Blocking Harmful Prompts and Streaming Bedrock Guardrail Filters

Why the Answer Is Correct

Option A is the only choice that satisfies all four requirements simultaneously: a Lambda step calls the ApplyGuardrail API to reject harmful prompts before any model token is generated, the InvokeModelWithResponseStream step attaches the guardrail so streamed output is filtered as it is produced, and a second Lambda step runs ApplyGuardrail against the response for post-checking. Flagged items are handed to an Amazon SQS queue, which is the standard mechanism for routing cases to a human review workflow. Finally, the bedrock:GuardrailIdentifier IAM condition key makes guardrail attachment mandatory at the API call level, so no developer can bypass the approved safety policy. That combination guarantees that every inference, not just most inferences, complies.

Why the Other Options Are Wrong

Option B calls ApplyGuardrail before inference but then uses InvokeModel without streaming, which fails the explicit requirement to filter streamed model outputs in real time, and it delegates token suppression to the client UI where a user can simply inspect the raw response. Option C drops the pre-inference step entirely, so a harmful prompt still consumes model resources and is only caught after generation, directly contradicting the 'block harmful prompts before model invocations' requirement. Option D includes the right API sequence but relies on code reviews and other process controls instead of IAM enforcement, leaving compliance dependent on human discipline rather than a technical guarantee for every call.

Community Comment Notes

As TNT87 noted, option A's pre-check validation with Lambda and the ApplyGuardrail API 'ensures that harmful prompts are blocked immediately before consuming unnecessary model generation resources.' That reasoning matches the exam's emphasis on blocking before invocation, and the same comment's endorsement of answer A aligns with this analysis.