AWS AI Practitioner Bedrock, RAG and Responsible AI Guide 2026

AIF-C01 Is Now A Bedrock Decision Test, Not An AI Glossary

The AWS Certified AI Practitioner exam is still foundational, but the current AIF-C01 blueprint rewards candidates who can choose the right generative AI pattern under business constraints. The official AIF-C01 exam guide weights Applications of Foundation Models at 28%, Fundamentals of GenAI at 24%, Fundamentals of AI and ML at 20%, Guidelines for Responsible AI at 14%, and Security, Compliance, and Governance for AI Solutions at 14%. Together, those domains make Bedrock, RAG, model adaptation, guardrails, evaluation, and AI governance the high-yield layer of the exam.

AWS also published a 2026 update that many older prep pages do not reflect. The AIF-C01 revisions page lists version 1.1 published April 30, 2026 and adds or clarifies topics such as agentic AI, context engineering, token-based pricing, model distillation, Bedrock Prompt Management, hallucination detection, grounding, AI audit logging, and AgentCore identity and policy concepts. If a third-party page still teaches older weights or treats Bedrock as one service name in a long list, use the AWS guide as the source of truth.

AWS AI Practitioner study guideFree exam prep with practice questions & AI tutor

AIF-C01 Exam At A Glance

These facts come from the official AWS Certified AI Practitioner page, the AIF-C01 exam guide, and the AWS after-testing policies page. Use them as the first thing you memorize, because several older guides still quote wrong numbers.

Current AIF-C01 Domain Weights (Version 1.1, April 30, 2026)

Domain 3 is the heaviest. If you over-invest study time anywhere, invest there, because it is where Bedrock, RAG, prompt engineering, agents, and model adaptation all live. Domains 4 and 5 together add 28%, which is why responsible AI and security are not throwaway sections.

The Bedrock Feature Map Candidates Actually Need

Amazon Bedrock is the managed foundation-model platform behind most AIF-C01 generative AI scenarios. The Amazon Bedrock documentation covers model access, inference, knowledge bases, agents, guardrails, prompt management, model evaluation, customization, and security integrations. For this exam, you do not need to build a production app. You do need to recognize which Bedrock feature solves the described problem.

The trap is that several answers can sound plausible. A company can use an agent with a knowledge base and a guardrail in the same application. The exam asks for the best match to the stated requirement. If the requirement is current documents, think RAG first. If the requirement is API action, think agent. If the requirement is safety policy, think guardrail. If the requirement is model comparison, think evaluation.

RAG, Fine-Tuning, Prompt Engineering, Pretraining, And Distillation

AIF-C01 expects you to compare ways to adapt foundation models. This is where many candidates lose easy points because they choose fine-tuning whenever a question mentions company data.

Prompt engineering changes the instructions, examples, output format, tone, or constraints sent to the model. It is usually the fastest first step. Choose it when the model already has the needed knowledge or capability but needs clearer direction.

Retrieval Augmented Generation retrieves external content and sends the relevant pieces to the model as context. Choose RAG when answers must be grounded in private, recent, or frequently changing information. On AWS, Bedrock Knowledge Bases is the service cue, and RAG is the safer foundational answer than fine-tuning for weekly policy changes, product manuals, support articles, HR documents, or internal knowledge bases.

Fine-tuning continues training a model on task-specific examples. Choose it when you need consistent behavior, style, classification, terminology, or output format that prompting does not reliably produce. Fine-tuning does not magically keep a model current with daily document changes; that is usually a RAG problem.

Pretraining is training a model from scratch or near scratch on massive data. For AIF-C01, it is usually too expensive and too advanced for the target candidate. Distillation transfers behavior from a larger model to a smaller one to improve cost, latency, or deployment tradeoffs while preserving enough quality. The 2026 v1.1 revision explicitly adds model distillation as an exam topic, so expect at least one question comparing distillation with fine-tuning or RAG.

A useful final-review rule: RAG changes what the model can reference, prompting changes how the model responds, fine-tuning changes repeated behavior, distillation changes cost/performance shape, and pretraining changes the base model itself.

Agents Are For Workflows, Not Just Chat

The Agents for Amazon Bedrock documentation explains that agents can orchestrate foundation models, software applications, data sources, and conversations. For exam purposes, an agent is a workflow pattern. It can interpret a request, decide steps, query a knowledge base, call an action group or API, and return a result.

Use an agent when the scenario says the system must do something, not only answer something. A travel assistant that checks policy, searches flights, reserves a booking, and updates a CRM is agent-shaped. A support assistant that only answers from troubleshooting documents may only need RAG. An onboarding helper that creates tickets, looks up policies, and routes approvals is agent-shaped.

The 2026 revision language matters here because AIF-C01 v1.1 explicitly points candidates toward agentic AI, the Model Context Protocol (MCP), multi-agent communication patterns, memory management, tool usage, and workflow orchestration. Amazon Bedrock AgentCore is the newer infrastructure layer: it provides Runtime for serverless agent hosting, Gateway for MCP-compatible tool integration, Memory for managed agent state, Identity for agent authentication, Observability for distributed tracing, Evaluations for quality assessment, and Policy for Cedar-based access control. You do not need to memorize console screens, but you should know that agents introduce more security questions: what tools can the agent call, what data can it retrieve, what identity does it use, how are actions authorized, and how are results logged or reviewed?

Guardrails, Grounding, And Responsible AI Controls

Responsible AI questions are not solved by vague words like ethical or unbiased. They test whether you can name the risk and pick a mitigation. Bias and fairness deal with uneven outcomes across groups. Explainability and transparency deal with stakeholder understanding and disclosure. Privacy and security deal with sensitive data, access, retention, and leakage. Safety deals with harmful output, prompt injection, hallucination, and misuse. Human-centered design adds oversight, feedback, appeal, and appropriate human review.

Amazon Bedrock Guardrails is a high-yield service for this domain. The Bedrock Guardrails documentation describes configurable safeguards for generative AI applications, and the official policy types are the exact list you should memorize for AIF-C01:

• Content filters detect and filter harmful text or image content in prompts and model responses across categories: Hate, Insults, Sexual, Violence, Misconduct, and Prompt Attack.
• Denied topics let you block a defined set of undesirable topics in user queries or model responses.
• Word filters block custom words or phrases (exact match), including a ready-to-use profanity option and competitor-name blocking.
• Sensitive information filters block or mask PII (such as SSN, date of birth, address) in user inputs and model responses, with custom regex support.
• Contextual grounding checks detect hallucinations when model responses are not grounded in the retrieved source or are irrelevant to the user query.
• Automated Reasoning checks validate model response accuracy against a set of logical rules to detect hallucinations, suggest corrections, and surface unstated assumptions.

For AIF-C01, know the purpose of each filter and when to combine them. Guardrails can be applied during inference by specifying a guardrail ID and version in the model invocation, or through the standalone ApplyGuardrail API without invoking a foundation model. You do not need to memorize console screens.

Grounding questions often pair RAG and guardrails. If the problem is hallucination in a document-answering assistant, a stronger answer may combine RAG with contextual grounding or evaluation rather than jump to fine-tuning. If the problem is prohibited advice, toxic content, or PII exposure, guardrails are more direct than model evaluation. If the problem is proving model quality before release, evaluation is the better keyword.

Evaluation Is Separate From Safety Filtering

The Amazon Bedrock evaluation documentation covers evaluating models and knowledge bases, including automated and human evaluation options. The v1.1 revision now references human-in-the-loop evaluation explicitly, so expect a question contrasting human review with automated benchmarks. The RAG evaluation documentation is especially relevant because AIF-C01 revisions call out hallucination, grounding, and business-objective metrics.

Keep the categories separate. Guardrails intervene during use. Evaluation measures quality before or during improvement cycles. Monitoring and logging give operational visibility. Human review provides judgment when risk, ambiguity, or business context matters. A question that asks how to compare two models for answer quality points to evaluation. A question that asks how to block unsafe responses points to guardrails. A question that asks how to prove the application is auditable points to logging, traceability, and governance controls.

Classic ML metrics can still appear, but generative AI adds quality and business metrics. Accuracy, precision, recall, F1, BLEU, ROUGE, latency, cost per interaction, task completion rate, user satisfaction, hallucination rate, groundedness, toxicity, and LLM-as-a-judge are different signals. The right metric depends on the task. A summarization assistant, a retrieval assistant, and a classification workflow do not all use the same primary metric.

Security, Compliance, And Governance Scenario Cues

AI security starts with normal AWS security. Use IAM roles, policies, and least privilege. Encrypt data at rest and in transit. Use private connectivity where appropriate. Log activity. Apply the shared responsibility model: AWS secures the cloud infrastructure and managed service foundation, while the customer remains responsible for data, identities, prompts, retrieved context, application access, outputs, and business use.

AI-specific risks add another layer. Prompt injection tries to override instructions or leak data. Data leakage can happen through prompts, retrieved documents, logs, outputs, or excessive permissions. Hallucinations create confident false answers. Toxicity and unsafe guidance can harm users. Model misuse can create policy, legal, or compliance exposure.

AIF-C01 answer choices often mix quality, safety, and access controls. Read the requirement first. If the phrase is least privilege, choose IAM or role-based access controls. If it is sensitive information in prompts or responses, choose PII filtering, encryption, data handling, or access controls. If it is harmful content, choose guardrails. If it is false answers from a knowledge base, choose RAG quality, grounding, or evaluation. If it is auditability, choose logging, traceability, review, and governance.

A One-Week Review Loop For This Topic

Day one: read the official AIF-C01 guide and the revision page. Write the current weights: 20%, 24%, 28%, 14%, 14%. Mark every new 2026 term you cannot explain in one sentence.

Day two: build a Bedrock feature map. Include foundation models, Knowledge Bases, Agents, Guardrails, prompt management, model evaluation, customization, and security controls. For each, write one scenario where it is correct and one where it is a distractor.

Day three: drill RAG, prompting, fine-tuning, pretraining, and distillation. Most misses should become one-line corrections such as: private changing documents means RAG, not fine-tuning.

Day four: drill responsible AI. For every question, label the risk before choosing the service: bias, privacy, harmful content, hallucination, prompt injection, governance, or auditability.

OpenExamPrep AIF-C01 practicePractice questions with detailed explanations