Mock Exam 3: every answer explained.

Why C

The stop reason max_tokens means generation ended because the response reached the configured output token limit, not because the model decided it had finished. Short plans fit under the cap and long ones reach it mid-sentence, which matches the pattern exactly. Raising the maximum output tokens value, within the ceiling the model supports, lets the longest itineraries complete; a cost-conscious team can pair this with an instruction to stay concise. Option A changes how randomly tokens are chosen, not how many may be generated, so long plans still hit the same cap. Option B adds another reason to stop early, and a stop sequence cuts text off rather than extending it. Option D enlarges how much the model can read, but nothing is being rejected for its size; the limit being reached is the output setting, which this option leaves unchanged.

Why C

Hierarchical chunking stores two linked levels: small child chunks, whose embeddings are precise enough to match a narrowly worded question, and the larger parent chunks that contain them. At retrieval the matched children are swapped for their parents, so the model receives the whole surrounding section. That removes the trade-off the firm measured instead of choosing a point on it. Option A softens cuts at chunk boundaries, but every chunk is still one size, so the team must still choose between precise matching and enough context. Option B draws better boundaries by meaning, yet it still produces a single level of chunk and adds foundation-model cost at ingestion. Option D turns a 1,200-page manual into one averaged vector, which matches almost any question loosely and far exceeds what the model can usefully read in one prompt.

Why D

Asynchronous inference queues each request, reads the payload from Amazon S3 and writes the result back to S3, with an optional Amazon SNS notification, and it supports payloads up to 1 GB and processing times up to one hour. Because the queue absorbs the bursts, the endpoint can scale its instance count to zero between them, so the firm pays only while tiles are being processed. Option A keeps instances running, and billing, through the idle hours, and a synchronous call is the wrong shape for a 600 MB input that takes ten minutes. Option B suits small, quick requests with idle gaps, but its payload limits and short timeouts rule out these tiles, and it offers no GPUs. Option C runs a job over a dataset that someone starts, not an endpoint that accepts individual client requests as they arrive.

Why B

Robustness is the property of producing stable, reliable output when inputs are noisy, unexpected or deliberately adversarial. The classifier is accurate on clean letters, but small perturbations that do not change a letter's meaning, and one crafted phrase, change its decision, so the weakness the review exposes is robustness, and the remedy lies in testing and training with perturbed and adversarial inputs. Option A, fairness, concerns differing outcomes across groups, and the team found equal error rates across segments. Option C, explainability, is about understanding why a model produced a given output; the review measured how stable the decisions are, not whether they can be explained. Option D, transparency, is about giving stakeholders enough information to make informed choices about a system, which says nothing about how stable its decisions are under perturbed inputs.

Why C

An endpoint policy is a resource policy on the interface endpoint itself: it states which principals may perform which actions on which resources for traffic that passes through it. Allowing only bedrock:InvokeModel and bedrock:InvokeModelWithResponseStream on the approved model's ARN refuses everything else on that path, works alongside the callers' IAM policies without editing them, and leaves console traffic outside the VPC untouched. Option A applies to every principal in the account, so it also blocks the data scientists' model evaluations. Option B decides which hosts may connect to the endpoint by address and port, and has no view of which model or action a request names. Option D stops traffic from bypassing the endpoint, which is useful, but places no limit on the models called through it.

Why D

Input length is a model selection criterion in its own right. The context window caps how many tokens one request can carry, and only a long-context model can hold a 250,000-token agreement plus instructions at once, which lets it relate every obligation to definitions and exceptions far away in the same pass. Very long requests are billed for every input token, so the firm should still confirm that the cost per agreement is acceptable. Option A, a map-reduce pattern, compresses each section in isolation, so a definition that changes the meaning of a distant clause is often dropped before the two are ever compared. Option B supplies only the clauses that look similar to the question, and the exception that matters may not be among them. Option C teaches general patterns but leaves the window at 32,000 tokens, so the model still cannot see the whole agreement.

Why A

A multimodal embedding model, such as Amazon Nova Multimodal Embeddings, encodes an image and a piece of text into the same vector space, so a photo of a green velvet armchair and a sentence describing one land close together. One index then answers text-to-image and image-to-text queries with ordinary nearest-neighbour search. Option B never looks at the pixels, so the 600,000 uncaptioned photos can be found only through whatever text sits next to them, and an uploaded photo has nothing to be compared with. Option C reduces each image to generic labels such as chair or furniture, which loses details like brass legs and turns semantic search back into keyword matching. Option D places vectors from two unrelated models side by side; their dimensions mean different things, so the distance between an image vector and a text vector is meaningless.

Why A

Serverless inference provisions compute only when requests arrive and scales the endpoint to zero when there are none, with pay-per-use billing, which is exactly the shape of a tool that sits idle for weeks and then sees a month-end burst. The occasional cold start after an idle period is the trade-off, and the department has said a few seconds of delay on a first request is acceptable. A small CPU model fits within the serverless memory sizes of up to 6 GB. Option B keeps at least one instance running, and billing, through the quiet weeks, and someone must choose the instance type and tune the scaling policy. Option C requires staging every payload in Amazon S3 and collecting the result later, which suits large, slow requests rather than a form expecting an immediate answer. Option D scores a whole dataset as a job and cannot answer individual requests from the app.

Why A

Support for customisation is a model selection criterion: Amazon Bedrock offers fine-tuning only for specific models, Regions and methods, so a team that must train on its own labelled data has to start from that list. Amazon Nova Lite supports supervised fine-tuning in us-east-1, so the 8,000 report and summary pairs can be used directly in a fine-tuning job. Option B may perform well with prompting alone, but Bedrock does not offer fine-tuning for it, so the labelled examples could never be trained in. Option C is customisable, but through reinforcement fine-tuning driven by reward functions, which the team has decided against, and in us-west-2 rather than us-east-1. Option D is an embedding model that returns vectors rather than text, so it cannot write summaries, and it is not offered for fine-tuning either.

Why B

Summarising or truncating history is a core context-engineering technique: recent turns stay word for word, and everything older collapses into a short summary of the facts that still matter, such as the customer's device, the steps already tried and the open fault. The input stops growing with every turn, which caps cost and keeps even a 150-turn session inside the context window. Option A only postpones the failure, and because every turn still resends the whole conversation, cost keeps climbing and often rises faster on a larger model. Option C can discount repeated tokens, but the cached history still occupies the context window, so the longest sessions still overflow. Option D governs the length of the reply, not the size of the input, and longer replies add tokens rather than remove them.

Why B and E

The sensitive information filter can block or mask each PII type; Mask replaces a detected phone number or email address with its type, such as {PHONE} or {EMAIL}, so the conversation carries on without exposing the value. A word filter blocks exact matches of custom words and phrases of up to three words, which suits a fixed list of brand names and a codename that must never appear. Option A applies the Block action, which refuses the entire prompt or response with the configured message whenever a phone number or email address appears, the opposite of what the provider wants. Option C relies on a natural-language topic definition, so it would also block the general questions about switching provider that the policy explicitly allows. Option D tunes the harmful-content filter for criminal activity, which does not target brand names at all.

Why A

AWS Lake Formation governs access to Data Catalog tables at a finer grain than files: a data filter combines column-level permissions, which hide the identifying columns, with a row filter expression that returns only UK claims, and the team then queries the original tables through integrated services such as Amazon Athena. Permissions are granted and revoked centrally, and no second dataset exists. Option B works at the level of objects and prefixes, so the team either reads whole files, identifying columns included, or nothing at all. Option C finds and reports sensitive data, which is a discovery step, but enforces no access restriction. Option D does produce a safe dataset, yet it is the extra copy governance wants to avoid, and it drifts out of date between runs.

Why C

Semi-supervised learning trains on a small labelled set together with a much larger unlabelled set, typically by learning from the labelled examples, assigning provisional labels to the unlabelled examples the model is confident about, and retraining on the enlarged set. It exists for exactly this situation: labels are scarce because expert time is expensive, while raw examples are plentiful. Option A learns only from the 1,200 labelled contracts and discards whatever the other 300,000 could teach the model, which the company explicitly wants to use. Option B can group the unlabelled contracts by similarity, but clusters carry no risk categories and the approach ignores the lawyers' labels entirely. Option D learns a policy from rewards for actions taken in an environment, and categorising a clause involves no sequence of actions and no environment to reward them.

Why B

Amazon Bedrock Knowledge Bases can connect to a structured data store, using Amazon Redshift as the query engine. When a manager asks a question, the knowledge base uses the schema to generate a SQL query, runs it against the warehouse, and returns the results or a generated answer built from them, so the figures come from the current tables and nobody writes SQL by hand. The service role should be granted read-only access. Option A turns rows into embeddings, and similarity search cannot rank, sum or filter across millions of rows, so a top-ten calculation would be guessed from whichever rows looked similar. Option C freezes one snapshot into model weights; it cannot compute exact aggregates and goes stale as soon as new sales arrive. Option D asks the model to extrapolate from a sample, which yields estimates rather than correct totals.

Why B

In a swarm, agents collaborate as peers: each can see the shared context and hand off directly to whichever teammate is best placed, so work can loop between the researcher and the analyst as often as needed with no coordinator in the middle. That matches a task whose path cannot be planned in advance. Option A centralises every decision in an orchestrator, which suits work that splits cleanly into assignable subtasks, but no agent could pass work straight to a colleague: every back-and-forth exchange would have to route through the orchestrator. Option C fixes the order, so the analyst could never send work back to the researcher. Option D is not a multi-agent design at all, and loading one prompt with three roles and every tool tends to blur responsibilities and degrade tool selection.

Why A

GraphRAG in Amazon Bedrock Knowledge Bases identifies entities and the relationships between them in the ingested documents and stores that graph, alongside the vectors, in Amazon Neptune Analytics. After the initial vector search, retrieval traverses those links to pull in connected chunks, so a supplier can be traced through components and batches to products even when each link sits in a different document. GraphRAG takes its documents from Amazon S3, which suits this corpus. Option B makes chunks larger and less focused, and relationships spread across 900 documents cannot fit into any single chunk. Option C improves exact matching of names and codes, which is useful, yet still returns isolated passages rather than the chain that links them. Option D changes where vectors are stored and what they cost; retrieval stays similarity-only and still misses the connections.

Why B

Self-supervised learning creates its training targets from the data itself. In next-token prediction, every position in the text supplies its own label, the token that actually comes next, so trillions of training examples exist without a single human annotation. This is how large language models acquire their broad knowledge of language during pre-training, before any later tuning stages. Option A requires people to attach a correct answer to each example, which is the step the model card says never happened. Option C is a later alignment stage in which people rank model responses and a reward model steers further training, so it depends on exactly the human judgements that pre-training lacked. Option D mixes a small human-labelled subset with a large unlabelled set, and in this stage there is no human-labelled subset at all.

Why D

The ApplyGuardrail API evaluates any text against a pre-configured guardrail without invoking a foundation model, so it is decoupled from where the model runs. The application sends each user prompt with the source set to INPUT and each model response with the source set to OUTPUT, and gets back the same assessment, masking or blocked message the Bedrock-hosted assistants receive, from one shared policy. Option A misreads the guardrail configuration in Converse and InvokeModel: it applies a guardrail to a model invoked through Amazon Bedrock and cannot route a request to a model on EC2. Option B recreates part of the policy in a second service, the duplicate rule set the lead wants to avoid, and Comprehend has no equivalent of denied topics. Option C matches HTTP requests against patterns; it cannot judge what a prompt means or check model responses.

Why D

Synthetic data generated with differential privacy reproduces the distributions and correlations of the real visits while bounding how much any single patient can influence the output, so the vendor can train a useful model and no real record is handed over. Option A is pseudonymisation: the quasi-identifiers the privacy officer named stay in the data, so individuals can still be re-identified by linking them with other sources. Option B protects the records at rest and in transit, but the vendor holds the decryption permission and therefore reads every real record, which the ruling forbids. Option C secures the network path and the access mechanism, yet what arrives at the vendor is still the full set of real patient records.

Why C

When the steps are known in advance and must run the same way every time, a deterministic workflow, for example an AWS Step Functions state machine, fits better than an agent. The path is defined in code, every execution records the same sequence, and a foundation model is used only where judgement on language adds value, here in drafting the summary. Autonomy is worth its unpredictability only when the steps cannot be planned beforehand. Option A still leaves the model free to reorder, skip or repeat steps, because a prompt is guidance rather than a guarantee. Option B adds more autonomous decision points, which makes the path harder still to predict and audit. Option D filters what the agent says, not which steps it chooses, so the process path remains non-deterministic.

Why C

Amazon S3 Vectors stores and queries embeddings in S3 vector buckets without any provisioned infrastructure, and AWS positions it for large vector datasets with infrequent queries where sub-second response times are acceptable, which is this firm's profile. It is a supported knowledge base vector store, so cost follows the data held and the queries made rather than capacity kept running. Its trade-off is that it does not offer hybrid search, which the firm has said it does not need. Option A suits high query volumes and hybrid search, but its compute capacity keeps accruing charges between queries. Option B needs database instances that run, and are billed, around the clock to serve a few dozen queries a day. Option D is intended for GraphRAG over relationship-heavy content, and its graph is billed for provisioned memory capacity whether or not anyone is querying.

Why A

The two protocols cover different connections. The Model Context Protocol (MCP) standardises how an agent, acting as an MCP client, discovers and calls tools and data sources exposed by MCP servers, which is exactly the fares database and the currency API. The Agent2Agent (A2A) protocol standardises how independent agents, possibly built on different frameworks, advertise their capabilities and delegate tasks to one another, which is the visa-eligibility handoff. Option B reverses the roles: a database has no reasoning of its own to negotiate with, and MCP is not designed for delegating tasks to a peer agent. Option C stretches MCP beyond its role; it connects an agent to tools, while the other team's agent runs its own reasoning and task lifecycle. Option D treats passive data sources as peers, adding an agent layer in front of a database that needs only a tool interface.

Why B

Multilabel classification predicts a set of labels for each item, and any number of them can apply at once, so the carbon-tax article can be tagged politics, economy and climate in a single prediction. That matches a scheme in which each article carries any combination of the 14 topics. Option A makes one yes-or-no decision per item; covering 14 topics would take 14 separate binary models, which is a workaround rather than the problem type. Option C also chooses among many classes, but it assigns exactly one class per item, so it would force the carbon-tax article into a single topic and lose the other two. Option D groups articles by similarity without using the editors' tags at all, so it cannot reproduce the topic list the publisher has defined, and the 80,000 tagged examples would go unused.

Why A

The Retrieve operation queries the knowledge base and returns the matching chunks with their source locations, metadata and relevance scores, then stops, which is what a team running its own prompt and model needs. RetrieveAndGenerate performs the same retrieval and then has a chosen foundation model write a response grounded in those chunks, returning citations that map parts of the answer to their sources, so the intranet team gets a finished answer from a single call. Option B reverses the fit: the claims team would pay for a generation it never uses, and the intranet team would have to build the generation step it wants to avoid. Option C adds a wasted model invocation, its cost and its latency to every claims request. Option D misunderstands InvokeModel, which calls a model directly and has no knowledge base parameter, so nothing would be retrieved.

Why A

Reusing a pre-trained model and adapting it with the firm's 30,000 labelled contracts, through fine-tuning or a lighter technique, avoids the six-week pre-training run, which is where most of the energy would be spent. Choosing energy-efficient accelerated instances, such as those built on AWS Trainium, and a Region whose electricity has a lower carbon intensity reduces the footprint of the remaining work further. Option B halves the elapsed time but uses roughly the same number of GPU-hours, so the energy consumed hardly changes. Option C repeats the most expensive step every month and multiplies the footprint. Option D optimises network latency for users; the training run is unchanged, and being close to the office says nothing about the carbon intensity of that Region's grid.

Why C and D

Excessive agency means an agent holds more capability or autonomy than its task needs, so a manipulated or mistaken decision turns into real damage. Restricting tool access to the read and purchase-order operations removes cancellation, refunds and deletion from what the agent can do at all, and Policy in AgentCore evaluates each tool call at the gateway before it runs. Requiring human confirmation for side-effecting actions puts a person in front of anything that changes records. Option A may improve judgement but leaves every dangerous tool within reach, and a stronger model can still be manipulated. Option B is guidance the model can be talked out of, which is how the crafted email succeeded. Option E creates an audit trail that explains the damage afterwards without preventing it.

Why A and E

With the Converse API, tool use is a loop the application drives. The application first describes each tool in the tool configuration, giving it a name, a description that tells the model when to use it, and a JSON schema for its inputs, so the model can request it with valid arguments. When the model stops with a tool_use stop reason, it has only asked for the call; the application must run the function itself and return the output in a toolResult content block, matched to the request's ID, in the next user message so the model can compose its answer. Option B describes something Converse does not do: the model never executes the internal function. Option C cannot teach a model stock levels that change by the minute. Option D adds randomness without connecting the model to the data, so any figure it produced would be invented.

Why C

Query decomposition, an orchestration option on RetrieveAndGenerate, has the knowledge base break a complex question into smaller sub-queries, for example one about each office's parental leave and one about phased return, and run each against the index before the answer is generated. Each sub-query retrieves its own focused passages, so both policy documents reach the model. Option A improves exact matching of terms such as office names, but it still issues one search whose embedding blends two topics. Option B returns more passages from the same blended search, padding the prompt with near-misses while possibly still favouring one office. Option D can only reorder what the single search already returned; it cannot add passages for the office that the search missed.

Why C

Unsupervised anomaly detection learns what normal transactions look like, from amounts, timing, merchants and device patterns, and flags the ones that deviate from it, so it needs no fraud labels and can surface schemes that have never been seen before. That fits a problem where labelled fraud is scarce and new tactics bear little resemblance to old ones. Option A has only 140 positive examples against 50 million negatives, and a classifier can only learn to recognise patterns resembling those 140, which is precisely what new schemes avoid. Option B forecasts aggregate volume per day, so it might notice a spike but cannot point to which individual transactions are suspicious. Option D can only assign transactions to the scheme types it was trained on, so a novel scheme would be forced into a known class or missed.

Why C and D

These are two distinct limitations. A foundation model knows only what was in its training data, so a rate that changed two months ago, after the training cutoff, is simply absent and the model reports the old figure with full confidence; grounding answers in current documents through retrieval addresses it. The audit problem is interpretability: an output emerges from billions of learned parameters, and there is no rule or feature weighting to point to, so the model cannot show why it reached a conclusion. Citing sources and keeping a human reviewer accountable for advice mitigate it. Option A is unlikely for short questions, and an overflow causes rejection or truncation, not a confident stale figure. Option B assumes fine-tuning that the scenario never mentions. Option E would require malicious text in the input, and these are plain questions from staff.

Why C

The two approaches spend money in different places. In-context learning has no up-front cost, but the examples are re-sent and billed as input tokens on every request, so its cost grows in step with volume. Fine-tuning moves that spend into a one-off training job and an ongoing serving charge that does not depend on how many examples would have been sent. At 200 requests a month, 5,000 extra tokens each is a trivial sum that could never repay training and serving a custom model. At 4 million requests, the same examples add about 20 billion input tokens a month, which can far exceed the fixed cost of a fine-tuned model. Option A ignores the fixed serving charge that dominates at low volume. Option B ignores how the per-request token cost scales at high volume. Option D inverts the trade-off for both workloads.

Why C and E

AnalyzeDocument with the FORMS feature type returns key-value pairs, linking a label such as Policy number to the value written beside it, along with selection elements such as tick boxes. The TABLES feature type returns each table as rows, columns and cells, so every repair line keeps its description, quantity and cost together. Requesting both feature types covers the two requirements in one call. Option A returns lines and words of text but no relationship between a label and its value, or between the cells of a row, which is exactly the structure the claims system needs. Option B locates signatures on the page and says nothing about field values or itemised costs. Option D finds entities such as names and dates in a flat stream of text after the page structure has already been lost, so it cannot say which value belongs to which field.

Why B

Under Section 50.10 of the AWS Service Terms, AWS offers uncapped intellectual property indemnity for the output of its Indemnified Generative AI Services, which include the generally available Amazon Nova models: AWS defends the customer against third-party claims that the output infringes their IP. The cover has conditions, such as keeping available filters enabled, following the service instructions and not knowingly using infringing output, so the publisher must stay within them. Option A overstates the cover, which applies to the services AWS lists, not to every third-party model on Bedrock. Option C misuses Amazon Macie, which discovers sensitive data such as PII in Amazon S3 and does not check text for copyright. Option D filters categories such as hate, insults and violence, none of which detects copied text, and a filter is not the contractual protection counsel asked for.

Why D

Models tend to be more confident on records they were trained on than on similar unseen ones, so comparing confidence for a named person's exact record reveals whether that person was in the training set, and here that alone discloses that they were treated by the clinic network. The related model inversion attack uses outputs to reconstruct sensitive attributes of training data. Mitigations include returning labels rather than raw scores, rate limiting and training with differential privacy. Option A tampers with the data before training, whereas the red team only queries a finished model. Option B aims to change a prediction, not to learn anything about the training set. Option C copies the model's function through many queries and reveals nothing about individual patients.

Why C

Zero-shot prompting gives the model an instruction with no examples and relies on what it already knows. When the task is simple, the categories are unambiguous and testing shows the target is met, zero-shot is the right choice: it uses the fewest input tokens, keeps the prompt short and easy to maintain, and adds no examples that might skew the labels towards their wording. Option A would help if the model were misreading the categories, but here it adds tokens to every request for no measured gain. Option B adds reasoning tokens and latency to a one-word classification that is already accurate. Option D requires labelled data, a training job and serving costs to solve a problem that the instruction alone has already solved.

Why D

Model selection starts with the modalities a task needs on each side. Writing a description of a photograph needs a model that accepts images as input and returns text. Amazon Nova Lite reads text, images and video and responds in text, at a low price per token, so it fits the archive and the curators can review its drafts. Option A is the cheapest model on the list, but it is text-only and cannot accept a photograph at all, so its price is irrelevant. Option B also takes only text, and its output is a numeric vector for search and similarity rather than readable prose. Option C is a conversational speech model that takes speech and text and replies in speech and text; it has no way to receive an image. Checking the input and output modalities on each model card rules out three of the four before price is even compared.

Why B and E

A custom vocabulary lists domain-specific words, such as brand names, acronyms and proper nouns, that Amazon Transcribe is rendering incorrectly, and the team already holds the 300 drug names it needs to build one. Speaker diarization partitions a single audio stream by voice and labels each segment with a speaker, so the transcript shows which of the two people said each line. Option A does something else entirely: a vocabulary filter masks, removes or tags listed words in the output rather than improving how they are recognised. Option C separates speakers by audio channel, so it helps only when each party was recorded on its own channel, and these recordings mix both voices into one. Option D adapts recognition to a domain by training on a large body of domain text, which the team does not have and which is far more effort than a word list.

Why B and C

A well-formed prompt typically combines an instruction, context, input data and an output indicator. This prompt already contains an instruction, the request to summarise, and input data, the pasted report. What it lacks is context about who will read the summary and why, which is why the language defaults to engineering jargon, and an output indicator stating the expected format and length, which is why the summaries range from one sentence to a page. Adding both addresses each observed symptom directly. Option A is already present in the line asking for a summary. Option D is already present as the pasted report. Option E is an inference parameter rather than a prompt element, and more randomness would make the length and tone less consistent, not more.

Why B and D

Two advantages of foundation models apply here. Adaptability: a model pre-trained on broad data can take on sentiment, tagging, language detection and new jobs through instructions and a few examples, instead of a labelled dataset and a retraining cycle for every task. Generation and conversation: a foundation model writes new content and responds to follow-up questions in natural language, which covers headline drafting and questions about the archive that no classifier can serve. Option A describes the opposite of how these models behave; they sample their output, so identical inputs can produce different responses. Option C is a known weakness, because a foundation model's reasoning cannot be traced to specific rules. Option E is a misconception: a foundation model can produce fluent but wrong or unsuitable text, so drafted headlines and answers still need editorial review before they reach readers.

Why A and C

Both keys change how much the under-represented group influences training. Oversampling raises its share of the training rows, by duplicating records or generating synthetic ones, and undersampling the majority does the same from the other side. Sample or class weights leave the data as it is but make each error on the minority records cost more in the loss function, so the model cannot minimise its loss while ignoring them. Option B is fairness through unawareness: credit history length and other fields still act as proxies for age, and the team loses the ability to measure the disparity. Option D repeats the same imbalanced data, so extra passes mainly fit the majority better and risk overfitting the few minority rows. Option E hides the problem the validation results revealed instead of fixing it.

Why B

Model output is untrusted input to whatever consumes it. A strict schema check on required fields, data types, numeric ranges and the absence of extra keys catches malformed JSON, text in a numeric field and injected instructions before the claims API can act on them, and anything that fails goes to a person instead of becoming a payment. Option A fixes truncation at most, while the failures described are wrong content, not cut-off content. Option C filters harmful language categories, none of which describes a malformed amount or a smuggled instruction. Option D makes output more repeatable, but deterministic output can still be wrong for a given email, and nothing checks it before it schedules a payment.

Why A and D

Anything placed in a model's context can potentially be extracted, because the model has no reliable way to keep part of its own input secret. The durable fix is to keep secrets out of that context: the key belongs in a secrets store, used by backend or tool code that the model can ask to act but never reads, and the leaked key must be rotated. Likewise, the prompt should be written on the assumption that it will be disclosed, so eligibility for a payment plan is decided by code that checks the account flag, not by a hidden instruction the model may reveal or be talked out of. Option B is itself an instruction that a determined user can talk the model past. Option C changes sampling, not what the model can see. Option E moves the same secrets into another part of the same context.

Why A

Custom terminology supplies source terms together with the target text to use, and when Amazon Translate finds a match in the source it applies the terminology entry, so mapping FlowDesk Pulse and QuickLedger to themselves keeps the names unchanged across all nine languages. It is a small file attached to translation requests, with no training job involved. Option B steers translations towards the style and wording of example parallel data, which means assembling pairs of translated articles, adds cost, and is aimed at overall domain style rather than pinning individual names. Option C adjusts the register of the output, for example formal versus informal forms of address, and leaves the product names translated exactly as before. Option D masks profane words and phrases in the output, which has no bearing on brand or product names.

Why B

Amazon Bedrock can serve a customised model on demand through a custom model deployment: once deployed, the deployment's ARN is used as the model ID, and the team pays only for what it uses, with no provisioned compute to size or idle through the night. Support covers models customised on or after 16 July 2025, including Meta Llama 3.3 70B Instruct in US West (Oregon) and several Amazon Nova models in US East (N. Virginia). Option A charges for reserved model units every hour whether or not anyone is drafting, so capacity sized for deadline bursts sits idle most of the week. Option C repeats the training work and adds always-on GPU instances plus patching, scaling and monitoring the team must run itself. Option D returns results asynchronously, which suits offline jobs but leaves a lawyer waiting in the editor for a draft that arrives later.

Why A

Jailbreaking aims to bypass a model's built-in safety and moderation behaviour so that it produces content it was trained to refuse. Persona and role-play framing, such as a character with no rules whose dialogue happens to contain the forbidden instructions, is a classic jailbreak technique, and the stated goal is harmful content rather than anything about the application's configuration. Option B describes input that tries to override the developer's instructions, for example telling a homework helper to act as a different tool; the distinction matters because the two are mitigated differently, and Amazon Bedrock Guardrails reports them as separate prompt attack types. Option C targets the system prompt, which this user is not after. Option D attacks a model while it is being trained, not through a chat request at inference time.

Why A

Latency-optimized inference serves a supported model with significantly lower latency and no loss of accuracy, without fine-tuning or a model change: the request sets the latency field of its performance configuration to optimized. Amazon Nova Pro supports it through cross-Region inference from US East (N. Virginia), US East (Ohio) and US West (Oregon); the feature is in preview, and once its quota is used up requests fall back to standard latency at standard rates. Option B processes requests asynchronously and returns results later, which is useless to a driver waiting for a spoken reply. Option C trades response time for a discount, so replies may arrive more slowly rather than faster. Option D produces a different, smaller model and requires a training job, both of which the team has ruled out.

Why B

SHAP, based on Shapley values from cooperative game theory, gives a local explanation: for one prediction it assigns each feature a positive or negative contribution, and the contributions add up to the difference between that claim's score and the model's average score. An investigator can see, for example, that a recent policy start and a late-night incident time raised this score while a long claims-free history lowered it. Option A is a global technique: it shows the average effect of a feature across the dataset, not why one claim scored 0.87. Option C measures how accurate the flagging is, which says nothing about the reasons behind any single score. Option D is also global, ranking features by how much they matter overall, and the features driving one claim can differ from that ranking.

Why A

The matrix places an organisation that refines an existing third-party foundation model with its own data, producing a new model specialised to its workload, in Scope 4. That is the newsroom's case, so the security team also owns the governance of the 80,000 training articles and of the custom model, on top of the application controls. Option B describes building an application on a foundation model through its API without changing the model, as a RAG assistant on Amazon Bedrock would. Option C applies when an organisation trains a model from scratch on data it owns or acquires and owns every aspect of it. Option D fits the legal team's contract tool, a vendor application with AI built in, but not the newsroom's custom model.

Why D

Exploratory data analysis is the stage in which a team examines a new dataset before modelling, plotting distributions, computing summary statistics and correlations, and spotting problems such as missing values, outliers and impossible entries. Its findings then shape cleaning, feature choices and even whether the data can support the use case at all. Every activity in the scenario, from the histograms to the 40 percent gap and the negative spend values, is discovery rather than transformation. Option A creates or transforms input columns, for example by encoding categories or deriving tenure, and it follows the analysis that tells the team which features are worth building. Option B scores a trained model on held-out data, and no model exists yet. Option C searches training settings such as the learning rate, which also requires an algorithm to have been chosen.

Why A

Amazon Bedrock prompt optimization analyses the components of a prompt and rewrites it for a model the user selects, either from the optimize action in a playground or in Prompt Management, or through the OptimizePrompt API with a target model ID. The rewritten prompt appears beside the original so that the team can compare outputs and adopt it, which is exactly this migration task. The simple mode is a quick heuristic rewrite that works best on prompts of around 1,000 tokens or fewer, and the result should still be tested against the team's own examples. Option B stores and versions prompts but does not rewrite them for a different model. Option C decides which model serves each request and leaves the prompt text unchanged. Option D lowers the cost and latency of repeated prompt prefixes without altering their wording.

Why C

Amazon Bedrock service tiers trade cost against response time on the same runtime APIs. The Flex tier applies a pricing discount in exchange for potentially longer processing, and AWS positions it for work such as model evaluations, summarisation and agentic workflows; the firm only sets the service_tier parameter to flex on each request, so the workflow is unchanged. Option A charges a premium over standard pricing for the fastest responses, the opposite of what an unattended overnight job needs. Option B is also discounted, but a batch job takes a prepared file of independent prompts and returns all the results later, while this workflow builds each request from the previous response, so it would have to be redesigned. Option D reserves capacity at a fixed monthly price for mission-critical traffic that cannot tolerate downtime, far more than a delay-tolerant nightly job requires.

Why B

Reinforcement fine-tuning in Amazon Bedrock learns from rewards instead of labelled responses. The model generates several candidate answers for each prompt, a reward function grades every one, and training shifts the model towards the higher-scoring behaviour. A Lambda function that executes the SQL against the test warehouse and compares its output with the accepted result is an objective, automatic grader, so the 3,000 logged questions become usable training data without anyone writing SQL. Option A needs the very labelled pairs the company lacks, and writing them is the months of work it wants to avoid. Option C absorbs general SQL style from unlabelled text but never learns this schema or whether a query returns the right answer. Option D swaps an automatic, exact check for human preference rankings, which are slower, costlier and less precise for output that can be verified.

Why D

SageMaker Pipelines defines an ML workflow as a series of connected steps, such as processing, training, evaluation, a condition and model registration, and runs it the same way every time on orchestration that SageMaker AI provisions and scales. Each execution is versioned and its lineage recorded, so the team can see which data and which run produced which model, and a condition step can register the model only when its AUC beats the current one. Option A stores and serves engineered features for reuse across models, but it orchestrates nothing. Option B is a visual tool for preparing data, which covers one of the seven steps. Option C would run the notebooks unattended, yet it leaves an instance and its scripts for the team to maintain and records no lineage or step history, so a failed step could still go unnoticed.

Why C

A counterfactual explanation answers the question an applicant actually has: what would have had to be different for the decision to change. Phrased as the smallest realistic changes to the applicant's own figures, for example existing debt below a stated level or twelve more months of trading history, it is understandable without technical knowledge and points directly to what could be done before reapplying. Option A is a valid local explanation for analysts, but scores in model units tell an applicant which inputs mattered, not what change would lead to approval. Option B is global, so it describes the model in general rather than this applicant's decision. Option D maximises openness in a form no applicant can use, and exposing the model's internals invites applicants to game it.

Why C

An application inference profile is a taggable Amazon Bedrock resource that wraps a model, so each feature passes its own profile ARN as the model identifier and the usage and cost of those calls carry that profile's tags. Once the team tag is activated as a cost allocation tag, Cost Explorer groups the bill by it with no further work. Option A describes a real feature: since April 2026 Amazon Bedrock can allocate costs by IAM principal tags, and it works well when each team calls under its own role. It fails here only because all four features share one role, so every dollar lands under the same tag. Option B alerts on spend against thresholds, but a budget splits nothing between teams. Option D could approximate each share, yet it is a manual monthly estimate from token counts, not attribution that appears on the bill.

Why D

A cross-Region inference profile lets Amazon Bedrock route each request to a Region in a defined set that has capacity, which absorbs bursts that would throttle a single Region and keeps serving when one Region is under pressure. Choosing the EU geographic profile limits routing to EU Regions, so the residency policy holds, and there is no additional routing charge; the price follows the Region the call is made from. Option A buys dedicated capacity sized for a few hours of peak and pays for it through a quiet month, a commitment that suits steady demand rather than short, unpredictable spikes. Option B can route requests to any supported commercial Region worldwide, which breaks the EU-only policy. Option C makes shoppers wait for asynchronous results, which an interactive assistant cannot do.

Why B

Automatic model evaluation jobs in Amazon Bedrock run a model against a prompt dataset and compute the scores without any human reviewers. For text summarisation, Bedrock supplies a built-in dataset with metrics that include a toxicity score and a robustness score that measures how much output quality changes when prompts are slightly perturbed, for example by typos or changes of case. Running the same job on each candidate gives directly comparable results, and the built-in dataset means the team supplies no reference summaries. Option A could measure similar things, but building, validating and maintaining the harness and classifier is the effort the team wants to avoid. Option C needs reviewers the team does not have, and humans rating every summary is slow for properties that can be scored automatically. Option D measures how well a model predicts general text, which reveals neither toxic output nor sensitivity to noisy input.

Why B

Precision is the share of flagged sellers who really are fraudulent, so it falls with every legitimate seller who is wrongly suspended. When a false positive is the expensive error, as it is when a suspension happens automatically, costs an honest seller income and drives many away, the threshold should be tuned to keep precision high. The marketplace has also said that fraud the model misses is caught later by chargebacks, which makes a missed case the cheaper error here. Option A would be the priority if misses were the costly error, which is the reverse of this situation. Option C is dominated by the large majority of honest sellers and can look excellent while many of them are still being suspended. Option D is a regression metric for continuous values, not a measure of classification errors.

Why A

Amazon Bedrock AgentCore Gateway converts existing APIs and Lambda functions into MCP-compatible tools: OpenAPI, Smithy and Lambda are supported target types, and the gateway translates an agent's MCP tool calls into the underlying API requests and Lambda invocations. It also handles inbound authentication of the calling agent and outbound credentials for each target, and offers semantic search so agents can find the right tool among many. Option B can host MCP servers, but the bank would still write and maintain one per API, which is the work it wants to avoid. Option C keeps short-term and long-term memory for agents and exposes nothing as a callable tool. Option D runs code in a sandbox; having agents improvise HTTP calls to banking APIs gives no managed tool interface and no managed authentication.

Why C and E

An agent's quality lies in what it does, so its evaluation has to examine actions and outcomes, not just text. Tool-selection accuracy checks each step of the trajectory, confirming that the agent chose the correct tool and passed valid parameters, which catches the wrong-tool calls seen in testing. Task completion checks the end state against the goal, here whether a reservation really exists, and trajectory evaluation confirms that the steps happened in a sensible order. Managed options such as Amazon Bedrock AgentCore Evaluations include built-in evaluators for task completion and tool usage. Option A and Option B score word overlap with reference text, so a fluent but false confirmation could score well. Option D measures how predictable general text is to the model and says nothing about whether this agent booked anything.

Why D

Human-centred design for AI decisions keeps people able to understand and contest outcomes that affect them. Telling each claimant that the suspension was automated, with the main reason, and offering an appeal to a caseworker who has the authority to review and reverse it, adds both AI decision transparency and a human override, and the outcomes of appeals feed back where the model is wrong. Option A reduces the number of people affected but leaves every remaining claimant with no route to challenge a mistaken suspension. Option B is general transparency about the model, but it explains nothing about an individual decision and offers no recourse. Option C may improve accuracy over time, yet wrong suspensions will still happen and the people affected still cannot contest them.

Why D

AWS Artifact holds agreements as well as reports, and accepting the Business Associate Addendum as an organisation agreement from the management account covers every existing member account and every account added later. That agreement covers only HIPAA-eligible services such as Amazon Bedrock, and the company still configures them securely. Option A provides audit evidence about the controls AWS operates, which is useful in a compliance file, but a report is not a contract and creates no business associate relationship. Option B checks the company's resource settings against HIPAA-related practices, which helps meet its own obligations but is not the addendum counsel requires. Option C produces an audit trail of API activity, which HIPAA safeguards may call for, yet it puts no legal agreement in place.

Why C

The share of truly defective welds that the model caught is recall: true positives divided by all actual positives, which is 72 divided by 72 plus 8, or 72 out of 80, giving 90 percent. The eight missed welds are the false negatives that recall counts against the model. Option A is precision, 72 out of the 90 welds flagged, which answers how many of the flags were correct rather than how many defects were caught. Option B is accuracy, 974 correct decisions out of 1,000, inflated by the 902 good welds correctly passed. Option D is specificity, 902 out of 920 good welds correctly passed, which describes how the model treats good welds and says nothing about the defective ones the quality lead asked about.

Why D

AWS Inferentia2 is a chip that AWS designed for deep-learning inference, and Inf2 instances are positioned to deliver lower cost per inference than comparable GPU instances for models compiled with the AWS Neuron SDK, which the engineers have already accepted. Its counterpart, AWS Trainium, plays the same role for training. Steady, round-the-clock volume is where a cheaper per-inference rate compounds most. Option A offers top GPU performance aimed at training and the very largest models, at the highest hourly price, so it raises cost for a tagging workload. Option B avoids accelerator charges, but generating text from a large language model on CPUs alone is slow enough to need far more instances. Option C suits intermittent traffic, offers no GPU or Inferentia acceleration, and scaling to zero saves nothing when requests never stop.

Why D

A golden dataset is a curated, version-controlled set of representative inputs, including edge cases such as each category of user, paired with approved reference answers or grading criteria. Running every candidate prompt or model change against it, and comparing the scores with those of the current version, turns a regression into a failed check before release rather than a customer complaint afterwards, and each defect that does escape becomes a new test case. Option A exposes real customers to the faulty version, and suits choosing between versions that have already passed quality checks. Option B makes the same input produce more consistent wording but cannot tell whether that wording is still correct after a prompt change. Option C makes rollback quick once a problem is found, but detection would still depend on complaints.