Q2AI Safety, Security, and GovernanceMultiple answers
A company uses an AWS Organizations organization with all features enabled to manage multiple AWS accounts. Employees use Amazon Bedrock in multiple accounts. The company must prevent particular topics and proprietary information from being included in prompts submitted to Amazon Bedrock models. The company must ensure that employees can use only approved Amazon Bedrock models. The company centrally administers IAM roles for employees. Which combination of solutions will satisfy these requirements? (Choose two.)
Select 2 answers.
← → navigate · a answer
Community votes
Discussion · 7
B, D 2
Why the other options are incorrect:
A & C (Permissions Boundaries): While Permissions Boundaries can restrict what a user can do, they must be applied to each IAM role individually. In a multi-account environment where you already have AWS Organizations, SCPs are the more scalable and standard method for central governance.
E (Masking Policy): As mentioned, masking is better for PII redaction in responses. Blocking is the appropriate mechanism for enforcing company policy on what can be sent to the model.
B, D 2
Correct Answer
B, D 2
"The company must prevent" - D because E only mask.
B, D 2
Simplicidad: Un mecanismo (SCP) vs dos (SCP + Boundary)
Best practice AWS: SCP para controles organizacionales
Menor overhead: No necesitas gestionar boundaries en cada rol
D 1
Gotta say, D makes the most sense. It directly addresses the problem statement.
B, D 1
The answers are B and D because the SCP enforces both model approval and mandatory guardrail usage at the organization level, while CloudFormation StackSets deploys a consistent block-filtering guardrail across all accounts — together providing centralized, enforceable content governance and model access control across the entire AWS organization.
0
Why the others are wrong
A: A permissions boundary cannot be used to enforce the required guardrail identifier in the way described. The organization-wide enforcement belongs in an SCP.
B: The SCP can enforce the guardrail requirement, but it does not provide the model restriction through the centrally administered IAM roles as effectively as the permissions boundary in C.
E: Masking redacts sensitive information rather than preventing it from being submitted. The requirement says to prevent particular information from being included, so blocking is the appropriate behavior.
Answer: C and D.