5.1Standard
Display AI answers as HTML and links.
Do not execute generated text.
Choose two controls.
× Incorrect
Escape HTML, restrict URL schemes and domains, validate schemas, and separate rendering from tool execution.
Detailed explanation
CorrectValidate structured output and separate display from tool execution
Text cannot become an action automatically.
IncorrectAllow every URL scheme
Dangerous protocols are accepted.
IncorrectInsert output directly into innerHTML
Generated text can execute.
CorrectHTML-escape output and restrict URL schemes, domains, and elements
XSS and unsafe links are reduced.
Check official documentation
Compare the following points with the official documentation.
AWS公式AIF-C01 Domain 5.1の生成出力、アプリケーションセキュリティ、入力検証を確認する。
Official references
What to confirm
AI出力を表示・処理する境界でXSS、危険URL、意図しない実行を防げる。
Key points
- Escaping
- URL restriction
- Execution boundary
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
Output sanitization
Removing or neutralizing content that could violate a display or execution policy.
HTML escaping
Encoding markup characters so text is displayed instead of interpreted as HTML.
Question IDAWS-AIF-407
EnvironmentAWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
Last technical review2026-08-20
Report an error or rights issue