Mock Exam 2: every answer explained.

Why C

A three-way split separates the data the model is fitted on, the data used to make choices about the model, and the data used to judge the result. Because the validation set was consulted eleven times, the score on it is optimistic — the choices have been fitted to it. The test set is scored once, after the final variant is fixed, so it estimates how the model will behave on data nobody has optimised against. Option A would let the model learn from the held-out rows, which destroys the measurement it exists to provide. Option B inverts the two roles: choosing hyperparameters is exactly what the validation set is for. Option D would pick whichever split flatters the model, which is not a measurement at all.

Why C

Chunk size and overlap decide how much usable context each retrieved unit carries. A 200-token chunk with no overlap severs procedures and strips the introductory sentence from any step that starts near a boundary, so the model is handed a fragment and answers from it. A larger chunk plus a modest overlap places boundary-spanning text in both neighbours, so whichever chunk is retrieved still reads coherently on its own. Option A shrinks the unit further and multiplies the fragmentation. Option B collapses a whole article into one averaged vector, which blurs many distinct topics together and retrieves the article for questions it barely covers. Option D changes the generator, not the broken fragments it is being given.

Why C

AWS groups responsible AI into named dimensions, and controllability is the one concerned with having mechanisms to monitor, guide and if necessary stop an AI system once it is running: override paths, escalation routes and an off switch. That is precisely what the reviewers say is missing. Option A, veracity and robustness, is about whether outputs are correct and stay reliable under unusual or adversarial conditions. Option B, transparency, is about making enough information available that stakeholders can judge a system and their interactions with it. Option D, governance, covers the policies, roles and oversight processes an organisation builds around its AI programme, not the runtime controls over one deployed system.

Why A

Supervised image classification needs a label on every image, and 90,000 unlabelled photographs are the blocker. A multimodal foundation model on Amazon Bedrock can look at each photograph and choose one of the six damage types named in its prompt, and Amazon Bedrock batch inference runs the whole collection as one asynchronous job that reads its input from and writes its output to Amazon S3, so the team builds no annotation tooling and recruits no annotators. The supervisors' spot checks on a random sample measure label quality and catch a consistently confused damage type before training starts. Option B still requires labelled examples before it can train a custom model, so it does not solve the problem it is offered for. Option C stores, versions and approves trained models; it has no labelling function and no concept of an image label. Option D classifies text, not images, and would itself need a labelled training sample before it could run. Amazon SageMaker Ground Truth, the managed human-labelling service this need once pointed to, closed to new customers on 30 July 2026.

Why A

Isolation has to happen at retrieval, before any text reaches the model. Because each chunk already carries its client identifier as metadata, attaching a filter on that field to every query makes another tenant's chunks ineligible to be returned at all, which is a configuration change rather than a re-architecture. Option B relies on the model obeying an instruction about data it can already see, which is not an access control and fails the moment the model is persuaded otherwise. Option C only makes a leak less frequent, not impossible. Option D does isolate tenants, but it multiplies ingestion, syncing and cost by sixty and is far more redesign than the requirement calls for.

Why A

IAM allows an action to be scoped to specific resources, and Amazon Bedrock models have ARNs, so a policy permitting bedrock:InvokeModel only on the two approved model ARNs makes a call to any other model fail at the API, with no human review in the loop. Option B grants everything and detects misuse after the fact; CloudTrail records the calls but does not prevent them. Option C blocks Amazon Bedrock outright, which stops the approved work as well. Option D misunderstands guardrails: a guardrail filters the content of prompts and responses for topics, words and sensitive data on the model it is applied to, and it has no say in which model a caller is permitted to invoke.

Why D

Deriving tenure from a timestamp, one-hot encoding a categorical tariff name and rescaling a numeric reading are all transformations of raw columns into inputs an algorithm can learn from, which is the definition of feature engineering. It sits between data preparation and model training, and it is usually where the largest accuracy gains on tabular problems come from. Option A searches the settings that govern how training runs, and it happens only once the features already exist. Option B scores a trained model against held-out data and produces metrics, not columns. Option C watches an already deployed model for drift and degradation. None of those three changes the shape or encoding of the input data.

Why D

Semantic search compares meaning, which is why it handles paraphrase well and handles rare literal strings such as part numbers, error codes and SKUs badly: two similar identifiers sit close together in embedding space. Hybrid search runs a keyword match in parallel with the vector match and merges the results, so an exact token like XR-4410-B is found on its literal form. Option A changes randomness in the output and cannot influence which documents were retrieved. Option B floods the prompt with 50 near-identical part pages and still may not include the exact one. Option C confuses the embedding model's input limit with its ability to match literal identifiers.

Why B

AWS AI Service Cards are AWS's own responsible-AI documentation for individual AI services and models: each card sets out intended use cases, design and testing choices, known limitations, and best practices for deployment and performance optimisation. That is exactly the material a review board needs before adopting a managed service. Option A inverts the relationship, because Amazon SageMaker model cards are where a customer documents a model it has built and trained itself, not something AWS publishes about its own services. Option C, AWS Artifact, is the portal for compliance reports and agreements such as SOC and ISO, which say nothing about a model's limitations. Option D describes parameters and syntax, not behaviour.

Why B

A hyperparameter is a value chosen before training that controls how training proceeds; learning rate, number of trees and maximum depth are the textbook examples, and an automatic tuning job searches over exactly these. A parameter is a value the algorithm learns from the data during training, such as the split threshold stored at each node, which no human sets directly. Option A uses storage location as the test, which is not what separates the two ideas. Option C reverses the terms outright. Option D is wrong because a tuning job can only search hyperparameters — learned thresholds are an output of training, never an input to it.

Why A and D

A retrieval pipeline has two failure points and they need separate measures. Faithfulness scores the generation step by asking whether each claim traces back to a retrieved passage, which is what catches invented figures. Context recall scores the retrieval step by asking whether the passages needed to answer were fetched at all, which is what catches the missing figure. Option B measures how well a model predicts general text and says nothing about either step. Option C is a cost and capacity figure, not a quality one. Option E is a translation metric based on n-gram overlap with references, and this task has no reference translations to compare against.

Why D

Only a customer managed AWS KMS key gives the organisation ownership of the key policy, the rotation schedule and the ability to disable or schedule deletion of the key. Because the custom model is encrypted with that key, revoking it makes the model unusable, which is the control the policy demands. Option A is true as far as it goes, since Amazon Bedrock encrypts custom models by default, but a service-owned key cannot be controlled or revoked by the customer. Option B protects the training data while leaving the derived model, which carries the same information, outside the bank's key control. Option C confuses access control with encryption: bucket settings and IAM policies give nobody control of a key.

Why C

Training accuracy of 61 percent sits barely above test accuracy of 60 percent and both are poor, which is the signature of underfitting: the model is too simple to capture the pattern, so it performs badly everywhere rather than only on unseen data. A linear model against sharply seasonal demand is that situation exactly. The remedy is more capacity, or features such as month and promotion flags that make the pattern learnable. Option A treats the opposite condition, where a high training score sits far above a low test score, and regularisation would make this model simpler still. Option B assumes a deployed model whose incoming data has shifted, which is not in evidence. Option D would show as an unusually high test score, not a low one.

Why B

Vector search is optimised for fast approximate recall across a large index, so it reliably gets the right passage into a candidate set but orders that set crudely. A re-ranking model reads each candidate together with the question and scores relevance directly, which is slower but far more accurate, and is applied only to the shortlist. Passing the top few reranked passages raises precision without losing recall. Option A retrieves four times as much noise and worsens the same problem. Option C makes the wording more deterministic but does not change which passages were supplied. Option D frees tokens without improving the relevance or ordering of what fills them.

Why A

Automated Reasoning checks are the Amazon Bedrock Guardrails policy that applies formal logic rather than probability: the team encodes the rulebook as variables and rules, and each response is checked against that model, returning a finding about whether the statement is valid, invalid, or outside the encoded scope. Option B, contextual grounding, tests whether a response is grounded in the retrieved passage and relevant to the query; useful, but it scores a response rather than proving consistency with a rule. Option C requires the team to enumerate every ineligible case by hand and blocks topics instead of checking reasoning. Option D filters harmful content, which is not the failure described.

Why D

With 0.8 percent positives, always predicting the majority class scores above 99 percent accuracy while catching almost no fraud, so accuracy is worthless on this problem. The F1 score is the harmonic mean of precision and recall, so it falls when missed fraud rises and also when false alarms rise, which is the single balanced figure leadership asked for. Option A is the trap the scenario spells out. Option B is a regression metric for continuous targets and is not defined for a class label in any useful way. Option C measures how well optimisation converged on the training data, which says nothing about behaviour on unseen transactions or about the minority class.

Why C

Two techniques solve the two complaints at once. Role prompting states plainly who the model is acting as, which anchors register and scope instead of leaving the model to default to a generic assistant. A template with named variables keeps the surrounding wording identical for everyone while letting per-request values be substituted, so tone stops drifting with whoever last edited the text. Option A increases randomness, which widens the tone variation the team is trying to remove. Option B hands the one stable part of the system to the model to reinvent each session. Option D is an expensive customisation that entrenches the inconsistency between teams rather than resolving it.

Why C

Amazon Bedrock processes a request in the Region in which it is called, so residency is achieved by keeping both the data store and the model invocation in an EU Region, which makes model availability by Region part of the design decision. Option A confuses confidentiality with location: encryption protects the data but does not change which country processes it. Option B is the opposite of what a residency rule allows, because a cross-Region inference profile deliberately routes requests to other Regions, so an EU workload needs a profile scoped to the EU geography or none at all. Option D leaves the records in the EU but sends every prompt containing them abroad for processing.

Why A

The deciding requirement is a metric expressed in the target's own unit. Mean absolute error averages the absolute difference between predicted and actual demand, so it is reported in megawatt-hours and reads directly as a typical miss that operations staff can compare against the day's total. Option B squares each error first, so the result is in squared megawatt-hours and cannot be read as a demand figure; it also weights a handful of large misses far more heavily than the brief asked for. Options C and D are classification metrics: area under the ROC curve summarises class separation across thresholds, and F1 balances precision and recall. Neither is defined for a continuous numeric prediction.

Why A

An embedding's dimensionality is simply how many numbers represent each chunk. Fewer dimensions means a smaller index, cheaper storage and faster similarity search, at the cost of a coarser representation that can blur fine distinctions between passages, so this is a deliberate cost-versus-recall trade-off rather than a free optimisation. Option B confuses the embedding vector's width with the generation model's context window; the two are unrelated. Option C states the trade-off backwards, since compression discards information rather than noise. Option D is the trap worth remembering: changing the embedding model or its dimension means the whole corpus must be re-embedded, because vectors of different shapes are not comparable.

Why B

The image model embeds an invisible, tamper-resistant watermark in every image it creates, and Amazon Bedrock offers watermark detection that reports whether an image carries it. Because the mark is designed to survive ordinary alterations such as resizing and cropping, it answers the question for an image already in circulation. Option A is defeated by a crop and degrades the creative work. Option C is a useful provenance record, but it can only be searched by request, not by presenting an arbitrary image found on a partner's site. Option D relies on S3 object metadata that exists only inside the bucket and is lost the moment the file is downloaded and reposted.

Why B

Reinforcement learning is the paradigm in which an agent takes actions in an environment and improves a policy from reward and penalty signals rather than from labelled examples. A simulator that rewards speed and penalises collisions is precisely a reward function, and the absence of any dataset of correct routes rules out the label-driven paradigms. Option A needs input and output pairs with known correct answers, which the team explicitly cannot produce. Option C finds structure such as clusters in unlabelled data and has no notion of a good or bad action. Option D still depends on a labelled subset to anchor the unlabelled majority, and there is no labelled subset here.

Why B

Amazon Bedrock Knowledge Bases is the managed retrieval layer here: it reads the documents from the bucket, chunks them, calls an embedding model, maintains the vector store and returns the relevant passages to the model, so a small team gets retrieval-augmented generation without running a pipeline. Option A is that same pipeline built by hand, leaving chunking, embedding and relevance tuning for the team to operate. Option C adds a separate enterprise search deployment to provision, size and pay for, and on its own it only returns passages, so the team would still write and operate the code that passes them to the model; Amazon Kendra has also been closed to new customers since 30 July 2026. Option D does no semantic matching: S3 Select filters rows inside one structured object and cannot rank prose by meaning.

Why B and E

Two complementary controls apply. Network isolation is the Amazon SageMaker setting that runs the training container with no outbound network access at all, so nothing inside the job can call out even if a dependency tries. Placing the job in private subnets with no NAT gateway removes the route to the internet at the network layer, and an Amazon S3 VPC endpoint keeps the data path on the AWS network. Option A still has a route to the internet, because restricting the protocol to HTTPS does not remove it. Option C is a monitoring feature for training metrics and tensors, not an egress control. Option D protects the bucket from anonymous readers but says nothing about what the container may connect to.

Why D

Transfer learning reuses a model already trained on a large general dataset and adapts it to a smaller related task, typically by keeping the early layers that learned generic edges, textures and shapes and retraining only the final layers on the new labels. With 4,000 images that is far more effective than learning every weight from scratch. Option A manufactures extra training examples by rotating, cropping or adjusting the existing images; it helps with small datasets but does not describe starting from a pre-trained network. Option B trains several models independently and combines their votes, which does not address the shortage of labels. Option C groups unlabelled data and produces no classifier at all.

Why B and C

Perceived latency is dominated by time to first token, not by total generation time. Streaming lets the interface display words as they are produced, so the wait shrinks to a fraction of a second even when the full answer takes the same time overall. Choosing a smaller model for requests that evaluation shows it handles correctly cuts the real generation time as well, and lowers cost. Option A lengthens answers and therefore makes the wait worse. Option D controls randomness in token selection and has no bearing on speed. Option E governs how much text can be supplied in one request; it does not accelerate generation and a larger window often accompanies a slower, costlier model.

Why D

Red-teaming is the deliberate adversarial testing of a system before launch: a team acts as an attacker or bad-faith user, probing for harmful, biased, unsafe or policy-violating behaviour, and the findings feed the guardrails, the system prompt and the launch criteria. It is the only listed activity that produces evidence about misuse. Option A measures more of the same benign accuracy, which says nothing about adversarial behaviour. Option B measures capacity and latency under load, a reliability property. Option C is a reasonable habit, but it is a desk review by the people closest to the system, who are least likely to find the failure modes an outsider would deliberately hunt for.

Why C

Amazon Personalize is the managed recommendation service: the company supplies an interactions dataset, a users dataset and an items dataset, and the service selects and trains a recipe and serves real-time recommendations through a campaign, with no model code written. Option A is an enterprise search service that answers a natural-language query over documents; it ranks documents against a query, not titles against a viewer's history. Option B extracts sentiment, entities and key phrases from text and builds no recommender. Option D would rank titles by keyword relevance, returning the same row to every subscriber, which is search rather than personalisation.

Why D

Embedding models consume text. A scanned PDF is a container of page images, so an ingestion job reads it, finds no extractable characters, and produces an index with nothing meaningful in it, which is exactly the symptom described. Textract performs optical character recognition and also recovers tables and form fields, so its output can then be chunked, embedded and retrieved normally. Option A misdiagnoses a missing-text problem as a model-capacity problem; no embedding model reads pixels as prose. Option B invents a filtering explanation that would show up as blocked responses, not an empty index. Option C tunes a parameter that only matters once there is text to divide in the first place.

Why A and C

The finding is that sensitive data is captured, then retained too long and read too widely. Redacting personal data before it reaches the log destinations means card and account numbers are never stored, and a defined CloudWatch Logs retention period plus an S3 lifecycle rule bounds how long the remaining records live. Option B removes the exposure by destroying the audit trail the stem says must remain. Option D changes the storage class and the bill, not the retention period or who can read the data. Option E tightens filters on harmful content, which is unrelated to personal data sitting in logs. Restricting read access would help as well, but was not among the choices.

Why A

Amazon Lex is the service for building conversational interfaces across voice and text: it models intents such as changing a seat, elicits the slots the intent requires such as a booking reference, manages the multi-turn dialogue, and invokes an AWS Lambda function for fulfilment, with speech recognition and natural-language understanding built in. Option B turns text into speech and has no understanding of what a caller wants. Option C turns speech into text, which is one input step but provides no intent recognition, slot filling or dialogue management. Option D searches enterprise documents and returns relevant passages; it cannot run a booking dialogue or call fulfilment code.

Why C

An agent chooses tools by reading them. Each tool is described by a definition, such as an OpenAPI specification or a function's JSON input schema, and the natural-language summaries of each operation and parameter are what the model reasons over when deciding which call fits the request. A vague, missing or misleading description for the reschedule operation means the agent never recognises it as the right tool, however healthy the underlying Lambda function is. Option A changes randomness in wording, not tool selection. Option B can block content but does not teach the agent what a tool is for. Option D controls how much conversational context carries between sessions, which is unrelated to whether an operation is discoverable.

Why A

ISO/IEC 42001 is the international management system standard for artificial intelligence, structured like ISO 9001 and ISO/IEC 27001, so an organisation can build a conforming AI management system and have an accredited body certify it. Option B is voluntary guidance: the NIST AI Risk Management Framework describes the Govern, Map, Measure and Manage functions and is valuable for structuring risk work, but no one certifies an organisation against it. Option C is legislation, so conformity is a legal obligation that varies by risk tier rather than a certificate an organisation elects to pursue. Option D attests to a service organisation's controls and is not specific to how AI is built or operated.

Why A and C

Sentiment analysis returns positive, negative, neutral or mixed for a document, which answers the first requirement, and named entity recognition extracts spans such as organisations, locations and dates, which answers the second. Both are pre-trained Amazon Comprehend APIs, so neither needs labelled data or a training job. Option B discovers unlabelled themes across a corpus, which is useful exploration but answers neither question the team asked. Option D would require labelling a sample and training a custom model, which the scenario rules out, and would still produce no entities. Option E finds and masks personal data such as names and card numbers, a privacy control rather than an analytics output.

Why A

An agent's output is the end of a chain of decisions, so debugging it requires visibility into the chain rather than the final sentence. With the agent code instrumented through the AWS Distro for OpenTelemetry, AgentCore Observability records a trace for each request whose spans show every step in order: the model calls, which tool was selected, the exact input parameters sent, what the tool returned, and any knowledge-base lookup. That distinguishes a bad parameter from a missing retrieval from a fabricated figure, and the session view ties the trace to the conversation in which the wrong balance appeared. Option B makes the output reproducible without revealing any intermediate step. Option C tunes retrieval breadth before anyone knows retrieval is involved. Option D attempts an expensive fix for an unidentified fault, and would teach the model to recite balances rather than to look them up correctly.

Why C

This is insecure output handling, a named entry in the OWASP Top 10 for LLM applications: the application trusted text produced by a model and injected it into the page, so any markup the model reproduced from a retrieved document executes. The control is the ordinary one for untrusted input, namely encoding or sanitising the output and rendering it through a safe formatter rather than raw HTML. Option A names the wrong layer, because a prompt instruction is advisory and cannot serve as a security boundary. Option B addresses availability, not script execution. Option D misdiagnoses retrieval as training: the article was fetched at query time and never entered the weights, so retraining changes nothing.

Why B and D

Amazon SageMaker Canvas gives a business analyst a visual, no-code workflow: import the CSV from Amazon S3, pick the target column, build the model and inspect predictions without writing a line of code. Canvas builds on Amazon SageMaker Autopilot, which automatically explores candidate algorithms and hyperparameter settings and returns a ranked list of trained candidates, and which can also be driven on its own. Option A stores, versions and approves models on their way to deployment; it trains nothing. Option C creates labelled datasets, but this CSV already carries the outcome column. Option E curates and shares features across teams and presumes an existing engineering workflow.

Why B

A guardrail is a policy object that can be set once on the model configuration the agent uses rather than invoked by hand, so every model call the agent makes, intermediate steps included, passes the same denied topics, sensitive-information filters and word policies, and a new tool inherits the policy without anyone remembering to wire it in. Agent frameworks hosted on Amazon Bedrock AgentCore, such as Strands Agents, take the guardrail identifier and version as part of their Amazon Bedrock model settings. Option A relies on instructions the model may deprioritise under a long or adversarial conversation, and instructions are not an enforced control. Option C duplicates the same policy across every function, so it drifts the first time one is updated and is forgotten on the next function added. Option D leaves intermediate steps unchecked, which is precisely the gap the reviewer named.

Why B

Human-in-the-loop means a person reviews and authorises each individual output before it takes effect, which is what the compliance officer does for every closure letter. Human-on-the-loop means the system acts on its own while people supervise its behaviour in aggregate and intervene when something looks wrong, which is the fraud-blocking arrangement. Option A reverses the two. Option C ignores the fact that no analyst approves individual card blocks, since a real-time block cannot wait for a person, which is exactly why oversight moved to the aggregate view. Option D calls the fraud model fully autonomous, but supervision with the power to intervene is what distinguishes human-on-the-loop from autonomy.

Why B

Foundation models split text into tokens, sub-word chunks that average roughly three quarters of a word in English, and both pricing and context limits are expressed in tokens because that is the unit the model actually consumes and produces. Estimating the bill therefore means estimating input and output tokens, not words. Option A is wrong because billing is not per character; one long word and one short word can each be a single token. Option C describes a numeric vector used for semantic search, which is a separate model's output and never a billing unit for text generation. Option D describes a fixed learned weight inside the model, a property of the model rather than something a request consumes.

Why C and E

Fine-tuning is supervised, so it needs labelled pairs in the expected format: a JSONL file in Amazon S3 where each line carries the input and the target output the model should learn to produce. Quality then beats volume, because a curated, representative sample teaches the style cleanly while a dump of every article teaches the model the newsroom's inconsistencies, and a held-back validation set is what shows whether the job is learning or memorising. Option A describes unlabelled data, which suits continued pre-training, not fine-tuning. Option B applies an inference parameter to training records, where it has no meaning. Option D treats the context window as a tunable setting; it is a fixed property of the model.

Why A

Imported weights become part of the organisation's software supply chain, so the controls are the ones used for any third-party dependency: take the artefacts from the verified publisher, verify checksums, read the licence for the terms it places on commercial use, scan what was downloaded, and test behaviour in an isolated account before production. Option B misstates the shared responsibility model, since AWS operates the infrastructure while choosing and validating an imported model stays with the customer. Option C confuses an open architecture with vetted weights, because training data and learned behaviour are not visible by inspection. Option D filters content at run time and says nothing about provenance.

Why D

The transformer is the architecture behind current large language models, and self-attention is the mechanism that lets every position in the input attend to every other position and weigh their relevance, which is why relationships between distant words survive far better than in the sequential designs that came before. Option A describes convolutional networks, which excel at images and capture local patterns rather than arbitrary long-range word relationships. Option B describes a classical tabular technique with no notion of sequence at all. Option C describes the older recurrent approach the transformer displaced, which processes one step at a time and loses information across long spans.

Why D

When two variants are indistinguishable offline and the deciding measure is a user behaviour, the only reliable evidence comes from real traffic. An A/B test splits users between the variants, holds everything else constant, and compares the business metric over a defined window, which is how a prompt change is tied to acceptance rate rather than to a proxy score. Option A optimises cost while ignoring the stated decision criterion, and cost is not what is being compared here. Option B asks the system under test to grade itself, which produces a preference with no relationship to shopper behaviour. Option C adds randomness to a scoring run, turning a tie into noise rather than into evidence.

Why A and B

The loop is self-reinforcing because the training data is generated by the model's own recommendations: regions shown less produce fewer clicks, which the next retraining reads as lower interest. Reserving impressions for exploration injects data the current ranking would never collect, and monitoring recommendation and engagement distributions by region turns a slow drift into something visible while it is still small. Option C makes the loop turn faster and amplifies the imbalance sooner. Option D changes model capacity, not the biased data it learns from. Option E removes one field while proxies such as postcode and employer remain, and it also destroys the organisation's ability to measure the imbalance.

Why A

Diffusion models are trained to reverse a noising process, so generation starts from random noise and iteratively removes a little estimated noise at each step while the text prompt conditions every step, until an image remains. That step-by-step denoising is exactly the behaviour described, and the step count is the knob the team is setting at 40. Option B describes how a text model generates, predicting one token at a time from the tokens before it, which produces text rather than pixels. Option C turns input into a fixed numeric vector representing meaning and generates nothing at all. Option D fits a line through numeric data and has no generative capability.

Why A

This is a human-in-the-loop requirement: a defined condition diverts an item to a qualified person, the person approves or amends it, and the decision is retained as evidence. A workflow step that pauses on the payout condition provides exactly that structure, for example an AWS Step Functions task that waits for a callback until the adjuster records an approval or amendment, with the reviewer, the outcome and the time written to a durable store that an auditor can inspect. Option B suppresses the draft rather than routing it, so a legitimate large settlement never reaches the adjuster at all and no decision is recorded. Option C substitutes a self-reported score for the stated monetary threshold, and models are poorly calibrated judges of their own output. Option D cannot satisfy a regulatory review obligation, because customisation is not accountability.

Why D

Tenant isolation has to be enforced where the data is fetched, not where the text is generated. Either give each tenant its own knowledge base, or apply a tenant filter that the application derives from the authenticated session and attaches to every retrieval, so nothing a user types can widen the scope. Option A relies on a system prompt, which is an instruction the model may ignore and an attacker may talk around, and is not an access-control boundary. Option B redacts personal data from responses but would happily return another tenant's strategy discussion. Option C is detective only: by the time anyone reads the log, the passage has already been disclosed.

Why C

Top-k and top-p both restrict which next tokens may be sampled, but by different rules. Top-k keeps a fixed number of the highest-probability candidates no matter how confident the model is, while top-p, also called nucleus sampling, keeps the smallest set whose cumulative probability reaches the threshold, so the pool narrows when the model is confident and widens when it is not. Option A names the right pair in the wrong order. Option B substitutes a stop sequence, which ends generation when a chosen string appears and has nothing to do with candidate selection. Option D names an output-length cap plus the randomness control the scenario explicitly held fixed.

Why C

The failure is a property of overlap-based scoring: two hours and 120 minutes share no words, so any metric counting matching n-grams penalises a correct paraphrase. BERTScore instead embeds both texts and compares them in vector space, so wording that means the same thing scores highly, which is why it is offered alongside overlap metrics for open-ended generation. Option A is the overlap family that caused the problem, and it is aimed at translation besides. Option B measures how well a model predicts text and produces no comparison between a candidate answer and a reference. Option D is another exact-token measure and would penalise the paraphrase for the same reason.

Why C

Fairness has several mathematical definitions that do not agree with one another. Demographic parity requires equal selection rates across groups; equal opportunity requires equal true positive rates, that is, equal selection among those who would have succeeded. Where base rates differ between groups, a model can satisfy one and fail the other, so the organisation must choose deliberately, justify the choice for its context and record it. Option A asserts an equivalence that holds only in special cases. Option B dismisses a definition that is standard and appropriate in some settings. Option D describes fairness through unawareness, which fails because correlated features act as proxies for the removed attribute.

Why B

A stop sequence tells the service to end generation the moment the model emits a chosen string, and the string itself is not returned, so the reply finishes at the boundary the team cares about instead of being trimmed afterwards. Setting it to 'Customer:' stops generation exactly where the invented exchange would begin. Option A makes wording more predictable but does nothing about a model that predictably continues the transcript. Option C narrows sampling to the single likeliest token, which again changes wording rather than where generation ends. Option D is the same truncation the team already has: a token cap cuts off wherever the budget runs out, which is precisely what leaves half-written sentences.

Why B

Public benchmarks such as MMLU measure broad multiple-choice knowledge across academic subjects. That is a reasonable way to shortlist candidates, but it is a proxy: it says nothing about 40 in-house categories expressed in shorthand the benchmark has never seen, and leaderboard results can be inflated by training data that overlaps the test set. The decision needs a labelled sample of real tickets scored for the accuracy the business will actually experience. Option A treats a general score as transferable to every task. Option C misstates what the benchmark measures, since MMLU scores knowledge rather than latency. Option D defers evaluation behind a customisation step that itself needs labelled data to be judged.

Why B

AWS Config evaluates resource configurations continuously and ships managed rules for exactly these SageMaker properties, recording each resource as compliant or non-compliant as it changes, while AWS Security Hub aggregates those findings across accounts and Regions into a single view. Option A produces a snapshot every three months, so a misconfigured notebook can run for a quarter unnoticed. Option C records who called which API, which is valuable during an investigation but does not report the current state of a resource that was modified later. Option D prevents new notebook instances altogether, blocking legitimate work while doing nothing about the endpoints or the resources that already exist.

Why A

The system prompt carries standing instructions — role, tone, scope and refusal rules — that apply to every turn, while the user message carries the request that changes. Separating them keeps the policy in one reviewable place, lets the model treat it as higher-priority context than the customer's text, and makes it easy to version. Option B works mechanically but buries the policy inside user content, where it competes with whatever the customer types and is far harder to govern. Option C leaves no user turn for the model to answer. Option D misunderstands the roles: model output is a result, not a channel through which instructions are issued to later turns.

Why D

Self-consistency runs the same prompt several times at a non-zero temperature, producing independent reasoning paths, and then takes the answer that appears most often. Arithmetic slips tend to differ from one another while the correct total recurs, so majority voting over five samples raises accuracy at the cost of extra calls, which the team has already budgeted for. Option A adds variation with no mechanism for choosing between the results, making the problem worse rather than better. Option B governs how long an answer may be, not whether the arithmetic in it is right. Option C borrows negative prompting from image generation and is meaningless here, since nobody knows in advance which wrong totals to exclude.

Why C

The downstream system needs a stable machine-readable contract, so the prompt should demand JSON only, name the exact keys expected and show one example of the structure; the parser then depends on a schema rather than on phrasing. Option A makes prose more repeatable but leaves the parser matching free text, which breaks again the moment the model rephrases. Option B addresses input capacity, which is not the failure here — the claim text already fits, and a bigger window does not make output parseable. Option D truncates output early and would cut the answer off mid-structure, losing two of the three values rather than making any of them reliable to read.

Why B

Streaming returns tokens as the model produces them, so the first words reach the screen almost immediately and the reader watches the answer build. Total generation time is unchanged; what improves is the time to first token, which is precisely what the complaint is about. Option A raises the ceiling on answer length, which if anything lengthens generation rather than shortening the wait. Option C is designed for large asynchronous jobs with nobody waiting and would make an interactive chat dramatically worse. Option D confuses a sampling control with latency: temperature changes how each next token is chosen, not when generation starts.

Why A

Amazon Bedrock batch inference reads a file of prompts from Amazon S3, processes them asynchronously and writes the results back to S3, and it is priced below on-demand for the same model — exactly the trade the publisher wants, since nothing is waiting on an individual article overnight. Option B pays full on-demand price four million times and adds the burden of orchestrating that many synchronous calls. Option C buys reserved capacity for sustained, predictable, latency-sensitive traffic and commits spend for months, far more than a one-off archival pass needs. Option D optimises perceived latency for an interactive reader, and there is no interactive reader in this workload.

Why C

Amazon Bedrock Flows provides a visual builder that chains prompts, knowledge bases, agents, AWS Lambda functions and conditional logic into a single workflow that can be tested and versioned from the console, which matches the classify, branch and draft design without orchestration code. Option A filters harmful content and blocks denied topics on the way in and on the way out; it is a safety control and sequences nothing. Option B scores candidate models against a dataset or human reviewers to help choose one, and runs offline before any workflow exists. Option D reserves model capacity for predictable throughput and has no bearing on how the steps are ordered.

Why B

The Converse API gives Amazon Bedrock a single request and response shape across the models that support it, including a common way to express a multi-turn message list and system instructions, so switching models becomes a configuration change rather than a rewrite. Option A is the lower-level call where each model family expects its own JSON body and returns its own shape, which is precisely the coupling the team wants to remove. Option C returns the catalogue of models available in a Region and performs no inference. Option D starts a customisation job that changes a model's behaviour, which is unrelated to standardising how the application talks to several models.

Why D

Amazon Quick is the enterprise assistant AWS now recommends in place of Amazon Q Business: it builds knowledge bases from sources such as SharePoint and Amazon S3, enforces document-level access control lists so each person is answered only from content they may open, and answers staff questions from that content. Kiro is the AWS agentic development environment that succeeds the Amazon Q Developer IDE plugins, offering inline suggestions and chat in the editor plus spec-driven development, in which an agent turns a written specification into requirements, a design and tasks and then implements them. Option A swaps the two, aiming a developer tool at HR staff and a document assistant at engineers. Option B gives engineers a workplace assistant with no IDE integration and no agent working in their code base. Option C would give HR and finance a developer tool with no connector to their document repositories. Amazon Q Business closed to new customers on 30 July 2026, and new Amazon Q Developer subscriptions have been blocked since 15 May 2026.

Why A and E

Two well-documented disadvantages bite here. Generative models sample their output, so the same inputs can produce different wording and therefore a different quoted premium, which is unacceptable for a priced product and hard to defend to a regulator. They also add token cost and inference latency measured in hundreds of milliseconds or more against a lookup that takes under 10 milliseconds at negligible cost. Option B is false: models read numbers in text perfectly well. Option C misstates how inference works, since a trained model serves requests without retraining. Option D is also false, because models can be invoked over private endpoints inside a virtual private cloud.

Why C and D

Open-weight means the trained weights are published for download, so the organisation can host the model on its own hardware inside an air-gapped facility rather than calling a hosted endpoint, and the accompanying licence is published and can be read, assessed against internal policy and approved before use. Those two properties answer the two constraints directly. Option A is false: hosting still costs compute, and some open-weight licences restrict commercial scale or particular uses. Option B is false as a general claim, since quality varies by task and several proprietary models lead common benchmarks. Option E confuses open weights with open data, and training sets are usually not released.

Why B and E

A parameterised template holds the shared wording once and substitutes only the variable parts per call, so an edit is made in one place and reaches all 14 report types, which is exactly what stops the drift described. The template also becomes a single versionable artefact that can be reviewed and tested, so a drop in output quality can be traced to a specific wording change rather than hunted across 14 copies. Option A is false, because a sampled model may word its answer differently even with identical variables. Option C is false, since templating changes nothing about the context window. Option D overclaims: consistency is not truthfulness, and a template cannot stop a model asserting something untrue.