Get Your CertDatabricks Certified Generative AI Engineer AssociatePlayCompete
‹ All Databricks Certified Generative AI Engineer Associate questions

Databricks Generative AI Engineer Associate Practice Question 9: AI Gateway PII Guardrail

Databricks Certified Generative AI Engineer Associate · Test 1 · question 9 of 10

Governancemedium

A customer-facing chat app calls a Foundation Model APIs pay-per-token endpoint in non-streaming mode. Customers sometimes paste credit card numbers into their messages. Compliance requires that card numbers never reach the model and never appear in its replies. Product management also requires that the conversation continue normally rather than return an error to the customer.

How should the engineer configure the endpoint?

Select one answer
Show answer and explanation

Answer:

  • B. Enable AI Gateway PII guardrails set to Mask on both the input and the output

AI Gateway guardrails on model serving endpoints can detect PII, such as credit card numbers, in requests and responses. Detected PII is then either blocked or masked. Mask replaces the sensitive values before the model sees them and in the reply, so the request still completes. That meets both the compliance requirement and the "keep the conversation going" requirement. Output guardrails are unavailable for streaming, which is why the stem specifies non-streaming mode.

A note on naming: the page cited below is now labelled "(legacy)". Databricks' newer Unity AI Gateway applies the same protection through service policies, where the redacting action is called Sanitize rather than Mask. The exam guide still states this objective as using masking techniques as guardrails, which is the terminology this question follows.

Option A meets compliance but fails the product requirement. Block rejects any request or response containing PII, so the customer gets an error instead of an answer.

Option C is wrong. Rate limits cap the number of queries or tokens per user. They have no effect on the content of a message.

Option D is wrong. Inference tables log payloads after the model has already processed them. Deleting the rows later means the card numbers still reached the model, and they were briefly stored.

References: Configure governance on model serving endpoints (legacy); How to safeguard AI workloads with Unity AI Gateway guardrails (Databricks)

Practice Test 1 ›

Study guides for Databricks Certified Generative AI Engineer Associate

AI engineer roadmap 2026: skills, certs and the orderAI engineer roadmap for 2026: skills to learn in order, AI engineer vs ML engineer, which certifications fit each stage, and what to skip.
NVIDIA AI certifications 2026: GenAI, agentic and infraNVIDIA AI certifications in 2026: generative AI, agentic AI and infrastructure exams, with codes, levels, prices, formats and first choices.
Databricks Generative AI Engineer Associate exam guideWhat the Databricks Generative AI Engineer Associate exam covers: format, US$200 price, domains, free Fundamentals badge and preparation.
Best AI certifications 2026: AWS, Google, Microsoft, ClaudeThe best AI certifications in 2026 from AWS, Google, Microsoft, Claude and Databricks, by level, with price, status and which one to take first.
What Is RAG? How Retrieval-Augmented Generation WorksWhat RAG is and how it works: chunking, embeddings, vector search, hybrid search, reranking, GraphRAG and agentic RAG on AWS, Google and Azure.
Prompt engineering vs RAG vs fine-tuningWhen to use prompt engineering, retrieval-augmented generation, fine-tuning or continued pre-training, compared on cost, freshness, hallucination and privacy.