Identifying prompt injection | AWS Certified AI Practitioner (AIF-C01) original practice question

5.1Standard

A retrieval chatbot executed an instruction contained in an uploaded document and exposed sensitive information.

Users can upload documents.

Which description is most accurate?

Hint 1: Focus on the requirement

Trace who can edit the document and which text the model treated as instructions. Separate document content from authority to act.

Hint 2: Key terms

Review the trust boundaries and permission checks relevant to this scenario.

Indirect prompt injection: Instructions in external content, such as a retrieved document, try to influence intended model behavior or policy. Trace the entry point separately from the impact.
Evidence versus authority: A document can support an answer without being authorized to change application policy or access to sensitive information.

Detailed explanation

CorrectUntrusted text is trying to override the application's instructions

The attack mixes data with instructions and attempts to change the model's intended behavior.

IncorrectIt is a normal technique for increasing output length

The behavior is a security attack, not a benign prompting technique.

IncorrectIt is an encrypted-storage availability failure

This is an input and instruction-boundary risk, not storage availability.

IncorrectThe only cause is too little training data

The key issue is treating untrusted content as an instruction.

Check official documentation

Compare the following points with the official documentation.

Review Task 5.1 and the prompt-injection guidance. In a hypothetical user-uploaded document, distinguish evidence for an answer from instructions trying to change application policy, then outline the input path and the boundaries leading to disclosure.

Official references

What to confirm

Identify indirect instruction injection through retrieved content and distinguish it from insufficient knowledge or encryption at rest.

Key points

Untrusted input
Instruction priority
Permission separation

Notes

Environment: Reference review of official documentation and hypothetical examples; no AWS API calls, business data access, or downstream execution are required.
Internal storage or retrieval relevance alone does not give document text instruction authority. Check its origin, editors, and role.
Delimiters and system instructions are only part of the defense. Independently limit sensitive data access and privileged actions if model behavior is influenced.

Foundation review

Indirect prompt injection

Instructions in external content, such as a retrieved document, try to influence intended model behavior or policy. Trace the entry point separately from the impact.

Evidence versus authority

A document can support an answer without being authorized to change application policy or access to sensitive information.

Question IDAWS-AIF-034

EnvironmentReference review of official documentation and hypothetical examples; no AWS API calls, business data access, or downstream execution are required.

Last technical review2026-10-26

Report an error or rights issue