3.2Standard
Departments can read different policies.
Do not let another department's document enter an answer.
Choose two appropriate designs.
× Incorrect
Attach authorization metadata, filter at retrieval, recheck access before generation and caching, and audit the path.
Detailed explanation
CorrectRecheck access after retrieval and before generation and audit the path
Indexes and caches are included in the protection boundary.
IncorrectReturn a close vector match regardless of authorization
Similarity does not grant access.
IncorrectUse one shared cache for all users
Results can cross user boundaries.
CorrectAttach department and classification metadata and filter by user authorization
Only documents the user may read become candidates.
Check official documentation
Compare the following points with the official documentation.
Amazon Bedrock Knowledge Bases公式のメタデータフィルターとAIF-C01 Domain 3.2を確認する。
Official references
What to confirm
類似度検索と閲覧権限を分離し、認可フィルターを検索経路へ組み込める。
Key points
- Metadata filter
- Least privilege
- Cache isolation
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Authorization filter
A condition that restricts retrieval to resources a principal may access.
Metadata
Attributes such as classification, owner, version, or retention attached to an item.
Question IDAWS-AIF-199
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue