Free AIP-C01 Web TestEngine Demo

Q25 Single choice

A regulated company invokes Amazon Bedrock from private application subnets. The security team requires model traffic to stay on private AWS network paths, requests to use least-privilege authorization, and stored prompts to be encrypted with customer managed keys.

Which design best satisfies these controls?

A
Route model calls through a public NAT gateway, and rely on HTTPS to satisfy all private connectivity requirements.
B
Use public model endpoints but restrict source IP addresses with an application allow list.
C
Disable model invocation logs so sensitive data is never written outside the application subnet.
D
Use AWS PrivateLink or VPC interface endpoints where supported, IAM policies scoped to required Bedrock actions, and AWS KMS customer managed keys for stored artifacts.

AIP-C01 Web TestEngine demo