AIF-C01 Practice Question 49: Security Scoping Matrix
AWS Certified AI Practitioner (AIF-C01) · Test 5 · question 9 of 10
A company builds its own customer support chatbot. The chatbot calls a third-party foundation model through the Amazon Bedrock API and uses retrieval-augmented generation (RAG) over the company's own documents, but the company does not fine-tune or train any model. Under the AWS Generative AI Security Scoping Matrix, which scope does this use case fall into?
Show answer and explanation
Answer:
The Generative AI Security Scoping Matrix sorts use cases into five scopes. In Scope 3: Pre-trained models, an organization builds its own application using an existing third-party foundation model, integrated through an API. AWS's example is almost this exact case: a customer support chatbot that uses RAG over your own data and a Claude model through Amazon Bedrock APIs (option A). Scopes 3 to 5 are the builder positions, where the organization has more control over its data and more responsibility for protecting it.
- B is wrong because Scope 2 means *using* a third-party enterprise application with generative AI features built in, such as a scheduling tool that drafts meeting agendas. The company here built its own application, so it's a builder, not a buyer. - C is wrong because Scope 4 means refining a third-party model by fine-tuning it with business-specific data. RAG adds context at request time but doesn't create a new, fine-tuned model. - D is wrong because Scope 5 means training a model from scratch on data you own or acquire.
Reference: Generative AI Security Scoping Matrix