Exams / SAP-C03 / Study guide / Generative AI and ML inference (Bedrock, SageMaker AI endpoints)
Generative AI and ML inference (Bedrock, SageMaker AI endpoints): SAP-C03 study notes and practice questions
What to know about Generative AI and ML inference (Bedrock, SageMaker AI endpoints) for the SAP-C03 exam, from the Architecture Design and Implementation Built for the Cloud domain (25% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 doesn’t test training or data science. It asks how to integrate generative AI into an architecture across many accounts, and how to serve ML models with the right latency, payload and cost profile.
Amazon Bedrock integration
Serverless model access through InvokeModel and the Converse API, which gives one request format across models and supports tool use.
Private access: call Bedrock through an interface VPC endpoint (PrivateLink) so traffic stays off the internet; restrict with endpoint policies and IAM.
Cross-Region inference profiles route requests across Regions in a geography (or globally) for more throughput; pick a geographic profile when data residency limits where inference may run.
Application inference profiles wrap a model with your own tags so you can track usage and cost per team or app.
Service tiers set per request: Priority (fastest, premium price), Standard (default), Flex (discounted for work that can wait) and Reserved (committed tokens-per-minute capacity). Batch inference handles large offline jobs at lower cost.
Multi-account patterns
Central AI platform (gateway) account: workloads call an API in a shared account that holds model access, Guardrails, logging and quotas; consumers get access through API Gateway, PrivateLink or cross-account roles. Gives one place to govern and meter usage.
Decentralized: each workload account calls Bedrock directly, governed by SCPs (allowed models and Regions), Guardrails and organization-wide model invocation logging to CloudWatch Logs or S3.
Quotas are per account and Region, so spreading load across accounts or using cross-Region inference raises available throughput.
SageMaker AI inference options
Option
Fits
Real-time endpoint
Steady, low-latency traffic; auto scaling, GPUs, multi-model endpoints and inference components to pack models
Serverless inference
Spiky or intermittent traffic, cold starts acceptable; up to 6 GB memory, no GPUs, no VPC configuration
Asynchronous inference
Payloads up to 1 GB and processing up to 1 hour; requests queue, results go to S3 with SNS notifications; can scale to zero
Batch transform
Scoring whole datasets offline with no endpoint left running
How to choose
Scenario wording
Choose
“Use a foundation model with no infrastructure”
Amazon Bedrock
“Host a custom or open-weights model we trained”
SageMaker AI endpoint (or Bedrock Custom Model Import where supported)
“Model calls must not traverse the internet”
Bedrock interface VPC endpoint
“Track model spend per business unit”
Application inference profiles with cost allocation tags
“Large video or document payloads, minutes to process”
SageMaker AI asynchronous inference
“Infrequent traffic, pay nothing when idle, CPU model”
SageMaker AI serverless inference
“Centrally enforce guardrails for all teams”
Central AI gateway account
Common traps
Serverless inference for a GPU model or one that must run in a VPC.
Real-time endpoints for nightly scoring, which keeps instances running all day.
Proposing Comprehend, Textract or other individual AI services, which aren’t in the SAP-C03 service list; use Bedrock or SageMaker AI.
Fine-tuning a model when the problem is missing company knowledge (that’s RAG).
Cross-Region inference profiles that span geographies when the data must stay in one.
A car maker's dealer portal generates marketing text from vehicle specifications with Amazon Bedrock. Twelve application accounts, each with its own VPC, call the Bedrock runtime API, and the marketing team has approved only Bedrock-hosted foundation models.
The security team requires that these calls never cross the public internet, and every call must appear in the audit logs. The network team wants to avoid running a separate endpoint and DNS setup in each of the twelve VPCs.
Which solution meets these requirements at the LOWEST cost?
Choose one answer.
AA. Give each application VPC a NAT gateway and call the public Bedrock endpoint, limiting callers with IAM policies.
BB. Create an interface VPC endpoint for the Bedrock runtime in each application VPC, with an endpoint policy that limits the approved model ARNs.
CC. Create one interface VPC endpoint for the Bedrock runtime in a shared services VPC that the application VPCs reach through a transit gateway, with a private hosted zone that resolves the service name to it.
DD. Host comparable open-weight models on Amazon SageMaker AI real-time endpoints inside each application VPC, and have the portal call those endpoints over private subnets so that no request leaves the VPC or reaches the internet.
Show the answer and explanation
Answer: C
A. Wrong: The calls leave the VPC through a NAT gateway and travel over the public endpoint, which breaks the requirement that they never cross the internet. Adding IAM controls does not change the path.
B. Wrong: Interface endpoints keep traffic private, and endpoint policies can limit the models. Creating one endpoint in each of the twelve VPCs multiplies the hourly and data charges, and it adds a DNS setup to every VPC.
C. Right: Correct. One shared endpoint keeps the calls on private addresses and avoids paying for an endpoint in every VPC. The private hosted zone lets each application resolve the Bedrock runtime name to that shared endpoint.
D. Wrong: The calls stay private, but the marketing team approved only Bedrock-hosted foundation models. Running separate SageMaker AI endpoints in twelve accounts also adds hosting and operating work.
Explanation
A single shared interface endpoint, reached over the transit gateway with a private hosted zone, keeps the calls private and avoids duplicate endpoint charges. NAT routing uses the public endpoint, and per-VPC endpoints or self-hosted models break the cost or model requirements.
Want more on Generative AI and ML inference (Bedrock, SageMaker AI endpoints)? The 5 full-length practice sets have 5 more Generative AI and ML inference (Bedrock, SageMaker AI endpoints) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Generative AI and ML inference (Bedrock, SageMaker AI endpoints)