2.3Standard
Insert user name, product name, and request text into a prompt.
Prevent values from becoming instructions or executable HTML.
Choose two appropriate practices.
× Incorrect
Escape and delimit variables as data, validate them, and sanitize generated output before display or execution.
Detailed explanation
IncorrectInsert model output into HTML without sanitizing
XSS and sensitive-display risks remain.
CorrectValidate variable size and content and sanitize output
Both injection and display attacks are addressed.
IncorrectAllow template-control characters in variables
They can change the prompt structure.
CorrectEscape variables into a fixed data field with roles and delimiters
Values are less able to alter prompt structure.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 2.3・5.1のプロンプトインジェクションと出力保護を確認する。
Official references
What to confirm
テンプレート変数を信頼された指示から分離する実装を説明できる。
Key points
- Variables
- Escaping
- Sanitization
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Template variable
An external value inserted into a predefined prompt or message template.
Escaping
Encoding special characters so inserted data cannot change the surrounding syntax or role.
Question IDAWS-AIF-179
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue