Get Your CertAIF-C01PlayCompete
‹ All AIF-C01 questions

AIF-C01 Practice Question 90: Private DNS Bedrock VPC Endpoint

AWS Certified AI Practitioner (AIF-C01) · Test 9 · question 10 of 10

Security, Compliance, and Governance for AI Solutionshard

AWS Lambda functions run in private subnets that have no internet gateway and no NAT device. They must call Amazon Bedrock models. A team creates an interface VPC endpoint for com.amazonaws.us-east-1.bedrock-runtime in those subnets, but the functions' requests to the default Regional hostname bedrock-runtime.us-east-1.amazonaws.com still time out. The team does not want to add any internet path. What is the most likely fix?

Select one answer
Show answer and explanation

Answer:

  • C. Enable the private DNS name on the endpoint, or point the SDK at the endpoint's own URL.

An interface endpoint powered by AWS PrivateLink lets you *"access Amazon Bedrock as if it were in your VPC, without the use of an internet gateway, NAT device, VPN connection, or Direct Connect connection."* However, the default Regional hostname only resolves to the private endpoint if private DNS is enabled: *"If you enable private DNS for the interface endpoint, you can make API requests to Amazon Bedrock using its default Regional DNS name."* Without it, the hostname resolves to public addresses that the subnets cannot reach, so calls time out. Enabling the private DNS name fixes this with no code changes, or the code can pass the vpce-... URL as endpoint_url (option C).

- A is wrong because it adds the internet path that the requirements forbid, and it would bypass the purpose of the private connection. - B is wrong because gateway endpoints exist only for Amazon S3 and Amazon DynamoDB. Bedrock is reached through interface endpoints. - D is wrong because the default endpoint policy allows full access to Amazon Bedrock through the endpoint. A custom policy is only needed to restrict access.

Reference: Use interface VPC endpoints (AWS PrivateLink) to create a private connection between your VPC and Amazon Bedrock

Practice Test 9 ›

Study guides for AIF-C01

AI engineer roadmap 2026: skills, certs and the orderAI engineer roadmap for 2026: skills to learn in order, AI engineer vs ML engineer, which certifications fit each stage, and what to skip.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
How AWS Certification Exams Work: Scoring and RenewalHow AWS certification exams work: levels, booking, question types, unscored questions, scaled scores, pass marks, validity and how recertification works.
What Is Amazon Bedrock? Models, Pricing and GuardrailsWhat is Amazon Bedrock? How a request reaches a model, what happens to your data, token pricing, Guardrails, Knowledge Bases, AgentCore and the exam traps.
Google Cloud Generative AI Leader vs AWS AI PractitionerGoogle Cloud Generative AI Leader vs AWS AI Practitioner: format, cost, topics, free preparation and which certification to take first.
AWS certification cost in 2026, and free ways to prepareWhat every AWS certification costs in 2026 in USD and INR, retake and reschedule rules, the 50% voucher, and the free official ways to prepare.
AWS Generative AI Developer Professional (AIP-C01) guideWhat the AWS Certified Generative AI Developer – Professional (AIP-C01) exam covers - format, cost, the five domains, the services, and how to prepare.
Best AI certifications 2026: AWS, Google, Microsoft, ClaudeThe best AI certifications in 2026 from AWS, Google, Microsoft, Claude and Databricks, by level, with price, status and which one to take first.
Which AWS certification should you get? 2026 roadmapWhich AWS certification to get first, by role and experience, with each exam's status in October 2026, what is changing, and prices in USD and INR.
What Is RAG? How Retrieval-Augmented Generation WorksWhat RAG is and how it works: chunking, embeddings, vector search, hybrid search, reranking, GraphRAG and agentic RAG on AWS, Google and Azure.
Prompt engineering vs RAG vs fine-tuningWhen to use prompt engineering, retrieval-augmented generation, fine-tuning or continued pre-training, compared on cost, freshness, hallucination and privacy.