AWS Certified Generative AI Developer – Professional: study guide and free practice questions The ideas the Generative AI Developer – Professional (AIP-C01) exam tests, one page each: what the Amazon Bedrock docs say, the traps the questions set, and real practice questions to try. Every page links to the AWS pages it was written from.
Topics Foundation Model Integration, Data Management, and Compliance Implementation and Integration AI Safety, Security, and Governance Operational Efficiency and Optimization for GenAI Applications Testing, Validation, and Troubleshooting 10 free practice questions Drawn from every domain. Pick an answer to see why each option is right or wrong.
A company hosts a fine-tuned LLM on an Amazon SageMaker AI real-time endpoint that extracts fields from contracts. The inference container reads each request body as JSON. By default, the container returns the extracted fields as JSON. Its output serializer can also return the fields as CSV rows when a request asks for text/csv output.
A new reporting service sends one contract at a time and must receive each result as CSV within a few seconds, so that it can load the rows straight into spreadsheets. The company does not want to change the container or deploy another endpoint.
Which solution will meet these requirements? Right. In the game that’s Renown for your Foundation Model Integration, Data Management, and Compliance building.
Not that one: A is right. In the game your Foundation Model Integration, Data Management, and Compliance building would lose a little Renown, and this question would come back later.
The answer A. Call the InvokeEndpoint API with ContentType set to application/json and Accept set to text/csv. Load the response body into the spreadsheets.InvokeEndpoint carries two MIME types, one for each direction. Your answer B. Call the InvokeEndpoint API with ContentType set to text/csv and Accept set to application/json. Load the response body into the spreadsheets.ContentType describes the request body and Accept the response, so this swaps them: the container would be told the JSON body is CSV and asked for JSON back. Your answer C. Run a SageMaker AI batch transform job on the model with Accept set to text/csv. Load the output files from Amazon S3 into the spreadsheets.Batch transform does honour an output type, but it runs as a job over files in Amazon S3. The reporting service needs each contract's answer within seconds. Your answer D. Call the InvokeEndpoint API with ContentType set to application/json and with text/csv in the CustomAttributes value. Load the response body into the spreadsheets.CustomAttributes is an opaque value that SageMaker AI forwards verbatim; the container picks its output format from Accept, so the response stays JSON unless the container code is changed to read the attribute.
Show the full explanation and doc quotes The InvokeEndpoint reference defines ContentType as "The MIME type of the input data in the request body." and Accept as "The desired MIME type of the inference response from the model container." The request body is JSON and the reporting service wants CSV back, so ContentType is application/json and Accept is text/csv. The container already supports that output, so nothing is redeployed.
Written from docs.aws.amazon.com/sagemaker/latest/APIReference/API_runtime_InvokeEndpoint.html
A law firm reviews supplier contracts with a Claude model in Amazon Bedrock. An AWS Lambda function reads each contract PDF from Amazon S3 and sends it to the Converse API in a document content block, with a prompt that asks for a list of risky clauses.
Most contracts are 40 to 80 pages long and are reviewed correctly. Requests for the longest contracts, which run from 150 to 300 pages, fail with a ValidationException. The firm must review every clause of each long contract and wants to keep the current model and prompt.
Which solution will meet these requirements with the LEAST operational overhead? Right. In the game that’s Renown for your Implementation and Integration building.
Not that one: B is right. In the game your Implementation and Integration building would lose a little Renown, and this question would come back later.
Your answer A. Raise the maxTokens value in the inferenceConfig of each Converse request to the maximum that the model allows. Send each long contract in one request so that the model can read the whole document.More output tokens let the model write a longer answer, but the request is rejected because of the size of the PDF going in. Nothing about the input changes. The answer B. Split each contract that is longer than 100 pages into PDF files of fewer than 100 pages each. Review each part in its own Converse request with the same prompt, and combine the clause lists.The failures come from a per-request limit on PDF documents for Claude models. The API restrictions page (https://docs.aws.amazon.com/bedrock/latest/userguide/inference-api-restrictions.html) says: "Claude requires PDF documents to be a maximum of 100 pages per request. If you have larger PDF documents, we recommend splitting them into multiple PDFs under 100 pages each or consolidating more text into fewer pages." Your answer C. Ingest the contracts into an Amazon Bedrock knowledge base. Call the RetrieveAndGenerate API with the same prompt so that the model receives the contract passages that best match the request.A knowledge base finds the passages closest to the question. A contract review needs every clause, and a clause that is not retrieved is never checked. Your answer D. Send each long contract to the InvokeModel API instead of the Converse API. Pass the whole PDF as a base64-encoded document in the Anthropic Messages request body, together with the same prompt.Changing the API does not change the model. Claude takes at most 100 pages of PDF per request on either API, so the long contracts fail the same way.
A company is creating an Amazon Bedrock knowledge base that uses a Pinecone index as its vector store. Amazon Bedrock needs the Pinecone API key to write to and query the index.
The security team requires that the API key never appear in plain text in code, templates, or resource configurations. The API key must also be replaced with a new Pinecone API key every 30 days without manual steps.
Which combination of steps will meet these requirements?
(Select TWO) Right. In the game that’s Renown for your AI Safety, Security, and Governance building.
Not that one: B,D is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.
Your answer A. Turn on automatic rotation for the customer managed AWS KMS key that encrypts the stored API key, so that the key material changes on a schedule.Rotating the KMS key material re-encrypts nothing in Pinecone; the Pinecone API key itself stays the same. Your answer B. Store the API key in an AWS Secrets Manager secret under the apiKey key. Enter the secret ARN in the credentials secret ARN field of the knowledge base.Your answer C. Store the API key as a SecureString parameter in AWS Systems Manager Parameter Store. Enter the parameter ARN in the vector store configuration of the knowledge base.The knowledge base takes the Pinecone API key through AWS Secrets Manager, not through a Parameter Store parameter. Your answer D. Turn on automatic rotation for the secret every 30 days with a Lambda function that creates and stores a new Pinecone API key.Your answer E. Store the API key in an Amazon S3 object that is encrypted with SSE-KMS. Enter the S3 URI of the object in the vector store configuration of the knowledge base.The knowledge base reads the Pinecone credentials from a Secrets Manager secret ARN, not from an S3 object.
A company exposes an FAQ assistant through an Amazon API Gateway REST API. Its mobile app offers 300 suggested questions, and each question has a stable question ID. The app sends the chosen question in the JSON body of a POST request, and a Lambda function calls an Amazon Bedrock model to answer it. Most traffic repeats the same suggested questions. The company wants to stop invoking the model for a suggested question that was already answered in the last hour. The company can change the requests that the app sends.
Which solution will meet these requirements? Right. In the game that’s Renown for your Operational Efficiency and Optimization for GenAI Applications building.
Not that one: B is right. In the game your Operational Efficiency and Optimization for GenAI Applications building would lose a little Renown, and this question would come back later.
Your answer A. Enable API Gateway caching on the stage with a 1-hour TTL, and override the method settings of the POST method to turn on caching for it. Keep the question in the JSON request body.The question sits in the body, and API Gateway builds its cache key from headers, paths, and query strings, so it cannot tell questions apart. The answer B. Add a GET method that takes the question ID as a query string parameter, and set that parameter as the cache key. Enable stage caching with a 1-hour TTL, and change the app to call the GET method.Two documented behaviors decide it. CloudFront "always caches responses to GET and HEAD requests" and "does not cache responses to requests that use the other methods", so a POST API gets no edge caching. API Gateway can "use a method or integration parameter as cache keys to index cached responses. This includes custom headers, URL paths, or query strings." A GET method with the question ID as a query string cache key caches each answer separately. Your answer C. Enable prompt caching in the Converse requests from the Lambda function, and add a cache checkpoint after the system prompt. Keep the POST requests from the app and the JSON request body unchanged.Prompt caching reuses a prompt prefix inside each model call; the model is still invoked for every question. Your answer D. Create an Amazon CloudFront distribution in front of the API that allows all HTTP methods, and attach a cache policy with a 1-hour TTL. Change the app to send its POST requests to the distribution.CloudFront caches GET and HEAD responses. A POST passes straight through to the API, so nothing is saved at the edge.
A financial services company is testing a refund agent that runs on Amazon Bedrock AgentCore Runtime and emits OpenTelemetry traces. In every refund session, the agent must call the verify_identity tool before it calls the issue_refund tool. The agent is also allowed to call lookup tools, such as get_order, at any point in the session. The company needs an automated evaluation that fails a session when the required tool order is broken. The evaluation must not fail a session because the agent made extra lookup calls.
Which solution will meet these requirements? Right. In the game that’s Renown for your Testing, Validation, and Troubleshooting building.
Not that one: D is right. In the game your Testing, Validation, and Troubleshooting building would lose a little Renown, and this question would come back later.
Your answer A. Run AgentCore Evaluations with the Builtin.TrajectoryExactOrderMatch evaluator. Supply verify_identity followed by issue_refund as the expectedTrajectory ground truth for each session.Exact order is too strict here. A harmless get_order call between the two required tools would fail the session. Your answer B. Run AgentCore Evaluations with the Builtin.Correctness evaluator. Supply the expected refund confirmation message as the expectedResponse ground truth for each trace.Correctness judges the final answer against an expected response and says nothing about which tools ran or in what order. Your answer C. Run AgentCore Evaluations with the Builtin.TrajectoryAnyOrderMatch evaluator. Supply verify_identity followed by issue_refund as the expectedTrajectory ground truth for each session.Any order is too loose. It would pass a session that refunded first and checked identity afterwards. The answer D. Run AgentCore Evaluations with the Builtin.TrajectoryInOrderMatch evaluator. Supply verify_identity followed by issue_refund as the expectedTrajectory ground truth for each session.The requirement is order with room for extra calls. The AgentCore ground truth page describes Builtin.TrajectoryInOrderMatch as: "Checks that all expected tools appear in order within the actual sequence, but allows extra tools between them."
A company's GenAI support assistant stores each conversation turn as an item in an Amazon DynamoDB table. The partition key is session_id, and the sort key is the time that the turn was written. Before each call to the FM, an AWS Lambda function queries the turns of the session and adds them to the prompt.
A new privacy policy says that a turn must never be added to a prompt more than 24 hours after it was written. Old turns must be deleted from the table automatically without consuming write capacity, and the company does not want to run a scheduled deletion job.
Which solution will meet these requirements? Right. In the game that’s Renown for your Foundation Model Integration, Data Management, and Compliance building.
Not that one: C is right. In the game your Foundation Model Integration, Data Management, and Compliance building would lose a little Renown, and this question would come back later.
Your answer A. Create an Amazon EventBridge schedule that invokes a Lambda function every hour to delete turns older than 24 hours with BatchWriteItem. Query the turns of the session with only the session_id key condition, and add every returned turn to the prompt.This is the scheduled deletion job the company does not want, its deletes consume write capacity, and turns can reach the prompt for up to an hour after 24 hours. Your answer B. Enable TTL on an expires_at attribute, and write each turn with expires_at set 24 hours after the write time in Unix epoch seconds. Query the turns of the session with only the session_id key condition, and add every returned turn to the prompt.TTL is the right way to delete old turns, but it deletes them days late, not on the second, so the prompt still gets expired turns. The answer C. Enable TTL on an expires_at attribute, and write each turn with expires_at set 24 hours after the write time in Unix epoch seconds. Query the turns of the session with a filter expression that keeps only turns whose expires_at is later than the current time.TTL deletion is not immediate. The TTL page (https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/TTL.html) says "DynamoDB automatically deletes expired items within a few days of their expiration time, without consuming write throughput." and "Items with valid, expired TTL attributes might be deleted by the system at any time, typically within a few days after their expiration." Its instruction for reads is "Use filter expressions to remove expired items from Scan and Query results." So TTL handles the deletion, and the filter on expires_at keeps turns older than 24 hours out of the prompt. Your answer D. Enable TTL on an expires_at attribute, and write each turn with expires_at set 24 hours after the write time in Unix epoch seconds. Query the turns of the session with ConsistentRead set to true, and add every returned turn to the prompt.A strongly consistent read returns what is in the table, and an expired turn is still in the table until TTL deletes it.
A company has 40 teams that build agents and MCP servers on Amazon Bedrock AgentCore Runtime. Teams often rebuild tools that already exist because they cannot find what other teams have published.
The company wants one catalog of its agents, MCP servers, and tools. A platform team must approve each entry before other teams can discover it. Developers must be able to search the catalog by exact name or by a description of a task, and agents must be able to query the catalog through MCP.
Which solution will meet these requirements with the LEAST operational overhead? Right. In the game that’s Renown for your Implementation and Integration building.
Not that one: D is right. In the game your Implementation and Integration building would lose a little Renown, and this question would come back later.
Your answer A. Store a description file for each agent and MCP server in an Amazon S3 bucket that is the data source of an Amazon Bedrock knowledge base. Have the platform team review each file before a sync, and let developers and agents query the knowledge base.A knowledge base returns document passages. The company would build and run its own review and publishing process, and agents would query it through the Retrieve API rather than MCP. Your answer B. Create an AWS Service Catalog portfolio with one product for each agent and MCP server. Have the platform team add each approved product to the portfolio, and share the portfolio with the accounts of every team.A Service Catalog portfolio governs which products teams can launch. It offers no search by task description and no MCP endpoint for agents. Your answer C. Create one Amazon Bedrock AgentCore Gateway, and add each team's MCP servers to it as targets. Turn on semantic search for the gateway so that developers and agents can find the tools through the gateway's MCP endpoint.A gateway exposes tools for agents to call. It does not catalog agents, and it has no approval workflow for entries that other teams can discover. The answer D. Create a registry in AWS Agent Registry with approval turned on. Have each team publish records for its agents and MCP servers for the platform team to approve. Developers search the registry, and agents connect to its MCP endpoint.AWS Agent Registry is the managed catalog for this. The registry page (https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/registry.html) says: "AWS Agent Registry is a fully managed discovery service that provides a centralized catalog for organizing, curating, and discovering resources across your organization."
Show the full explanation and doc quotes It lets teams publish MCP servers, tools and agents, "control access through an approval workflow, and enable both human users and AI agents to discover the right tools and agents through hybrid search, catalog browsing, and a native MCP endpoint."
Written from docs.aws.amazon.com/bedrock-agentcore/latest/devguide/registry.html
A bank customizes an Amazon Nova model by running an Amazon Bedrock model customization job. The training data is in an Amazon S3 bucket in the same AWS Region.
The security team requires the job's traffic to the data to flow through the bank's VPC so that the team can monitor it with VPC Flow Logs. The VPC's private subnets have no route to the internet, and the team will not add one. The job must read the training data from Amazon S3 and write the model artifacts to Amazon S3.
Which combination of steps will meet these requirements?
(Select TWO) Right. In the game that’s Renown for your AI Safety, Security, and Governance building.
Not that one: B,E is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.
Your answer A. Create a NAT gateway in a public subnet of the VPC. Add a default route from the private subnets to the NAT gateway so that the job can reach the training data in Amazon S3.This connects the job to S3, but through the internet path that the team said it will not add. Your answer B. Specify the private subnets and a security group in the vpcConfig of the CreateModelCustomizationJob request. Let the service role of the job create network interfaces in the VPC.Your answer C. Add a bucket policy to the training data bucket that denies requests that do not come from the VPC. Use the aws:sourceVpc condition key in the policy.A bucket policy only restricts access; without an S3 endpoint the job in the VPC still has no path to the bucket. Your answer D. Create an interface VPC endpoint for the bedrock-runtime service in the private subnets of the VPC. Enable private DNS on the endpoint so that the job can use it.The bedrock-runtime endpoint carries inference calls from the VPC to Amazon Bedrock; it gives the job no path to Amazon S3. Your answer E. Create a gateway VPC endpoint for Amazon S3 in the VPC. Associate the endpoint with the route tables of the private subnets that the job uses.
Show the full explanation and doc quotes The customization security page (https://docs.aws.amazon.com/bedrock/latest/userguide/custom-model-job-access-security.html) says "When you submit a CreateModelCustomizationJob request, you can include a VpcConfig as a request parameter to specify the VPC subnets and security groups to use". The Amazon S3 page (https://docs.aws.amazon.com/bedrock/latest/userguide/vpc-s3.html) adds: "If you configure your VPC with no internet access, you need to create an Amazon S3 VPC endpoint to allow your model customization jobs to access the S3 buckets that store your training and validation data and that will store the model artifacts."
Written from docs.aws.amazon.com/bedrock/latest/userguide/vpc-s3.html
A company runs a GenAI support assistant that writes application logs to an Amazon CloudWatch Logs log group. The logs contain INFO and ERROR lines for model calls, tool calls, and response parsing. After earlier prompt changes, new kinds of error messages appeared and some existing messages suddenly became much more frequent. The team noticed each problem days later.
The log group must be monitored continuously so that new or unusually frequent log patterns are flagged automatically. An alarm must notify the on-call engineer. The team does not want to define each error message in advance.
Which solution will meet these requirements with the LEAST operational overhead? Right. In the game that’s Renown for your Operational Efficiency and Optimization for GenAI Applications building.
Not that one: C is right. In the game your Operational Efficiency and Optimization for GenAI Applications building would lose a little Renown, and this question would come back later.
Your answer A. Create a metric filter for each known ERROR message in the log group. Create a CloudWatch alarm on each metric, and notify the on-call engineer through Amazon SNS.Metric filters match only messages that the team defines in advance, so a new kind of error message raises no alarm. Your answer B. Run a CloudWatch Logs Insights query each morning that compares the log patterns with the previous day. Have an engineer review the new and changed patterns that the query reports.A daily comparison query finds new patterns only when someone runs and reviews it, so it is not continuous and raises no alarm. The answer C. Create a log anomaly detector for the log group. Create a CloudWatch alarm on the anomaly metrics that the detector publishes, and notify the on-call engineer through Amazon SNS.A log anomaly detector learns the log group's normal patterns on its own. The CloudWatch Logs page (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/LogsAnomalyDetection.html) states: "A log anomaly detector scans the log events ingested into a log group and finds anomalies in the log data automatically. Anomaly detection uses machine-learning and pattern recognition to establish baselines of typical log content." Your answer D. Create a CloudWatch alarm with anomaly detection on the InvocationClientErrors metric of Amazon Bedrock. Notify the on-call engineer through Amazon SNS when the metric leaves its band.The Bedrock metric counts only model invocations that fail with client-side errors, not tool call or parsing errors in the application logs.
A company runs GenAI applications in five workload accounts in AWS Organizations. All the applications call Amazon Bedrock in the us-east-1 Region. The operations team works in a separate central account.
The team needs one view of the Invocations, InvocationLatency, and InvocationThrottles metrics of all five accounts, with graphs that compare the accounts. The team must also create alarms on these metrics from the central account. The team does not want to copy metric data between accounts.
Which solution will meet these requirements with the LEAST operational overhead? Right. In the game that’s Renown for your Testing, Validation, and Troubleshooting building.
Not that one: D is right. In the game your Testing, Validation, and Troubleshooting building would lose a little Renown, and this question would come back later.
Your answer A. Create a CloudWatch dashboard in each workload account that graphs its own Amazon Bedrock metrics, and share each dashboard with the central operations team. Create the alarms in each of the five workload accounts.Each dashboard shows one account, so the team cannot compare accounts on one graph or alarm from the central account. Your answer B. Create a CloudWatch metric stream in each workload account that sends metrics through Amazon Data Firehose to a central-account S3 bucket. Query it with Amazon Athena, and graph it in Amazon Quick Sight.Metric streams copy the metric data into the central account, and Athena and Quick Sight provide no CloudWatch alarms. Your answer C. Create an organization trail in AWS CloudTrail that delivers the Amazon Bedrock API events of all accounts to the central account. Build graphs and alarms from the events with CloudWatch Logs metric filters.API call events carry no invocation latency, and the trail copies data into the central account, which the team wants to avoid. The answer D. Set up CloudWatch cross-account observability with the central account as the monitoring account and the five workload accounts as source accounts. Build a dashboard there that graphs the source accounts' metrics, and create the alarms there.CloudWatch cross-account observability is built for a central operations account.
Show the full explanation and doc quotes The dashboards page (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html) says that with it you can "Search, view, and create graphs of metrics that reside in source accounts. A single graph can include metrics from multiple accounts." and "Create alarms in the monitoring account that watch metrics in source accounts." Linking the five workload accounts as source accounts gives one dashboard that compares them, with alarms in the central account and no copied data.
Written from docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html
Certopolis is an independent study game. It is not affiliated with, endorsed by or sponsored by Amazon Web Services, and its questions are not the exams' questions. Exam names are trademarks of their owners.