Overview
Domain 3 covers how to keep GenAI systems safe, private and accountable, across four task statements. Input and output safety controls cover Amazon Bedrock Guardrails for content filtering, custom moderation workflows, grounding answers in a knowledge base to reduce hallucinations, JSON Schema for structured output, layered pre- and post-processing filters and detection of prompt injection and jailbreak attempts. Data security and privacy cover VPC endpoints, IAM, Lake Formation, PII detection with Amazon Comprehend and Amazon Macie, masking and retention rules. Governance covers model cards in SageMaker AI, lineage with AWS Glue, source attribution, CloudTrail audits and continuous monitoring for misuse and drift. Responsible AI covers transparency through reasoning traces and citations, fairness evaluation and policy-compliant guardrails.
At 20%, this domain is about one-fifth of the scored items, and its controls appear inside scenarios from the other domains as well.
How it's tested
Domain 3 scenarios describe a safety, privacy or compliance gap in a GenAI application and ask for the control that closes it. Strong answers stack protections: validate input, constrain the model, check the output and log for audit, using managed features before custom code.
-
Block the harmful case
Toxic content, denied topics or prompt attacks are described, and you choose the Guardrails policy or detection layer.
-
Protect sensitive data
PII appears in prompts, logs or responses, and you pick detection, masking, network isolation or retention controls.
-
Prove accountability
An auditor or regulator needs evidence, and you choose model cards, lineage tracking, CloudTrail or decision logs.
A banking assistant sometimes includes account numbers from retrieved documents in its answers. Rewriting the system prompt to ask the model not to reveal them is unreliable. A Bedrock guardrail with sensitive information filters set to mask account-number patterns enforces the rule on every response. Because the requirement is consistent enforcement, a policy control outranks an instruction the model may ignore.
Task statements 4
Official task statements from the Amazon Web Services outline, in outline order.
3.1 Implement input and output safety controlsContent filtering, hallucination reduction, defense in depth and adversarial input detection.
- What it means
- This task covers filtering harmful inputs and outputs with Amazon Bedrock Guardrails and custom moderation workflows, reducing hallucinations by grounding in Bedrock Knowledge Bases, confidence scoring and JSON Schema output, layering Comprehend pre-filters, model guardrails, Lambda post-validation and API response filtering, and detecting prompt injection and jailbreaks with sanitization, safety classifiers and automated adversarial testing.
- What to understand
- Guardrails provide content filters, denied topics, word filters, sensitive information filters, contextual grounding checks and prompt attack detection, applied to input, output or both. Contextual grounding scores whether an answer is supported by the source and relevant to the question. Text-to-SQL can make some answers deterministic by querying data rather than generating facts.
- How it shows up
- A harmful input, ungrounded answer or attack is described, and you choose the safety layer or Guardrails policy.
- Common confusion
- Treating the system prompt as a security control; instructions can be overridden by injected text, so enforcement belongs in guardrails and validation.
3.2 Implement data security and privacy controlsNetwork isolation, access control, PII detection, masking and data retention.
- What it means
- This task covers securing FM environments with VPC endpoints (AWS PrivateLink), IAM policies, Lake Formation for fine-grained data access and CloudWatch monitoring, detecting PII with Amazon Comprehend and Amazon Macie, using Bedrock's data privacy features and guardrails, masking and anonymizing sensitive fields, and applying S3 Lifecycle retention rules.
- What to understand
- Bedrock does not use customer prompts or outputs to train base models, and traffic can stay on the AWS network through VPC endpoints. Comprehend detects PII in text in flight; Macie discovers sensitive data at rest in S3. Masking before the prompt is sent keeps data out of the model and logs entirely. Retention rules limit how long prompts and logs persist.
- How it shows up
- A privacy requirement or data exposure is described, and you choose isolation, detection, masking or retention.
- Common confusion
- Confusing Macie with Comprehend; Macie scans S3 data at rest, while Comprehend analyzes text passed to it.
3.3 Implement AI governance and compliance mechanismsModel cards, data lineage, source tracking, oversight frameworks and continuous monitoring.
- What it means
- This task covers compliance frameworks using SageMaker AI model cards, AWS Glue for lineage and the Glue Data Catalog for registering sources, metadata tags for source attribution, CloudTrail and CloudWatch Logs for decision and audit logging, organizational oversight aligned to policy and regulation, and automated monitoring for misuse, drift, bias drift and policy violations with alerting and remediation.
- What to understand
- Model cards document intended use, training data, evaluation results and limitations. Lineage shows which data fed which model or knowledge base. CloudTrail records API activity, while invocation logs record the prompts and responses themselves. Continuous monitoring turns governance from a one-time review into ongoing detection and remediation.
- How it shows up
- An audit, regulatory or oversight requirement is described, and you choose the documentation, lineage or monitoring control.
- Common confusion
- Expecting CloudTrail to capture prompt text; it logs API calls, while Bedrock model invocation logging captures request and response content.
3.4 Implement responsible AI principlesTransparency, fairness evaluation and policy-compliant AI systems.
- What it means
- This task covers making FM outputs transparent with user-facing explanations, confidence metrics in CloudWatch, source citations and Bedrock agent traces, evaluating fairness with defined metrics, A/B tests using Prompt Management and Flows and LLM-as-a-judge evaluations, and enforcing policy with guardrails, model cards that state limitations and Lambda compliance checks.
- What to understand
- Transparency means users can see why an answer was given and where it came from. Agent traces show the reasoning steps and tool calls. Fairness work compares outcomes across groups using consistent metrics and repeated evaluation. Model cards and guardrails turn written responsible AI policy into documented limits and enforced behavior.
- How it shows up
- A transparency, fairness or policy requirement is described, and you choose the explanation, evaluation or enforcement mechanism.
- Common confusion
- Assuming a one-time fairness test is enough; bias can drift, so evaluation needs to repeat as prompts, data and models change.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Amazon Bedrock Guardrails
Configurable safeguards applied to model inputs and outputs.
- Remember
- Works across models and with agents and knowledge bases.
- Tested as
- Core safety control questions.
- Trap
- Relying on system prompts instead.
-
Content filters
Guardrails categories such as hate, insults, sexual, violence and misconduct with strength levels.
- Remember
- Thresholds apply separately to input and output.
- Tested as
- Harmful content questions.
- Trap
- Setting one filter and ignoring output filtering.
-
Denied topics
Natural-language definitions of subjects the application must refuse.
- Remember
- Good for off-scope advice such as investment tips.
- Tested as
- Topic restriction questions.
- Trap
- Using word filters for whole topics.
-
Prompt attack filter
Guardrails detection of jailbreaks and prompt injection in user input.
- Remember
- Part of a layered defense with sanitization.
- Tested as
- Adversarial input questions.
- Trap
- Assuming it covers retrieved documents automatically.
-
Sensitive information filters
Block or mask PII types and custom regex patterns.
- Remember
- Masking preserves the rest of the response.
- Tested as
- PII output questions.
- Trap
- Blocking whole answers when masking suffices.
-
Contextual grounding check
Scores responses for grounding in the source and relevance to the query.
- Remember
- Reduces hallucinations in RAG answers.
- Tested as
- Hallucination questions.
- Trap
- Expecting it to work without reference content.
-
Amazon Macie vs. Amazon Comprehend
Macie finds sensitive data in S3; Comprehend detects PII in text.
- Remember
- At rest versus in flight.
- Tested as
- Privacy questions.
- Trap
- Swapping the two services.
-
VPC endpoints for Bedrock
Private connectivity through AWS PrivateLink.
- Remember
- Keeps traffic off the public internet.
- Tested as
- Network isolation questions.
- Trap
- Using a NAT gateway when private access is required.
-
Model invocation logging
Records Bedrock prompts and responses to CloudWatch Logs or S3.
- Remember
- Different from CloudTrail API records.
- Tested as
- Audit questions.
- Trap
- Expecting CloudTrail to show prompt text.
-
SageMaker AI model cards
Documentation of model purpose, data, evaluation and limits.
- Remember
- Supports compliance and transparency.
- Tested as
- Governance questions.
- Trap
- Treating them as runtime controls.
-
AWS Glue lineage and Data Catalog
Tracking and registering data sources used by AI systems.
- Remember
- Supports traceability and attribution.
- Tested as
- Data source tracking questions.
- Trap
- Relying on manual spreadsheets.
-
LLM-as-a-judge
Using an FM to score outputs against criteria such as fairness or harmfulness.
- Remember
- Scales evaluation; calibrate with human review.
- Tested as
- Fairness and evaluation questions.
- Trap
- Trusting judge scores without spot checks.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Bedrock Guardrails policy types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Content filters | Harm categories with thresholds | Broad harmful content | Ignoring output side |
| Denied topics | Subjects to refuse | Scope control | Using word lists for topics |
| Sensitive information filters | PII and regex block or mask | Data leakage prevention | Blocking instead of masking |
| Contextual grounding | Grounding and relevance scores | Hallucination control | Using without source context |
| Prompt attack detection | Jailbreak and injection detection | Adversarial input | Treating it as the only defense |
Audit and lineage sources
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| CloudTrail | Records AWS API calls | Who did what, when | Expecting prompt content |
| Model invocation logging | Prompts and responses | What the model saw and said | Leaving PII unmasked in logs |
| Glue Data Catalog and lineage | Data source registration and flow | Where data came from | Skipping attribution metadata |
PII protection tools
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Amazon Macie | Discover sensitive data in S3 | Data at rest | Using it on live prompts |
| Amazon Comprehend | Detect and redact PII in text | Text in flight | Using it to scan buckets |
| Guardrails sensitive information filters | Mask PII in model I/O | Enforced at inference | Assuming it cleans stored logs |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
System prompt as security
- What candidates pick
- Add 'never reveal secrets' to the system prompt.
- Why it looks right
- It is quick and needs no new service.
- Why it's wrong
- Prompt injection can override instructions; guardrails, input sanitization and output validation enforce rules independently of the model.
Clue to watch for Requirement says enforce or guarantee a behavior.
-
Macie for live prompts
- What candidates pick
- Use Macie to detect PII in chat messages.
- Why it looks right
- Macie is known for sensitive data.
- Why it's wrong
- Macie discovers sensitive data in S3 objects; real-time text PII detection uses Comprehend or Guardrails filters.
Clue to watch for PII in requests or responses at runtime.
-
CloudTrail shows prompts
- What candidates pick
- Use CloudTrail to review what users asked the model.
- Why it looks right
- CloudTrail is the audit service.
- Why it's wrong
- CloudTrail logs API calls and metadata; enable Bedrock model invocation logging to capture prompt and response bodies.
Clue to watch for Auditor needs prompt or response content.
-
Block the whole answer
- What candidates pick
- Configure guardrails to block any response containing PII.
- Why it looks right
- Blocking feels safest.
- Why it's wrong
- Masking removes the sensitive values while keeping the useful answer, which the requirement usually prefers.
Clue to watch for Users still need the rest of the response.
-
Bigger model stops hallucination
- What candidates pick
- Switch to a larger FM to stop invented facts.
- Why it looks right
- Larger models are more capable.
- Why it's wrong
- Grounding with retrieved sources, contextual grounding checks and structured outputs address hallucination more directly than model size.
Clue to watch for Answers must be verifiable against company data.
-
Only input filtering
- What candidates pick
- Apply guardrails to user input only.
- Why it looks right
- Stopping bad input seems sufficient.
- Why it's wrong
- Harmful or leaked content can still appear in outputs from retrieved data or model behavior, so output checks are also needed.
Clue to watch for Data leaks or unsafe text in responses.
Answer framework
Work through a Domain 3 safety or governance scenario with these steps.
- Classify the gap: harmful content, hallucination, adversarial input, data privacy, auditability, transparency or fairness. Naming the gap first keeps you from picking a privacy tool for a toxicity problem.
- Choose the managed control first, typically a specific Bedrock Guardrails policy, then add custom Comprehend or Lambda checks only where the managed policy falls short.
- Protect data along its path with VPC endpoints, least-privilege IAM, Lake Formation, masking before inference and retention rules for logs.
- Provide evidence with model invocation logging, CloudTrail, Glue lineage, source metadata and model cards that document limitations.
- Make protection continuous with monitoring for misuse, drift and bias, automated alerts and repeated evaluations as models and prompts change.
Practice question
Want more like this? The AIP-C01 practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start hands-on with Amazon Bedrock Guardrails, because most questions in this domain resolve to a specific guardrail policy. Create a guardrail in the console, add a content filter, a denied topic, a PII masking rule and a contextual grounding check, then test it with prompts designed to break it. Note which policy catches which attack and what happens on input versus output.
Next, study data protection as a path: from user to API Gateway, through a VPC endpoint to Bedrock, into logs and storage. At each point decide which service protects the data, keeping Macie, Comprehend and guardrail masking clearly separated. Enable model invocation logging once so you see how it differs from CloudTrail.
Then cover governance artifacts: SageMaker AI model cards, Glue lineage and source metadata. Finish with responsible AI, focusing on transparency through citations and agent traces and fairness evaluation that repeats over time. When reviewing practice questions, ask whether the chosen answer enforces the rule or merely requests it, since that distinction decides many items.
FAQ
How much of AIP-C01 is Domain 3?
AI Safety, Security, and Governance is 20% of the scored content, with four task statements covering safety controls, data privacy, governance and responsible AI.
What can Amazon Bedrock Guardrails do?
Filter harmful content, refuse denied topics, block words, mask or block PII and custom patterns, check contextual grounding and detect prompt attacks, on input, output or both.
How do I reduce hallucinations?
Ground answers in retrieved sources with Bedrock Knowledge Bases, apply contextual grounding checks, require structured JSON output and verify facts with post-processing where accuracy matters.
Does Bedrock use my prompts to train models?
AWS states that Bedrock does not use customer prompts or completions to train base models or share them with model providers.
What is the difference between Macie and Comprehend here?
Macie discovers sensitive data stored in S3. Comprehend detects and redacts PII in text that applications send to it, such as prompts and responses.
How do I show an auditor where an answer came from?
Return citations from the knowledge base, keep model invocation logs, record API activity in CloudTrail and register sources and lineage in the Glue Data Catalog.
What does responsible AI mean on this exam?
Transparent outputs with explanations and sources, fairness evaluated with consistent metrics and repeated testing, and policies enforced through guardrails and documented in model cards.
Other Artificial Intelligence & Machine Learning certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 3 knowledge
You have covered guardrails, prompt injection defense, PII protection, governance and responsible AI. Test whether you can choose controls that enforce rules rather than request them.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the AIP-C01 AI tutor Get any concept explained your way