AWS Certified Professional Changed AIP-C01 Questions

Option C best meets the requirements by combining native Amazon Bedrock logging with adaptive monitoring and minimal operational overhead. Amazon Bedrock model invocation logging can be sent directly to CloudWatch Logs, where detailed fields such as InputTokenCount, OutputTokenCount, and tool invocation metadata are captured for each request.

CloudWatch metric filters allow extraction of structured metrics from logs, including tool-specific token consumption patterns. By defining filters per tool integration, the company can isolate which tools are responsible for increased token usage without building custom log-processing pipelines.

CloudWatch anomaly detection provides automatic baseline modeling and dynamic thresholds based on historical traffic patterns. Unlike static alarms, anomaly detection adapts as usage evolves, making it ideal for applications with changing workloads or seasonal usage patterns. This directly satisfies the requirement to automatically adjust thresholds as traffic patterns change.

When abnormal token consumption occurs, anomaly detection alarms trigger immediately, enabling rapid investigation and remediation. Because this solution uses fully managed AWS services without custom analytics jobs or manual threshold tuning, it significantly reduces operational effort.

Option A fails to adapt to changing patterns. Option B introduces batch analysis and delayed insights. Option D requires manual intervention and custom code, increasing maintenance burden.

Therefore, Option C provides the most scalable, adaptive, and low-maintenance solution for monitoring and controlling token consumption in Amazon Bedrock–based applications.

The correct combination is A, B, and D because these three options collectively satisfy the mandatory requirements for structured extraction, PII redaction before inference, regional human review, data residency, auditability, and high-scale availability with managed AWS services.

Option A is essential because Amazon Textract is the AWS-managed service designed to extract structured data from scanned documents such as forms, tables, and financial statements. Textract provides confidence scores, and Amazon Augmented AI (A2I) is purpose-built to route low-confidence extractions to human reviewers. Deploying Textract and A2I within the same Region ensures that the human review loop remains regionally constrained, meeting strict data residency requirements for applicants.

Option B satisfies the requirement to redact PII before inference by using AWS Lambda preprocessing. It also adds Amazon Bedrock guardrails to enforce safety controls on model outputs. Region-specific IAM roles ensure that only authorized principals in the correct Region can access the extracted data and invoke downstream services, strengthening residency enforcement and auditability.

Option D ensures that source documents are stored in Amazon S3 in the same Region as the applicant. Object metadata and tagging provide an auditable trail, supporting compliance reporting and traceability. S3 also provides the durability and availability needed to support 99.9% application availability as part of a well-architected pipeline.

Option C is not the correct approach for structured extraction from scans. Option E adds useful quality validation but is not strictly required to meet the stated requirements compared to A, B, and D. Option F is unrelated to the extraction/redaction/residency workflow requirements.

Therefore, A, B, and D are the best three choices to meet all stated requirements with minimal operational overhead.

Option C is the correct solution because it provides a secure, scalable, and standards-compliant way to expose an MCP server to an AI agent while enforcing strong user authorization. The Model Context Protocol supports HTTP-based transports for remote MCP servers, making Streamable HTTP the appropriate choice when the server is hosted as a managed service rather than a local process.

Hosting the MCP server in AWS Lambda enables automatic scaling and cost-efficient execution. By placing Amazon API Gateway in front of the Lambda function, the company creates a secure, managed HTTP endpoint that the AI agent can invoke reliably. This architecture cleanly separates transport, authentication, and business logic, which aligns with AWS serverless best practices.

Using Amazon Cognito to enforce OAuth 2.1 ensures that only authenticated and authorized users can access the MCP server. This satisfies security and compliance requirements when the MCP server handles sensitive user information. Cognito integrates natively with API Gateway, removing the need for custom authentication logic and reducing operational overhead.

Option A lacks user-level authorization controls. Option B and Option D rely on STDIO transport, which is intended for local or tightly coupled processes and is not suitable for distributed, serverless architectures. Option D also introduces security risks by handling credentials through environment variables.

Therefore, Option C best meets the requirements for secure access control, scalability, and correct MCP integration in an AWS-based AI agent architecture.

Option A is the most complete solution because it provides a fully automated canary strategy with staged traffic shifts, metric-based decisioning, and automatic rollback, all using managed AWS services. The requirement emphasizes automation, health-based traffic progression, and zero manual intervention to revert if performance degrades.

AWS Step Functions is well suited for orchestrating controlled deployment workflows with deterministic stages, waits, and conditional branches. By shifting traffic in stages and pausing for observation windows, the system can evaluate real-time inference latency and error rates before promoting more traffic to the new model version. Amazon CloudWatch provides the necessary real-time metrics and alarms for latency and error monitoring.

Invoking a Lambda function to evaluate CloudWatch metrics enables dynamic logic: increase traffic if thresholds remain healthy, reduce traffic or roll back if error rates rise or latency exceeds limits. Step Functions can halt the deployment by stopping progression or triggering rollback steps immediately, meeting the requirement for automated revert without human action.

Amazon EventBridge provides reliable automation triggers when a new model version is released, ensuring the deployment process is event-driven and repeatable.

Option B depends on “external logic,” which introduces operational risk and does not guarantee automatic rollback without custom systems. Option C incorrectly uses SageMaker endpoint variants to represent Bedrock model versions, which is not the intended integration model. Option D is overly indirect and operationally complex, using log pipelines and automation runbooks instead of direct metric-based traffic control.

Therefore, Option A best meets the requirements for automated gradual traffic shifting, real-time monitoring, and automatic rollback for Amazon Bedrock model deployments in a canary strategy.