Sanitizing generated output | AWS Certified AI Practitioner (AIF-C01) original practice question

5.1Standard

Display AI answers as HTML and links.

Do not execute generated text.

Choose two controls.

Hint 1: Focus on the requirement

Identify what must change and what must remain unchanged. Then choose the command whose scope matches that requirement.

Hint 2: Check each command's role

Separate commands that display information, change state, remove data, or affect a child process.

HTMLエスケープ、許可要素、URLスキーム・ドメイン制限を適用する: XSS and unsafe links are reduced.
構造化出力をスキーマ検証し、表示処理とツール実行を分離する: Text cannot become an action automatically.
モデル出力を信頼してinnerHTMLへそのまま挿入する: Generated text can execute.
リンクなら全てのURLスキームを許可する: Dangerous protocols are accepted.

Detailed explanation

CorrectHTML-escape output and restrict URL schemes, domains, and elements

XSS and unsafe links are reduced.

CorrectValidate structured output and separate display from tool execution

Text cannot become an action automatically.

IncorrectInsert output directly into innerHTML

Generated text can execute.

IncorrectAllow every URL scheme

Dangerous protocols are accepted.

An example you can run in a temporary verification environment.

AWS公式AIF-C01 Domain 5.1の生成出力、アプリケーションセキュリティ、入力検証を確認する。

AI出力を表示・処理する境界でXSS、危険URL、意図しない実行を防げる。

Foundation review

Check whether the command acts on the current shell, a new process, an existing process, or a file.

Use the supplied command and compare the output with the expected result.

Question IDAWS-AIF-407

EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認

Last technical review2026-08-20