AWS Certified Generative AI Developer - Professional (AIP-C01) Study Guide

Domain 1: Foundation Model Integration, Data Management, and Compliance

Key concepts you must know · 233 practice questions

The Converse API gives one consistent request and response format across supported Bedrock providers, so switching models usually means only changing the modelId; InvokeModel instead requires a provider-specific JSON schema per model family.
Converse does not support every Bedrock model; embeddings-only models return vectors rather than conversational completions and must be called through InvokeModel.
Choosing a model with a large enough context window is the key requirement for summarizing a very long document in a single request without splitting it, since the window caps combined input plus output length.
Temperature, top-p, and top-k all shape randomness and diversity in generated text, while max tokens caps only the generated output length, not the input prompt length.
RAG is favored when information changes often, when teams want to avoid building a labeled dataset, and when answers must be traceable to specific source documents; a fixed permanent style is better instilled through fine-tuning.
In a RetrieveAndGenerate response, the citations array pairs each answer segment with its retrievedReferences, including the supporting chunk content and source location, so users can trace and verify each part of the answer.
Zero-shot prompting provides only a task description with no worked examples; asking the model to reason step by step before answering is the standard way to elicit chain-of-thought output.
Prefilling the reply with an opening brace and using a tool or function-calling schema both push output toward valid, clean JSON.
Bedrock requires model access to be explicitly requested and granted per account and Region before invocation, separate from IAM permissions.
Using Bedrock for protected health information requires confirming it is on AWS's HIPAA eligible services list and that a Business Associate Addendum has been signed; a customer's prompts and outputs are never shared with or used to benefit other Bedrock customers.
The epoch hyperparameter sets how many full passes a fine-tuning job makes over the entire training dataset.
Semantic chunking uses an embedding model to place chunk boundaries where meaning shifts, and metadata attributes used in retrieval filters must be defined through the data source's metadata files supplied during ingestion.
Streaming responses are consumed by iterating over incremental events and appending each text delta as it arrives; passing a fixed seed to an image request reproduces identical output across runs with the same settings.

Domain 2: Implementation and Integration

Key concepts you must know · 195 practice questions

The pgvector extension adds a native vector column type and similarity search to Aurora PostgreSQL, so embeddings can be joined with existing relational data via SQL without a separate vector service.
Amazon OpenSearch Serverless offers a vector search collection type purpose-built for dense embeddings; on a knn_vector field the engine parameter selects the ANN library (Faiss, NMSLIB, or Lucene) and space_type sets the distance metric.
Cosine similarity scores vectors purely by the angle between them, ideal for normalized embeddings, while dot product preserves magnitude so encoded signals like popularity can influence ranking.
A stopReason of tool_use means the app must read the toolUse block (tool name, arguments, toolUseId), execute the tool, and append a toolResult message referencing that toolUseId, then call Converse again.
Forcing a tool call eliminates stray commentary because the model must populate defined arguments in a structured toolUse block, leaving no free-text channel; a plain 'reply only in JSON' instruction can still be violated.
Multi-step tool chains work by looping the conversation, returning each toolResult so the model can decide the next tool call; a supervisor agent delegating subtasks to specialized workers is the multi-agent collaboration pattern.
Amazon Bedrock Agents provide a managed reasoning and orchestration loop, and function details let a developer describe an action group's operations as a simple list of functions instead of a full OpenAPI document.
A prompt cache hit requires reusing the exact prefix text up through the defined cache breakpoint; any change to the system prompt, tool definitions, or earlier turns invalidates the cache and forces full reprocessing.
Reranking uses a more expensive model to jointly score each retrieved passage against the query, producing a more accurate final ordering than the initial retrieval.
Server-sent events push a one-way token stream over a single long-lived HTTP response, well suited to browsers; streaming improves perceived latency but does not reduce total generation time.
Issuing a job identifier and letting the client poll decouples request submission from long processing, and routing by expected complexity keeps short queries fast and synchronous while long ones use an async path.
A dead-letter queue with a maximum receive count captures messages that repeatedly fail instead of retrying forever.
Updated source content becomes searchable only after the changed chunks are re-embedded and written back to the vector index; conversation summarization condenses older turns into a short recap to save tokens.

Domain 3: AI Safety, Security, and Governance

Key concepts you must know · 149 practice questions

Bedrock Guardrails apply to both prompt and response because different risks surface at different stages: injected instructions arrive in input while data leakage or a leaked system prompt appears in output.
Guardrails content filter strength levels are None, Low, Medium, and High (Firm is not valid); the Misconduct category targets requests for help with criminal or unethical activity.
Word filters match the literal configured words or phrases, whereas denied topics use a natural-language definition so the guardrail recognizes semantically related requests rather than keywords.
The Guardrails sensitive information filter includes managed PII entity types such as email address and phone number that are recognized automatically.
Malicious instructions embedded in a document that is later retrieved and fed to the model is a classic indirect prompt injection; grounding output in retrieved official API docs reduces fabricated method names.
Tenant isolation for a shared retrieval Lambda means deriving the knowledge base ID from the authenticated session server-side, never trusting a model-supplied or user-supplied ID, so one tenant cannot reach another's data.
Before a sensitive action, the Lambda should independently verify that a model-supplied parameter like an account ID belongs to the authenticated caller; privilege separation limits jailbreak damage to narrowly scoped authorized tools.
Human-in-the-loop review inserts a qualified person as a checkpoint before consequential output is acted on, such as requiring physician sign-off before an AI treatment draft reaches a patient.
Amazon Bedrock service quotas are scoped to each AWS account and Region combination, not shared globally, so a quota change in one Region has no effect on another.
Attribute shared-account Bedrock spend by activating cost allocation tags so Cost Explorer can group billed costs by tag key, and by assigning distinct inference profiles per team.
An endpoint policy attached to a shared VPC interface endpoint restricts which API actions can be called through it, and the InvocationServerErrors metric counts requests that failed with a server-side error for alarming.
A systematic quality gap tied to non-native phrasing points to biased or underrepresented patterns in the training data, and AI-assisted opinion content should be clearly labeled and kept distinct from verified reporting.

Domain 4: Operational Efficiency and Optimization for GenAI Applications

Key concepts you must know · 91 practice questions

Because API Gateway enforces a fixed maximum integration timeout, long-running generation should be handled asynchronously by returning a job reference immediately and letting the client poll or await notification; keep Lambda's timeout shorter than the gateway's and the client at least as patient.
Provisioned throughput can beat on-demand pricing when a workload sustains high, predictable volume around the clock, since reserved capacity's effective per-request cost can fall below accumulated on-demand token charges.
Providers price generated output tokens above input tokens because generation is autoregressive and sequential, consuming more compute per token, so long summaries cost more; stop sequences and length guidance cut trailing output tokens.
Right-size to a smaller model when evaluation shows its accuracy is within an acceptable margin of the larger one at lower cost, driven by measured results rather than an assumed quality delta.
Estimated cost per request built from expected token volumes gives a directly comparable financial measure, and passing only the relevant sections of a source document cuts input tokens per question.
Prompt caching saves only when the cached segment is an exact, unchanged prefix reused across calls before it expires; a daily-changing value in the prefix breaks the exact-match requirement.
Issuing independent model calls concurrently lets their latencies overlap instead of adding up, while summarizing older conversation turns keeps essential context using far fewer tokens.
An automated evaluation stage that runs a new prompt against a fixed regression set and scores outputs catches quality regressions before promotion; a gradual load test reveals the concurrency at which throttling begins.
Cap retry attempts and the exponential backoff delay so a prolonged capacity shortage does not turn into an indefinite hang or unreasonably long waits.
Deploy identical CDK stack templates across environments and vary only input parameters, such as passing the foundation model identifier per environment so staging can test a newer model while production keeps the current one.
Separate AWS accounts per environment under an AWS Organization give stronger isolation, independent service quotas, and smaller blast radius than aliases within one account.
A CloudWatch dashboard tagging latency, token, and error-rate metrics by release version enables direct before-and-after comparison across releases; a smaller, faster embedding model raises ingestion throughput when that step is the bottleneck.

Domain 5: Testing, Validation, and Troubleshooting

Key concepts you must know · 83 practice questions

Reading an agent trace in its natural chronological order (preprocessing, orchestration reasoning, tool or knowledge base calls, post-processing) mirrors the order the agent executed and shows where its understanding diverged.
Comparing segment durations in a trace localizes latency to model invocation, orchestration, or a tool call, and instrumenting a Lambda's own external calls narrows a slow tool call to the specific dependency.
Temperature 0 favors the highest-probability token and makes output far more consistent but not guaranteed identical, because floating-point differences or backend routing can still add nondeterminism.
Deterministic sampling, semantic similarity assertions, and JSON schema validation together reduce flaky LLM tests by tolerating valid rewording and checking structure instead of exact text.
Faithfully reflecting irrelevant retrieved chunks points to a retrieval-stage problem (embedding mismatch, poor chunking, or missing documents), not a generation failure; feeding a known-correct passage directly isolates the generation step.
Lowering temperature and instructing the model to rely only on supplied context both reduce fabricated content, since high temperature raises run-to-run variation and invented specifics even with grounded context.
Adversarial guardrail testing confirms policy-violating inputs are actually detected and blocked, and reviewing the guardrail intervention trace reveals which filter category and confidence level blocked a legitimate question.
ROUGE is a recall-oriented n-gram overlap metric, accuracy penalizes correct but differently worded paraphrases, and BERTScore's embedding-based comparison tolerates paraphrasing better than ROUGE.
Using an LLM as a judge introduces its own systematic biases, so its scores should be periodically checked against human judgment; random traffic assignment is what makes an A/B test's comparison statistically valid.
An effective canary plan routes a small share of traffic to the new model, compares canary metrics to the baseline, and defines automated rollback triggers on statistically significant error-rate rises or quality drops.
Repeatedly invoking the same action with little variation until hitting the iteration cap is the signature of an orchestration loop.
Snapshotting retrieved chunks for fixed queries and measuring precision and recall against a labeled reference set evaluates retrieval quality independent of generation; version the golden dataset in source control alongside prompt templates, tagged to a model version.
Splitting oversized documents into smaller files under the per-document size limit lets them ingest successfully on the next sync.

AWS Certified Generative AI Developer - Professional (AIP-C01) exam tips

Learn the Converse versus InvokeModel split cold: Converse gives a unified format for conversational text and multimodal models, while embeddings-only models require InvokeModel. Many questions hinge on this distinction.
For any RAG scenario, trace the failure to the right stage. Irrelevant-but-faithful answers mean retrieval is broken; fabricated content on good context means generation or temperature; use citations and precision/recall to reason about it.
Memorize the exact Guardrails vocabulary: filter strengths are None, Low, Medium, High; word filters are literal; denied topics use natural-language definitions; and guardrails screen both prompt and response.
When a question involves API Gateway plus long generation, default to an asynchronous job-and-poll pattern, and remember prompt caching only pays off with an unchanged exact prefix reused before expiry.
Watch for security answers that trust model or user input. The correct choice almost always resolves tenant identity and sensitive parameters server-side from the authenticated session, not from the model.

Study guide FAQ

What is the passing score and format of the AIP-C01 exam?

The AWS Certified Generative AI Developer - Professional exam requires a scaled score of 750 to pass. It runs 170 minutes and draws from a large item pool covering five domains.

How much does the exam focus on Amazon Bedrock specifically?

Heavily. Bedrock is the central platform, so you must know the Converse API, model access and quotas, Bedrock Agents, Knowledge Bases and RetrieveAndGenerate, Guardrails, and prompt caching in detail.

Do I need to know when to choose RAG versus fine-tuning?

Yes. RAG suits frequently changing information, avoids building a labeled dataset, and makes answers traceable to sources, while fine-tuning is better for instilling a fixed, permanent style or behavior.

How deep is the coverage of vector search and embeddings?

Fairly deep. Expect questions on pgvector in Aurora PostgreSQL, OpenSearch Serverless vector collections, knn_vector engine and space_type settings, cosine versus dot-product similarity, reranking, and re-embedding after content changes.

Related AWS resources

Test yourself: 751 AWS Certified Generative AI Developer - Professional (AIP-C01) practice questions