AWS Certified AI Practitioner AIF-C01 Book

Tokens in generative AI models are the smallest units that the model processes, typically representing words, subwords, or characters. They are essential for the model to understand and generate language, breaking down text into manageable parts for processing.

Option A (Correct): "Tokens are the basic units of input and output that a generative AI model operates on, representing words, subwords, or other linguistic units": This is the correct definition of tokens in the context of generative AI models.

Option B: "Mathematical representations of words" describes embeddings, not tokens.

Option C: "Pre-trained weights of a model" refers to the parameters of a model, not tokens.

Option D: "Prompts or instructions given to a model" refers to the queries or commands provided to a model, not tokens.

AWS AI Practitioner References:

Understanding Tokens in NLP: AWS provides detailed explanations of how tokens are used in natural language processing tasks by AI models, such as in Amazon Comprehend and other AWS AI services.

The correct answer is A – Explainability. According to AWS Responsible AI documentation, explainability refers to an AI system’s ability to clearly communicate why it produced a given result. In healthcare, clinical decision support systems must provide traceable, understandable reasoning, especially when generating treatment recommendations. AWS highlights explainability as critical for high-impact domains such as medicine because doctors and patients must trust and understand the basis for AI-driven decisions. Tools like Amazon SageMaker Clarify support feature attribution, helping clinicians understand which patient factors (e.g., age, symptoms, lab values) influenced a recommendation. Privacy and security (B) protect data but do not provide rationale. Fairness (C) ensures equitable treatment across demographics but does not explain decisions. Data governance (D) focuses on handling and controlling data, not model decision transparency. Explainability is the AWS principle that ensures clinical users can interpret, validate, and rely on AI-generated recommendations for patient care.

Referenced AWS Documentation:

AWS Responsible AI Whitepaper – Explainability

Amazon SageMaker Clarify – Feature Attribution and Model Insights

The correct answers are A and E because both directly align with AWS best practices for securing generative AI services and data privacy in enterprise applications.

From the AWS Amazon Q Business documentation:

"AWS Key Management Service (KMS) integrates with Amazon Q Business to encrypt sensitive data at rest. You can use customer-managed KMS keys to meet compliance requirements."

And:

"You must configure IAM access controls to manage which users and applications can access Amazon Q Business indexes, ensuring that only authorized users can retrieve information."

Explanation of other options:

B. Cross-account access is not a common requirement for internal enterprise use of Amazon Q Business unless explicitly sharing data across organizations. It’s not a requirement for securing access.

C. Amazon Inspector is a vulnerability management tool for EC2 and containers. It is unrelated to Amazon Q authentication or security.

D. Allowing public access would violate security and privacy principles and directly contradict the stated requirement.

Referenced AWS AI/ML Documents and Study Guides:

Amazon Q Business Developer Guide – Security and Identity Management

AWS KMS Documentation – Integration with Bedrock and Amazon Q

AWS Certified Machine Learning Specialty Guide – Responsible AI and Governance Section

Building and training a generative AI model from scratch provides the company with the most ownership and control over security responsibilities. In this scenario, the company is responsible for all aspects of the security of the data, the model, and the infrastructure.

Option D (Correct): "Building and training a generative AI model from scratch by using specific data that a customer owns": This is the correct answer because it involves complete ownership of the model, data, and infrastructure, giving the company the highest level of responsibility for security.

Option A: "Using a third-party enterprise application that has embedded generative AI features" is incorrect as the company has minimal control over the security of the AI features embedded within a third-party application.

Option B: "Building an application using an existing third-party generative AI foundation model (FM)" is incorrect because security responsibilities are shared with the third-party model provider.

Option C: "Refining an existing third-party generative AI FM by fine-tuning the model with business-specific data" is incorrect as the foundation model and part of the security responsibilities are still managed by the third party.

AWS AI Practitioner References:

Generative AI Security Scoping Matrix on AWS: AWS provides a security responsibility matrix that outlines varying levels of control and responsibility depending on the approach to developing and using AI models.