Maintaining RAG permission boundaries | AWS Certified AI Practitioner (AIF-C01) original practice question

3.2Standard

Departments can view different documents.

Neither retrieval nor citations may cross the boundary.

Choose two appropriate designs.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

検索時に利用者の属性と文書のアクセス条件を照合する: Only authorized documents become candidates.
回答へ出典を付ける際も、利用者が閲覧可能な範囲だけを表示する: Citations must not create a separate leak.
検索後に権限を確認せず、最も似た文書を返す: RAG must not bypass authorization.
文書の部署属性を全て同じ値にする: The access boundary disappears.

Detailed explanation

CorrectMatch user attributes with document access conditions during retrieval

Only authorized documents become candidates.

CorrectShow citations only from the user's permitted scope

Citations must not create a separate leak.

IncorrectReturn the most similar document without checking access

RAG must not bypass authorization.

IncorrectGive every document the same department metadata

The access boundary disappears.

An example you can run in a temporary verification environment.

Amazon Bedrock Knowledge Bases公式のメタデータフィルターとAWS IAM・AIF-C01 Domain 3.2を確認する。

検索・生成・出典の各段階でアクセス境界を維持する方法を説明できる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-122

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20