Exam AIP-C01 Topic 2 Question 65 Discussion
Actual exam question for Amazon's AIP-C01 exam
Question #: 65
Topic #: 2
Question #: 65
Topic #: 2
A company runs a generative AI (GenAI)-powered summarization application in an application AWS account that uses Amazon Bedrock. The application architecture includes an Amazon API Gateway REST API that forwards requests to AWS Lambda functions that are attached to private VPC subnets. The application summarizes sensitive customer records that the company stores in a governed data lake in a centralized data storage account. The company has enabled Amazon S3, Amazon Athena, and AWS Glue in the data storage account.
The company must ensure that calls that the application makes to Amazon Bedrock use only private connectivity between the company's application VPC and Amazon Bedrock. The company's data lake must provide fine-grained column-level access across the company's AWS accounts.
Which solution will meet these requirements?
The company must ensure that calls that the application makes to Amazon Bedrock use only private connectivity between the company's application VPC and Amazon Bedrock. The company's data lake must provide fine-grained column-level access across the company's AWS accounts.
Which solution will meet these requirements?
Suggested Answer: B Vote an answer
The first option labeled B is the correct solution because it fully satisfies both private connectivity and fine- grained cross-account data governance requirements using AWS-native services.
Creating interface VPC endpoints for Amazon Bedrock runtimes ensures that all inference calls remain on the AWS private network and never traverse the public internet. Running AWS Lambda functions in private subnets enforces network isolation, and using IAM conditions that restrict access to specific VPC endpoints and roles prevents unauthorized inference calls.
For the governed data lake, AWS Lake Formation LF-tag-based access control is the recommended AWS mechanism for enforcing cross-account, column-level permissions. LF-tags allow the company to define data access policies once and apply them consistently across accounts, databases, tables, and even individual columns. This is required for sensitive customer records and is not achievable with S3 bucket policies or IAM alone.
The second option labeled B uses a NAT gateway, which violates the private connectivity requirement.
Option C uses public Bedrock endpoints and only database-level grants, which are insufficient. Option D relies on IAM path-based policies, which cannot enforce column-level access and introduces public fallback paths.
Therefore, the first option labeled B is the only solution that meets all networking, security, and data governance requirements.
Creating interface VPC endpoints for Amazon Bedrock runtimes ensures that all inference calls remain on the AWS private network and never traverse the public internet. Running AWS Lambda functions in private subnets enforces network isolation, and using IAM conditions that restrict access to specific VPC endpoints and roles prevents unauthorized inference calls.
For the governed data lake, AWS Lake Formation LF-tag-based access control is the recommended AWS mechanism for enforcing cross-account, column-level permissions. LF-tags allow the company to define data access policies once and apply them consistently across accounts, databases, tables, and even individual columns. This is required for sensitive customer records and is not achievable with S3 bucket policies or IAM alone.
The second option labeled B uses a NAT gateway, which violates the private connectivity requirement.
Option C uses public Bedrock endpoints and only database-level grants, which are insufficient. Option D relies on IAM path-based policies, which cannot enforce column-level access and introduces public fallback paths.
Therefore, the first option labeled B is the only solution that meets all networking, security, and data governance requirements.
by Adolph at Feb 10, 2026, 01:26 PM
0
0
0
10
Comments
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Report Comment
Commenting
You can sign-up / login (it's free).