Amazon Web Services Updated AIP-C01 Exam Questions and Answers by tamara

Amazon Bedrock AgentCore Observability is the best fit because the requirement is specifically for built-in Amazon Bedrock visibility into agent interactions, tool behavior, and failures without custom instrumentation. AWS documentation states that AgentCore provides built-in metrics, logs, and traces for AgentCore modular services, and that this data can be viewed in Amazon CloudWatch. AgentCore observability also supports sessions, traces, and spans, where traces represent full request-response cycles and spans represent operations inside a trace. This directly matches the need to analyze multi-agent interactions, tool invocations, latency, throttling, and error behavior during peak traffic.

Option A is also correct because Amazon Bedrock AgentCore integrates with AWS X-Ray for distributed tracing of AI agents and tools. AWS X-Ray support helps follow requests across service boundaries and identify performance bottlenecks in agent and tool execution. CloudWatch provides curated GenAI observability views for AgentCore and can show operational health, metrics, traces, sessions, and error breakdowns. This gives the developer end-to-end visibility with minimal additional overhead because the core telemetry is service-provided rather than extracted through a custom pipeline.

Option B is incorrect because Container Insights focuses on container infrastructure and would not provide native visibility into Bedrock AgentCore agent reasoning paths or tool-level traces. Polling APIs with Lambda adds custom logic and operational overhead. Option C is incorrect because a custom ETL pipeline, DynamoDB storage, and QuickSight reporting do not satisfy the “built-in Amazon Bedrock capabilities” and “minimal overhead” requirements. Option D starts correctly with AgentCore Observability, but then adds custom Lambda processing and Grafana, which introduces unnecessary custom instrumentation and processing. Therefore, option A is the most AWS-aligned solution.

==========

Option A is the correct solution because it provides proactive, model-aware token management with fine-grained visibility and alerting, which is required for regulated financial workloads. Amazon Bedrock currently exposes token usage metrics after invocation, but it does not natively enforce proactive, model-specific token limits across multiple applications or business units.

By implementing model-specific tokenizers in AWS Lambda, the company can estimate input and output token usage before sending requests to Amazon Bedrock. This enables early detection of requests that are approaching or exceeding model limits and allows the application to block, truncate, or reroute requests proactively rather than reacting to failures.

Publishing token usage metrics to Amazon CloudWatch enables real-time monitoring and alerting at scale, easily supporting more than 5,000 requests per minute. Storing detailed token usage data in Amazon DynamoDB allows the company to attribute usage and costs to specific applications, teams, or business units—an essential requirement for regulatory reporting and internal chargeback.

Option B is incorrect because Amazon Bedrock Guardrails do not currently provide token quota enforcement or proactive token alerts. Option C is reactive and only analyzes failures after they occur. Option D throttles requests but cannot enforce token-based limits or provide per-model cost attribution.

Therefore, Option A best satisfies proactive alerting, scalability, compliance reporting, and cost allocation requirements with acceptable operational effort.

Option B best meets the requirement for reusable, versioned, and consistently governed components across multiple business units because it implements “platform-level standardization” through infrastructure as code plus automated compliance enforcement before deployment. Standardized CloudFormation templates provide reusable building blocks for security controls (identity, networking boundaries, encryption), observability practices (metrics, logs, traces), and RAG deployment patterns (knowledge base integration, ingestion pipelines, retrieval controls). This aligns with AWS guidance to operationalize well-architected patterns through repeatable templates rather than ad hoc implementations.

A centralized repository enables version control, change review, and governance of templates across all five business units. This satisfies the “versioned” and “reusable” requirements and provides a single source of truth for approved architectures. Integrating a CI/CD pipeline ensures that deployments are consistent and automated, reducing drift between business units and Regions.

CloudFormation Guard is most effective when used as a preventive control in the pipeline, not only after deployment. By running Guard rules during build or pre-deploy stages, the organization can enforce mandatory security and observability configurations and block noncompliant changes before they reach production. This supports consistent governance while still enabling business units to deploy quickly.

Option A performs compliance validation after deployment, which allows policy violations to be deployed first and remediated later. Option C provides governed provisioning but requiring console-based deployment reduces automation and can slow standardized CI/CD adoption; it also adds an additional governance layer that is not required to meet the stated needs. Option D is not enforceable and does not provide reusable, versioned, governed components.

Therefore, Option B provides the strongest, most scalable, and most consistently governed approach for standardized GenAI deployments across business units.