Before sending customer data to a foundation model, a compliance team requires PII redaction and audit logging of prompts. Which approach addresses both?
A.Send data as-is and hope the model ignores PII
Sending raw PII to an FM is exactly the violation.
B.Apply Bedrock Guardrails PII filters and enable model invocation logging for audit
Correct. Content filtering + invocation logging = both requirements.
C.Rely on the model's terms of service
ToS doesn't redact PII or log your calls.
D.Encrypt the network connection only
TLS protects transit — not content inspection or audit trails.
Why this answer
Guardrails provide managed PII detection/redaction at inference; invocation logging captures prompts/responses to S3/CloudWatch for audit. Encryption in transit protects the wire but doesn't redact content or create audit records.
Correct answer: B · Last reviewed 2026-10-28
Official AWS references
Practice this interactively
Answer without seeing the solution first in the AI Security & Governance practice session.
Practice AI Security & Governance