How to Read a Scenario Question

A professional-level AWS question is rarely a knowledge test. It is usually a constraint-matching test. Two, three or even all four options are technically capable of solving the stated problem; only one satisfies the constraint buried in the stem. If you read the question looking for "which service does RAG", you will find three answers that do RAG and then guess. If you read it looking for the constraint, the answer usually falls out in fifteen seconds.

Read the last sentence first

The constraint is almost always in the final clause, and it is almost always one of a small set of recurring phrases. Learn to recognise them on sight.

Phrase in the stem	What it is really asking	What it eliminates
"with the LEAST operational overhead"	Pick the most managed option	Anything with EC2, self-hosted vector databases, custom containers, or a Lambda you have to write when a managed feature exists
"MOST cost-effective"	Pick the option that avoids standing capacity	Provisioned Throughput, always-on OpenSearch capacity, over-provisioned instances — unless volume is genuinely constant
"LOWEST latency" / "real time"	Pick the synchronous path with the shortest hop count	Batch inference, Step Functions Standard workflows, queue-based decoupling, cross-Region calls
"must not traverse the public internet" / "stay within the VPC"	Private connectivity	Public endpoints; the answer involves an interface VPC endpoint (AWS PrivateLink) or in-VPC hosting
"must survive the loss of an AWS Region"	Multi-Region design	Anything single-Region; look for cross-Region inference profiles, replicated data stores, Route 53 failover
"must be auditable" / "regulator requires evidence"	An immutable record of what happened	Solutions with no logging; look for CloudTrail, model invocation logging, agent traces, Step Functions execution history
"data must never be used to train" / "must remain in-country"	Data governance and residency	Options that move data across a geography boundary or into a shared service you cannot evidence

A worked reading

"A bank runs a customer support assistant on Amazon Bedrock. Support agents ask free-text questions about a 4,000-page policy handbook that is updated monthly. Answers must cite the source paragraph. The security team requires that no request leaves the bank's VPC. The team has two engineers. Which approach should they use?"

Three constraints, and each one kills a family of answers. "Updated monthly" and "cite the source" mean retrieval, not fine-tuning — a fine-tuned model cannot cite and cannot be cheaply refreshed. "No request leaves the VPC" means interface VPC endpoints for the Bedrock runtime and agent runtime services, not a NAT gateway. "Two engineers" is the operational-overhead signal, which points at a Bedrock knowledge base with a managed vector store rather than a hand-built ingestion pipeline. You have not had to compare embedding models at all.

When two constraints conflict

Sometimes the stem gives you "lowest cost" and "lowest latency" in the same breath. They pull in opposite directions, so decide which is the hard requirement and which is the preference. Hard requirements use "must", "required", "cannot"; preferences use "should", "prefers", "wants to minimise". If a regulator or a security team is named in the stem, that constraint is hard and everything else is negotiable. If the constraint is a business preference, choose the cheapest option that still satisfies every hard requirement.

The trade-off

Constraint-first reading is fast but it can misfire when the stem contains a decoy constraint — a detail that sounds load-bearing and is not, such as naming a programming language or a team size that does not change the architecture. Guard against this by checking that your chosen constraint actually differentiates the options. If all four answers satisfy it equally, it was a decoy; go back and find the one that does not.

# The "least operational overhead" answer to the worked scenario above:
# one managed call that retrieves, generates AND returns citations.
# Note the client is bedrock-agent-runtime, not bedrock-runtime.
import boto3

agent_rt = boto3.client("bedrock-agent-runtime", region_name="eu-west-1")

resp = agent_rt.retrieve_and_generate(
    input={"text": "What excess applies to storm damage on a Tier 2 policy?"},
    retrieveAndGenerateConfiguration={
        "type": "KNOWLEDGE_BASE",
        "knowledgeBaseConfiguration": {
            "knowledgeBaseId": "KB1234ABCD",
            "modelArn": (
                "arn:aws:bedrock:eu-west-1::foundation-model/amazon.nova-pro-v1:0"
            ),
            "retrievalConfiguration": {
                "vectorSearchConfiguration": {"numberOfResults": 5}
            },
            "generationConfiguration": {
                "guardrailConfiguration": {
                    "guardrailId": "abc123guard",
                    "guardrailVersion": "3",
                }
            },
        },
    },
)

print(resp["output"]["text"])

# The citations are what satisfies the "must cite the source" constraint.
for citation in resp["citations"]:
    for ref in citation["retrievedReferences"]:
        print(ref["location"])  # e.g. the S3 URI of the source chunk

# If you only need the chunks (you are generating yourself), call retrieve()
# instead of retrieve_and_generate() — a common two-option discrimination.