explanation
Answers: D, E
A. Wrong: Keys in the image are visible to anyone who can read the image or its configuration, and monthly rebuilds do not isolate one customer's session from another. This breaks both the credential and the isolation requirements.
B. Wrong: A prompt instruction is not an access control. The execution role could read any customer's shipments, so one malformed prompt could expose another customer's data.
C. Wrong: This can keep the credentials in the workflow, but a fixed sequence removes the agent's ability to choose which tools to call for each question. The stem requires the agent to make that choice.
D. Right: Correct. AgentCore Runtime keeps each session isolated, and passing the caller's identity to the tools means results are scoped to that customer's shipments. Together with the gateway, this keeps credentials and data separate for each conversation.
E. Right: Correct. AgentCore Gateway turns the APIs into tools the agent can call, and the customer's token is checked on each call. Outbound credentials stay in AgentCore Identity, outside the agent's code.
Explanation
AgentCore Gateway and AgentCore Identity keep the tool credentials and the customer's token outside the agent, and AgentCore Runtime gives each conversation its own session with the caller's identity passed through. Hard-coded keys, a fixed workflow, and prompt-only restrictions each miss one requirement.
Want more on AI agents and RAG (AgentCore, Knowledge Bases)? The 5 full-length practice sets have 5 more AI agents and RAG (AgentCore, Knowledge Bases) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study AI agents and RAG (AgentCore, Knowledge Bases)