Amazon AWS AI Practitioner AIF-C01 Prompt Best Practices Security Risks And Version Management Practice Test

 

AIF-C01 skills 3.2 | 28 original questions

This AWS Certified AI Practitioner AIF-C01 practice test focuses on prompt best practices security risks and version management through original scenario-based questions aligned to AWS Exam Guide version 1.1 published April 30, 2026. Use the full ExamSnap AIF-C01 collection for broader practice across all five current exam domains. For broader exam preparation, review the Amazon AWS Certified AI Practitioner AIF-C01 Exam Dumps page.

Instructions: Select the best answer for each question. Review the rationale after answering. Each distractor includes a brief explanation of why it is not the strongest fit for the stated scenario.

Question 1

Bellows College has completed discovery for a agentic workflow trial. Before implementation, the AI product manager must decide how to recognize crafted input intended to bypass safety restrictions or policy constraints. Which choice best satisfies that requirement? The team will validate the result with representative production examples before rollout. The control owner requires evidence from 7 test groups before the 621-day release review.

1. Prompt hijacking
2. Data-loss prevention
3. Jailbreaking
4. Sensitive prompt exposure
5. Prompt injection

Correct answer: C

Why: Jailbreaks attempt to elicit behavior the system is designed to block. It directly addresses the requirement in this scenario.

Option review:

A: Hijacking redirects the application behavior by exploiting model instructions and context. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: DLP controls reduce accidental or malicious data exfiltration. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Jailbreaks attempt to elicit behavior the system is designed to block. It directly addresses the requirement in this scenario.

D: Prompt content should not contain secrets and should be protected as application logic where appropriate. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Jailbreaking – Jailbreaks attempt to elicit behavior the system is designed to block.

Question 2

While planning a contact-center transformation, Blue Yonder Airlines identifies this requirement: pin an application to a tested prompt revision so changes can be evaluated and rolled back. Which option should the operations manager prioritize if the goal is to reduce manual handling? The pilot has representative data, and the team will measure the selected approach against an agreed acceptance threshold. The project has 4 downstream consumers and a monthly review of approximately 658 sampled interactions.

1. Reusable prompt templates
2. Experiment and evaluate systematically
3. Be specific about the task and constraints
4. Prompt versioning
5. Separate trusted instructions from untrusted retrieved content

Correct answer: D

Why: Versioning makes prompt changes auditable and reduces uncontrolled production drift. It directly addresses the requirement in this scenario.

Option review:

A: Templates reduce copy-and-paste inconsistency and improve maintainability. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Prompt engineering should be measured using repeatable tests. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Specific prompts provide clearer behavioral guidance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Versioning makes prompt changes auditable and reduces uncontrolled production drift. It directly addresses the requirement in this scenario.

E: Clear trust boundaries help mitigate prompt-injection risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Prompt versioning – Versioning makes prompt changes auditable and reduces uncontrolled production drift.

Question 3

A proof of concept at Woodgrove Bank exposed a design decision for the AI product manager: the solution must combine prompt instructions with enforceable filtering or policy controls where needed. Which option most directly solves that problem? The team will document the rationale for auditors and wants the recommendation to be defensible from the scenario facts. The rollout spans 9 application teams, each using the same approved requirement set for the next 695 days.

1. Prompt poisoning
2. Be specific about the task and constraints
3. Prompt hijacking
4. Keep instructions concise and relevant
5. Use guardrails around high-risk outputs

Correct answer: E

Why: Prompts alone are not a sufficient security or safety boundary. It directly addresses the requirement in this scenario.

Option review:

A: Poisoning introduces harmful content into data or context used to shape model behavior. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Specific prompts provide clearer behavioral guidance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Hijacking redirects the application behavior by exploiting model instructions and context. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Concise prompts can reduce distraction and token usage. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompts alone are not a sufficient security or safety boundary. It directly addresses the requirement in this scenario.

Learning point: Use guardrails around high-risk outputs – Prompts alone are not a sufficient security or safety boundary.

Question 4

Wide World Importers is documenting the target state for a sales-assistant rollout. The operations manager needs a solution that can recognize an attack that diverts the model from the intended task toward an attacker-controlled objective. Which option is the strongest fit? The team wants the least complex technically correct choice that satisfies the requirement. The evaluation set contains examples from 6 business workflows and 732 recent production cases.

1. Prompt hijacking
2. Data-loss prevention
3. Prompt-injection defense
4. Output filtering and validation
5. Infrastructure protection

Correct answer: A

Why: Hijacking redirects the application behavior by exploiting model instructions and context. It directly addresses the requirement in this scenario.

Option review:

A: Hijacking redirects the application behavior by exploiting model instructions and context. It directly addresses the requirement in this scenario.

B: DLP controls reduce accidental or malicious data exfiltration. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Prompt injection can manipulate model behavior, so applications need trust boundaries and enforceable authorization beyond prompting. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Validation prevents unsafe, malformed, or policy-violating outputs from directly affecting users or systems. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Infrastructure controls reduce attack surface around AI components. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Prompt hijacking – Hijacking redirects the application behavior by exploiting model instructions and context.

Question 5

VanArsdel Media is reviewing a internal search upgrade. The AI product manager has one primary requirement: standardize prompt structure while injecting request-specific variables. Which choice best fits the requirement? The workload has passed basic feasibility checks, so the remaining question is which approach best matches the requirement. The initial rollout covers 769 internal users across 3 business units.

1. Prompt A/B evaluation
2. Reusable prompt templates
3. Use guardrails around high-risk outputs
4. Prompt versioning
5. Separate trusted instructions from untrusted retrieved content

Correct answer: B

Why: Templates reduce copy-and-paste inconsistency and improve maintainability. It directly addresses the requirement in this scenario.

Option review:

A: Controlled evaluation helps teams choose prompt changes based on evidence. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Templates reduce copy-and-paste inconsistency and improve maintainability. It directly addresses the requirement in this scenario.

C: Prompts alone are not a sufficient security or safety boundary. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Versioning makes prompt changes auditable and reduces uncontrolled production drift. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Clear trust boundaries help mitigate prompt-injection risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Reusable prompt templates – Templates reduce copy-and-paste inconsistency and improve maintainability.

Question 6

During a design review for Datum Dynamics, the operations manager must compare prompt variants against a representative evaluation set rather than relying on one anecdotal response. The team also wants to meet a strict latency target. What should the team choose? Stakeholders have ruled out a broad redesign and want the choice that most precisely addresses the stated need. The workload processes about 806 requests during its busiest hour and has a documented fallback path.

1. Prompt injection
2. Separate trusted instructions from untrusted retrieved content
3. Experiment and evaluate systematically
4. Sensitive prompt exposure
5. Use guardrails around high-risk outputs

Correct answer: C

Why: Prompt engineering should be measured using repeatable tests. It directly addresses the requirement in this scenario.

Option review:

A: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Clear trust boundaries help mitigate prompt-injection risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Prompt engineering should be measured using repeatable tests. It directly addresses the requirement in this scenario.

D: Prompt content should not contain secrets and should be protected as application logic where appropriate. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompts alone are not a sufficient security or safety boundary. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Experiment and evaluate systematically – Prompt engineering should be measured using repeatable tests.

Question 7

Alpine Ski House is moving a knowledge-assistant rollout from pilot to production. The key decision is how to recognize untrusted input that attempts to override trusted instructions or manipulate the model into unsafe behavior. Which option is the strongest fit if the team wants to keep the design easy to explain? Operational ownership is already assigned, so the team is comparing technical fit rather than staffing models. The pilot uses 843 representative records from 5 approved data sources.

1. Infrastructure protection
2. Application security
3. Output filtering and validation
4. Prompt injection
5. Encryption at rest and in transit

Correct answer: D

Why: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. It directly addresses the requirement in this scenario.

Option review:

A: Infrastructure controls reduce attack surface around AI components. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Most AI systems are applications first and inherit common application-security risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Validation prevents unsafe, malformed, or policy-violating outputs from directly affecting users or systems. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. It directly addresses the requirement in this scenario.

E: Encryption is a baseline data-protection control. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Prompt injection – Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content.

Question 8

A workshop at Humongous Insurance focuses on a single decision: how to compare candidate prompt versions on a representative dataset before broad rollout. Which option should the operations manager recommend? Existing application interfaces can accommodate any of the listed choices, so functional fit is the deciding factor. The first release supports 2 departments and is reviewed every 880 days.

1. Use guardrails around high-risk outputs
2. Separate trusted instructions from untrusted retrieved content
3. Amazon Bedrock Prompt Management
4. Be specific about the task and constraints
5. Prompt A/B evaluation

Correct answer: E

Why: Controlled evaluation helps teams choose prompt changes based on evidence. It directly addresses the requirement in this scenario.

Option review:

A: Prompts alone are not a sufficient security or safety boundary. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Clear trust boundaries help mitigate prompt-injection risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Bedrock Prompt Management supports structured lifecycle management for prompts. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Specific prompts provide clearer behavioral guidance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Controlled evaluation helps teams choose prompt changes based on evidence. It directly addresses the requirement in this scenario.

Learning point: Prompt A/B evaluation – Controlled evaluation helps teams choose prompt changes based on evidence.

Question 9

For the personalization program at Graphic Design Institute, stakeholders need to reduce ambiguity by naming the audience, objective, scope, and required output format. Which concept, service, or technique most directly addresses this goal? Assume the required AWS capabilities are available in the selected Region and normal governance controls are in place. The service has a 917-millisecond internal response target for the affected workflow.

1. Be specific about the task and constraints
2. Keep instructions concise and relevant
3. Prompt poisoning
4. Prompt injection
5. Sensitive prompt exposure

Correct answer: A

Why: Specific prompts provide clearer behavioral guidance. It directly addresses the requirement in this scenario.

Option review:

A: Specific prompts provide clearer behavioral guidance. It directly addresses the requirement in this scenario.

B: Concise prompts can reduce distraction and token usage. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Poisoning introduces harmful content into data or context used to shape model behavior. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompt content should not contain secrets and should be protected as application logic where appropriate. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Be specific about the task and constraints – Specific prompts provide clearer behavioral guidance.

Question 10

Relecloud is comparing alternatives for its developer-productivity pilot. The operations manager needs to recognize malicious or corrupted prompt-related data that causes undesirable behavior. Which option is most appropriate while trying to limit exposure of sensitive data? The review committee wants a direct mapping from the requirement to the chosen capability. The team is comparing 4 candidate designs after a 954-day proof of concept.

1. Prompt injection
2. Prompt poisoning
3. Audit logging
4. Infrastructure protection
5. Prompt-injection defense

Correct answer: B

Why: Poisoning introduces harmful content into data or context used to shape model behavior. It directly addresses the requirement in this scenario.

Option review:

A: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Poisoning introduces harmful content into data or context used to shape model behavior. It directly addresses the requirement in this scenario.

C: Audit trails support accountability, troubleshooting, and compliance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Infrastructure controls reduce attack surface around AI components. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompt injection can manipulate model behavior, so applications need trust boundaries and enforceable authorization beyond prompting. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Prompt poisoning – Poisoning introduces harmful content into data or context used to shape model behavior.

Question 11

An architecture review at Adventure Works Manufacturing has narrowed a fraud-review pilot decision to one requirement: centrally create, test, version, and reuse prompts for Bedrock applications. What should the AI product manager select? The solution will serve multiple internal teams, so the recommendation should be reusable without changing the core requirement. The control owner requires evidence from 9 test groups before the 991-day release review.

1. Reusable prompt templates
2. Separate trusted instructions from untrusted retrieved content
3. Amazon Bedrock Prompt Management
4. Experiment and evaluate systematically
5. Be specific about the task and constraints

Correct answer: C

Why: Bedrock Prompt Management supports structured lifecycle management for prompts. It directly addresses the requirement in this scenario.

Option review:

A: Templates reduce copy-and-paste inconsistency and improve maintainability. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Clear trust boundaries help mitigate prompt-injection risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Bedrock Prompt Management supports structured lifecycle management for prompts. It directly addresses the requirement in this scenario.

D: Prompt engineering should be measured using repeatable tests. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Specific prompts provide clearer behavioral guidance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Amazon Bedrock Prompt Management – Bedrock Prompt Management supports structured lifecycle management for prompts.

Question 12

The operations manager at Proseware Services is preparing a recommendation for a analytics modernization. The recommendation must avoid burying the core task under unnecessary text. Which choice is the best match? The decision must follow the workload characteristics rather than a preference for the largest model or newest service. The project has 6 downstream consumers and a monthly review of approximately 68 sampled interactions.

1. Sensitive prompt exposure
2. Prompt hijacking
3. Prompt poisoning
4. Keep instructions concise and relevant
5. Be specific about the task and constraints

Correct answer: D

Why: Concise prompts can reduce distraction and token usage. It directly addresses the requirement in this scenario.

Option review:

A: Prompt content should not contain secrets and should be protected as application logic where appropriate. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Hijacking redirects the application behavior by exploiting model instructions and context. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Poisoning introduces harmful content into data or context used to shape model behavior. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Concise prompts can reduce distraction and token usage. It directly addresses the requirement in this scenario.

E: Specific prompts provide clearer behavioral guidance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Keep instructions concise and relevant – Concise prompts can reduce distraction and token usage.

Question 13

Lucerne Publishing has completed discovery for a compliance-assistant prototype. Before implementation, the AI product manager must decide how to prevent confidential system instructions or embedded secrets from being revealed to users. Which choice best satisfies that requirement? The security baseline is already defined; the decision here concerns the specific capability described in the requirement. The rollout spans 3 application teams, each using the same approved requirement set for the next 105 days.

1. Prompt poisoning
2. Vulnerability management
3. Data-loss prevention
4. Encryption at rest and in transit
5. Sensitive prompt exposure

Correct answer: E

Why: Prompt content should not contain secrets and should be protected as application logic where appropriate. It directly addresses the requirement in this scenario.

Option review:

A: Poisoning introduces harmful content into data or context used to shape model behavior. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Model security does not replace ordinary software vulnerability management. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: DLP controls reduce accidental or malicious data exfiltration. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Encryption is a baseline data-protection control. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompt content should not contain secrets and should be protected as application logic where appropriate. It directly addresses the requirement in this scenario.

Learning point: Sensitive prompt exposure – Prompt content should not contain secrets and should be protected as application logic where appropriate.

Question 14

While planning a forecasting initiative, Lamna Healthcare identifies this requirement: pin an application to a tested prompt revision so changes can be evaluated and rolled back. Which option should the operations manager prioritize if the goal is to reduce manual handling? The recommendation must solve the stated requirement without introducing unrelated platform complexity. The evaluation set contains examples from 8 business workflows and 142 recent production cases.

1. Prompt versioning
2. Use guardrails around high-risk outputs
3. Amazon Bedrock Prompt Management
4. Separate trusted instructions from untrusted retrieved content
5. Prompt A/B evaluation

Correct answer: A

Why: Versioning makes prompt changes auditable and reduces uncontrolled production drift. It directly addresses the requirement in this scenario.

Option review:

A: Versioning makes prompt changes auditable and reduces uncontrolled production drift. It directly addresses the requirement in this scenario.

B: Prompts alone are not a sufficient security or safety boundary. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Bedrock Prompt Management supports structured lifecycle management for prompts. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Clear trust boundaries help mitigate prompt-injection risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Controlled evaluation helps teams choose prompt changes based on evidence. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Prompt versioning – Versioning makes prompt changes auditable and reduces uncontrolled production drift.

Question 15

A proof of concept at Contoso Retail exposed a design decision for the AI product manager: the solution must reduce the chance that retrieved or user-supplied text overrides system intent. Which option most directly solves that problem? The design must remain supportable after launch, but no additional feature is required beyond the stated need. The initial rollout covers 179 internal users across 5 business units.

1. Jailbreaking
2. Separate trusted instructions from untrusted retrieved content
3. Prompt poisoning
4. Experiment and evaluate systematically
5. Be specific about the task and constraints

Correct answer: B

Why: Clear trust boundaries help mitigate prompt-injection risks. It directly addresses the requirement in this scenario.

Option review:

A: Jailbreaks attempt to elicit behavior the system is designed to block. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Clear trust boundaries help mitigate prompt-injection risks. It directly addresses the requirement in this scenario.

C: Poisoning introduces harmful content into data or context used to shape model behavior. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Prompt engineering should be measured using repeatable tests. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Specific prompts provide clearer behavioral guidance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Separate trusted instructions from untrusted retrieved content – Clear trust boundaries help mitigate prompt-injection risks.

Question 16

Fourth Coffee is documenting the target state for a agentic workflow trial. The operations manager needs a solution that can recognize crafted input intended to bypass safety restrictions or policy constraints. Which option is the strongest fit? A short pilot window means the team prefers an approach that can be evaluated with clear success criteria. The workload processes about 216 requests during its busiest hour and has a documented fallback path.

1. Encryption at rest and in transit
2. Prompt poisoning
3. Jailbreaking
4. Sensitive prompt exposure
5. Output filtering and validation

Correct answer: C

Why: Jailbreaks attempt to elicit behavior the system is designed to block. It directly addresses the requirement in this scenario.

Option review:

A: Encryption is a baseline data-protection control. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Poisoning introduces harmful content into data or context used to shape model behavior. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Jailbreaks attempt to elicit behavior the system is designed to block. It directly addresses the requirement in this scenario.

D: Prompt content should not contain secrets and should be protected as application logic where appropriate. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Validation prevents unsafe, malformed, or policy-violating outputs from directly affecting users or systems. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Jailbreaking – Jailbreaks attempt to elicit behavior the system is designed to block.

Question 17

Margie Travel is reviewing a contact-center transformation. The AI product manager has one primary requirement: centrally create, test, version, and reuse prompts for Bedrock applications. Which choice best fits the requirement? The architecture board will reject a choice that addresses a different problem from the one described. The pilot uses 253 representative records from 7 approved data sources.

1. Experiment and evaluate systematically
2. Prompt A/B evaluation
3. Reusable prompt templates
4. Amazon Bedrock Prompt Management
5. Keep instructions concise and relevant

Correct answer: D

Why: Bedrock Prompt Management supports structured lifecycle management for prompts. It directly addresses the requirement in this scenario.

Option review:

A: Prompt engineering should be measured using repeatable tests. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Controlled evaluation helps teams choose prompt changes based on evidence. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Templates reduce copy-and-paste inconsistency and improve maintainability. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Bedrock Prompt Management supports structured lifecycle management for prompts. It directly addresses the requirement in this scenario.

E: Concise prompts can reduce distraction and token usage. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Amazon Bedrock Prompt Management – Bedrock Prompt Management supports structured lifecycle management for prompts.

Question 18

During a design review for School of Fine Art, the operations manager must combine prompt instructions with enforceable filtering or policy controls where needed. The team also wants to meet a strict latency target. What should the team choose? Budget has been approved for the project, but the team still wants to avoid unnecessary recurring consumption. The first release supports 4 departments and is reviewed every 290 days.

1. Be specific about the task and constraints
2. Prompt injection
3. Separate trusted instructions from untrusted retrieved content
4. Experiment and evaluate systematically
5. Use guardrails around high-risk outputs

Correct answer: E

Why: Prompts alone are not a sufficient security or safety boundary. It directly addresses the requirement in this scenario.

Option review:

A: Specific prompts provide clearer behavioral guidance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Clear trust boundaries help mitigate prompt-injection risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Prompt engineering should be measured using repeatable tests. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompts alone are not a sufficient security or safety boundary. It directly addresses the requirement in this scenario.

Learning point: Use guardrails around high-risk outputs – Prompts alone are not a sufficient security or safety boundary.

Question 19

Northwind Analytics is moving a sales-assistant rollout from pilot to production. The key decision is how to prevent confidential system instructions or embedded secrets from being revealed to users. Which option is the strongest fit if the team wants to keep the design easy to explain? The team will validate the result with representative production examples before rollout. The service has a 327-millisecond internal response target for the affected workflow.

1. Sensitive prompt exposure
2. Infrastructure protection
3. Data-loss prevention
4. Prompt injection
5. Jailbreaking

Correct answer: A

Why: Prompt content should not contain secrets and should be protected as application logic where appropriate. It directly addresses the requirement in this scenario.

Option review:

A: Prompt content should not contain secrets and should be protected as application logic where appropriate. It directly addresses the requirement in this scenario.

B: Infrastructure controls reduce attack surface around AI components. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: DLP controls reduce accidental or malicious data exfiltration. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Jailbreaks attempt to elicit behavior the system is designed to block. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Sensitive prompt exposure – Prompt content should not contain secrets and should be protected as application logic where appropriate.

Question 20

A workshop at Litware Financial focuses on a single decision: how to standardize prompt structure while injecting request-specific variables. Which option should the operations manager recommend? The pilot has representative data, and the team will measure the selected approach against an agreed acceptance threshold. The team is comparing 6 candidate designs after a 364-day proof of concept.

1. Amazon Bedrock Prompt Management
2. Reusable prompt templates
3. Be specific about the task and constraints
4. Prompt versioning
5. Use guardrails around high-risk outputs

Correct answer: B

Why: Templates reduce copy-and-paste inconsistency and improve maintainability. It directly addresses the requirement in this scenario.

Option review:

A: Bedrock Prompt Management supports structured lifecycle management for prompts. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Templates reduce copy-and-paste inconsistency and improve maintainability. It directly addresses the requirement in this scenario.

C: Specific prompts provide clearer behavioral guidance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Versioning makes prompt changes auditable and reduces uncontrolled production drift. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompts alone are not a sufficient security or safety boundary. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Reusable prompt templates – Templates reduce copy-and-paste inconsistency and improve maintainability.

Question 21

For the document-intelligence project at A. Datum Research, stakeholders need to reduce the chance that retrieved or user-supplied text overrides system intent. Which concept, service, or technique most directly addresses this goal? The team will document the rationale for auditors and wants the recommendation to be defensible from the scenario facts. The control owner requires evidence from 3 test groups before the 401-day release review.

1. Sensitive prompt exposure
2. Experiment and evaluate systematically
3. Separate trusted instructions from untrusted retrieved content
4. Prompt poisoning
5. Use guardrails around high-risk outputs

Correct answer: C

Why: Clear trust boundaries help mitigate prompt-injection risks. It directly addresses the requirement in this scenario.

Option review:

A: Prompt content should not contain secrets and should be protected as application logic where appropriate. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Prompt engineering should be measured using repeatable tests. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Clear trust boundaries help mitigate prompt-injection risks. It directly addresses the requirement in this scenario.

D: Poisoning introduces harmful content into data or context used to shape model behavior. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompts alone are not a sufficient security or safety boundary. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Separate trusted instructions from untrusted retrieved content – Clear trust boundaries help mitigate prompt-injection risks.

Question 22

Coho Winery is comparing alternatives for its knowledge-assistant rollout. The operations manager needs to recognize an attack that diverts the model from the intended task toward an attacker-controlled objective. Which option is most appropriate while trying to limit exposure of sensitive data? The team wants the least complex technically correct choice that satisfies the requirement. The project has 8 downstream consumers and a monthly review of approximately 438 sampled interactions.

1. Infrastructure protection
2. Vulnerability management
3. Application security
4. Prompt hijacking
5. Sensitive prompt exposure

Correct answer: D

Why: Hijacking redirects the application behavior by exploiting model instructions and context. It directly addresses the requirement in this scenario.

Option review:

A: Infrastructure controls reduce attack surface around AI components. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Model security does not replace ordinary software vulnerability management. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Most AI systems are applications first and inherit common application-security risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Hijacking redirects the application behavior by exploiting model instructions and context. It directly addresses the requirement in this scenario.

E: Prompt content should not contain secrets and should be protected as application logic where appropriate. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Prompt hijacking – Hijacking redirects the application behavior by exploiting model instructions and context.

Question 23

An architecture review at Lucerne Retail has narrowed a claims-processing redesign decision to one requirement: compare candidate prompt versions on a representative dataset before broad rollout. What should the AI product manager select? The workload has passed basic feasibility checks, so the remaining question is which approach best matches the requirement. The rollout spans 5 application teams, each using the same approved requirement set for the next 475 days.

1. Amazon Bedrock Prompt Management
2. Separate trusted instructions from untrusted retrieved content
3. Experiment and evaluate systematically
4. Be specific about the task and constraints
5. Prompt A/B evaluation

Correct answer: E

Why: Controlled evaluation helps teams choose prompt changes based on evidence. It directly addresses the requirement in this scenario.

Option review:

A: Bedrock Prompt Management supports structured lifecycle management for prompts. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Clear trust boundaries help mitigate prompt-injection risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Prompt engineering should be measured using repeatable tests. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Specific prompts provide clearer behavioral guidance. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Controlled evaluation helps teams choose prompt changes based on evidence. It directly addresses the requirement in this scenario.

Learning point: Prompt A/B evaluation – Controlled evaluation helps teams choose prompt changes based on evidence.

Question 24

The operations manager at Tailspin Toys is preparing a recommendation for a personalization program. The recommendation must compare prompt variants against a representative evaluation set rather than relying on one anecdotal response. Which choice is the best match? Stakeholders have ruled out a broad redesign and want the choice that most precisely addresses the stated need. The evaluation set contains examples from 2 business workflows and 512 recent production cases.

1. Experiment and evaluate systematically
2. Sensitive prompt exposure
3. Prompt hijacking
4. Prompt poisoning
5. Jailbreaking

Correct answer: A

Why: Prompt engineering should be measured using repeatable tests. It directly addresses the requirement in this scenario.

Option review:

A: Prompt engineering should be measured using repeatable tests. It directly addresses the requirement in this scenario.

B: Prompt content should not contain secrets and should be protected as application logic where appropriate. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Hijacking redirects the application behavior by exploiting model instructions and context. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Poisoning introduces harmful content into data or context used to shape model behavior. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Jailbreaks attempt to elicit behavior the system is designed to block. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Experiment and evaluate systematically – Prompt engineering should be measured using repeatable tests.

Question 25

City Power and Light has completed discovery for a developer-productivity pilot. Before implementation, the AI product manager must decide how to recognize malicious or corrupted prompt-related data that causes undesirable behavior. Which choice best satisfies that requirement? Operational ownership is already assigned, so the team is comparing technical fit rather than staffing models. The initial rollout covers 549 internal users across 7 business units.

1. Toxicity filtering
2. Prompt poisoning
3. Jailbreaking
4. Infrastructure protection
5. Prompt-injection defense

Correct answer: B

Why: Poisoning introduces harmful content into data or context used to shape model behavior. It directly addresses the requirement in this scenario.

Option review:

A: Toxicity controls are one layer of output safety. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Poisoning introduces harmful content into data or context used to shape model behavior. It directly addresses the requirement in this scenario.

C: Jailbreaks attempt to elicit behavior the system is designed to block. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Infrastructure controls reduce attack surface around AI components. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompt injection can manipulate model behavior, so applications need trust boundaries and enforceable authorization beyond prompting. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Prompt poisoning – Poisoning introduces harmful content into data or context used to shape model behavior.

Question 26

While planning a fraud-review pilot, Consolidated Messenger identifies this requirement: pin an application to a tested prompt revision so changes can be evaluated and rolled back. Which option should the operations manager prioritize if the goal is to reduce manual handling? Existing application interfaces can accommodate any of the listed choices, so functional fit is the deciding factor. The workload processes about 586 requests during its busiest hour and has a documented fallback path.

1. Prompt A/B evaluation
2. Reusable prompt templates
3. Prompt versioning
4. Experiment and evaluate systematically
5. Amazon Bedrock Prompt Management

Correct answer: C

Why: Versioning makes prompt changes auditable and reduces uncontrolled production drift. It directly addresses the requirement in this scenario.

Option review:

A: Controlled evaluation helps teams choose prompt changes based on evidence. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Templates reduce copy-and-paste inconsistency and improve maintainability. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Versioning makes prompt changes auditable and reduces uncontrolled production drift. It directly addresses the requirement in this scenario.

D: Prompt engineering should be measured using repeatable tests. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Bedrock Prompt Management supports structured lifecycle management for prompts. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Prompt versioning – Versioning makes prompt changes auditable and reduces uncontrolled production drift.

Question 27

A proof of concept at Nod Publishers exposed a design decision for the AI product manager: the solution must avoid burying the core task under unnecessary text. Which option most directly solves that problem? Assume the required AWS capabilities are available in the selected Region and normal governance controls are in place. The pilot uses 623 representative records from 9 approved data sources.

1. Jailbreaking
2. Separate trusted instructions from untrusted retrieved content
3. Sensitive prompt exposure
4. Keep instructions concise and relevant
5. Prompt poisoning

Correct answer: D

Why: Concise prompts can reduce distraction and token usage. It directly addresses the requirement in this scenario.

Option review:

A: Jailbreaks attempt to elicit behavior the system is designed to block. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: Clear trust boundaries help mitigate prompt-injection risks. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Prompt content should not contain secrets and should be protected as application logic where appropriate. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Concise prompts can reduce distraction and token usage. It directly addresses the requirement in this scenario.

E: Poisoning introduces harmful content into data or context used to shape model behavior. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

Learning point: Keep instructions concise and relevant – Concise prompts can reduce distraction and token usage.

Question 28

Fabrikam Health is documenting the target state for a compliance-assistant prototype. The operations manager needs a solution that can recognize untrusted input that attempts to override trusted instructions or manipulate the model into unsafe behavior. Which option is the strongest fit? The review committee wants a direct mapping from the requirement to the chosen capability. The first release supports 6 departments and is reviewed every 660 days.

1. Infrastructure protection
2. Threat detection
3. Prompt-injection defense
4. Output filtering and validation
5. Prompt injection

Correct answer: E

Why: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. It directly addresses the requirement in this scenario.

Option review:

A: Infrastructure controls reduce attack surface around AI components. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

B: AI workloads require the same continuous security monitoring expected of other production systems. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

C: Prompt injection can manipulate model behavior, so applications need trust boundaries and enforceable authorization beyond prompting. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

D: Validation prevents unsafe, malformed, or policy-violating outputs from directly affecting users or systems. This can be appropriate in another scenario, but it does not most directly satisfy the requirement described here.

E: Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content. It directly addresses the requirement in this scenario.

Learning point: Prompt injection – Prompt injection attacks the instruction hierarchy by embedding malicious directions in user or retrieved content.